Billing summary for a workspace

The PLAN is the OWNER's — a workspace's billing account is whoever owns it, quota pools at that account, and the plan is what sizes the pool. The subscription STATUS and invoices are the caller's own. workspace_meta.plan is a database-maintained mirror for Kairos and is not what this reports.

Prefer this over GET /v2/billing whenever you are rendering a particular workspace: the caller is not always its owner.

self_serve_checkout reports whether this deployment can take a payment RIGHT NOW, at the price the pricing page shows. It is true only when a payment processor is wired AND its configured prices reconcile with the published catalog — amount, currency, and monthly interval. When it is false the checkout and portal routes answer 503 not_configured, and a client should hide Upgrade / Manage billing and offer a contact route instead.

It is deliberately NOT just "is Stripe configured": a price edited in the Stripe dashboard takes the button away rather than breaking it, which is the difference between a contact route and a failed checkout.

Requires the billing:read scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying billing:read is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which does NOT include billing:read — mint a key with it explicitly (POST /v2/workspaces/{id}/keys).