---
title: "Get organization entitlements"
method: GET
path: "/org/entitlements"
tags: ["Organization"]
---

# Get organization entitlements

`GET /org/entitlements`

## Request

- Base URL: `https://api.onkernel.com`
- URL: `https://api.onkernel.com/org/entitlements`
- Auth: HTTP bearer

Get the authenticated organization's effective feature access and constraints after applying its plan, active trial treatment, plan status, and organization-specific overrides. Null constraint values mean unlimited.

## Response `200`

Effective organization entitlements

- OrgEntitlements: Effective feature access and constraints for the authenticated organization. Values already include trial treatment, plan status, and organization-specific overrides; consumers should use these resolved values instead of comparing plan IDs.
  - `features` OrgEntitlementFeatures, required
    - `browser_extensions` OrgBrowserExtensionEntitlement, required
      - `enabled` boolean, required: Whether browser extensions are available.
      - `max_stored_per_org` integer, nullable, required: Maximum active custom extensions the organization may store. Null means unlimited. Loading stored extensions into a browser is not plan-limited.
    - `browser_pools` OrgEntitlementFeature, required
      - `enabled` boolean, required: Whether the organization is entitled to use this feature.
    - `browser_replays` OrgBrowserReplayEntitlement, required
      - `enabled` boolean, required: Whether browser replay recording is available.
      - `retention_days` integer, required: Number of days browser replays are retained, matching the replay reaper policy.
    - `credential_providers` OrgEntitlementFeature, required
      - `enabled` boolean, required: Whether the organization is entitled to use this feature.
    - `credentials` OrgEntitlementFeature, required
      - `enabled` boolean, required: Whether the organization is entitled to use this feature.
    - `custom_proxies` OrgEntitlementFeature, required
      - `enabled` boolean, required: Whether the organization is entitled to use this feature.
    - `file_io` OrgEntitlementFeature, required
      - `enabled` boolean, required: Whether the organization is entitled to use this feature.
    - `gpu` OrgEntitlementFeature, required
      - `enabled` boolean, required: Whether the organization is entitled to use this feature.
    - `managed_auth` OrgManagedAuthEntitlement, required
      - `enabled` boolean, required: Whether managed auth is available.
      - `health_check_interval_default_seconds` integer, required: Effective interval in seconds used when a connection is created without an explicit health-check interval.
      - `health_check_interval_max_seconds` integer, required: Maximum accepted managed auth health-check interval in seconds.
      - `health_check_interval_min_seconds` integer, required: Minimum accepted managed auth health-check interval in seconds.
      - `max_connections` integer, nullable, required: Maximum active managed auth connections in the organization. Null means unlimited.
    - `managed_proxies` OrgEntitlementFeature, required
      - `enabled` boolean, required: Whether the organization is entitled to use this feature.
    - `profiles` OrgEntitlementFeature, required
      - `enabled` boolean, required: Whether the organization is entitled to use this feature.
    - `proxy_bypass_hosts` OrgEntitlementFeature, required
      - `enabled` boolean, required: Whether the organization is entitled to use this feature.
    - `search` OrgEntitlementFeature, required
      - `enabled` boolean, required: Whether the organization is entitled to use this feature.
    - `vaults` OrgEntitlementFeature, required
      - `enabled` boolean, required: Whether the organization is entitled to use this feature.
  - `limits` OrgEntitlementLimits, required
    - `default_max_concurrent_invocations_per_app` integer, required: Effective org-level default concurrent invocation ceiling for apps without an app-specific override. App-specific overrides are not represented here.
    - `max_concurrent_browsers` integer, required: Effective organization-wide ceiling shared by on-demand browsers and browser pool reservations.
    - `max_concurrent_invocations` integer, required: Effective organization-wide concurrent app invocation ceiling.
    - `max_vaults` integer, nullable, required: Maximum non-deleted vaults allowed org-wide across all projects. Null means unlimited. The vaults feature flag still controls access.
  - `plan` OrgEntitlementPlan, required
    - `effective_id` 'FREE' | 'HOBBYIST' | 'START_UP' | 'ENTERPRISE', required: The plan used to resolve plan-based access. Active trials resolve to START_UP regardless of the contractual plan.
    - `id` 'FREE' | 'HOBBYIST' | 'START_UP' | 'ENTERPRISE', required: The organization's contractual plan identifier. Use the resolved feature and limit values, not this field, for access decisions.
    - `is_trialing` boolean, required: Whether the organization is currently within its trial period.
    - `status` 'NEEDS_PAYMENT_METHOD' | 'ACTIVE' | 'CANCELED' | 'UNPAID', nullable, required: Current billing status of the contractual plan, or null when no billing status is recorded. Status-sensitive feature values already account for it.
    - `trial_ends_at` string, date-time, nullable, required: Configured trial end timestamp, or null when the organization has no trial. A past timestamp may be returned when is_trialing is false.

## Other responses

- `401`: Unauthorized – missing or invalid authorization token
- `500`: Internal Server Error

## Changes

- **2026-10-16** `03b369edee49`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/kernel/apis/kernel-api/changes/org/entitlements/get.md)

---

[API](https://skmtc.dev/kernel/apis/kernel-api.md) - [All operations](https://skmtc.dev/kernel/apis/kernel-api/llms.txt) - [OpenAPI document](https://skmtc.dev/kernel/apis/kernel-api/revisions/0f6cf4f58fe6?raw)