Organizations

List the organizations the caller belongs to, including the caller's effective org permissions and assignable project-permission ceiling in each organization. Membership alone admits an organization onto this list; no additional organization permission is required. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

Create a non-personal organization and seat the caller as its initial admin. No existing organization permission is required because this route creates the org context itself. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

Read one organization. The caller must be a seated member holding read:organization. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

Rename one organization. The caller must be a seated member holding write:organization. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not. The name is trimmed and validated (non-empty, no control characters, bounded length); the stored value is the trimmed one.

Delete one organization after the guarded project and resource checks pass. The caller must be a seated member holding delete:organization. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

The organization's entitlements as a full catalog map (every catalog key present, true when held) plus whether the platform enforces them at admission. The caller must be a seated member holding read:organization. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

Return the fully evaluated feature-flag map for one organization. The caller must be a seated member holding read:organization, which every catalog role implies. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

Mint a WorkOS Admin Portal link where the organization's IT admin configures single sign-on (intent: sso) or directory sync (intent: dsync). The link expires five minutes after issuance. The caller must be a seated member holding write:sso; the organization needs the sso entitlement (Enterprise plan) where entitlement enforcement is on. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

List the SSO connections configured for the organization in the WorkOS Admin Portal. An organization not yet linked to WorkOS has none. The caller must be a seated member holding read:sso; the organization needs the sso entitlement (Enterprise plan) where entitlement enforcement is on. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

Effective sandbox limits for one organization with their source (assigned on the organization, the platform default, or unlimited) and current usage: global totals for the soft tier, and the reserved GPU and Windows counts for the strict tier. A limit refusal at admission is a 429 whose envelope code is LIMIT_EXCEEDED, with limit, current and max as extras. The caller must be a seated member holding read:organization. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

Set or clear the organization's own max_timeout_secs, the one self-service limit: a number in 1..= the platform maximum to cap every sandbox timeout_secs under it, or null to inherit the platform maximum. A cap above the platform maximum is an operator assignment and is refused here. The caller must be a seated member holding write:organization. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

The organization's OTEL forwarding config (PLAN-ORG-OTEL-CONFIG.md): the tenant's OTLP/HTTP endpoint and the NAMES of its request headers — header values are write-only and never returned. The caller must be a seated member holding read:organization. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

Remove the organization's OTEL forwarding config; sandbox telemetry stops being forwarded. Idempotent. The caller must be a seated member holding write:organization. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

Replace the organization's OTEL forwarding config: the OTLP/HTTP endpoint and the request headers to send (header values are write-only). The whole config is replaced; an unknown body field is a 400. The caller must be a seated member holding write:organization. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

Turn the proxy's preview warning page off or on for every sandbox preview of the organization. The caller must be a seated member holding write:organization; turning the page off (disabled: true) additionally needs the preview_warning_opt_out entitlement (Team plan and above) where entitlement enforcement is on. Only an OIDC user JWT is admitted on this route; dtno_ organization API keys are not.

The caller's own resolved principal in one organization: its kind (user or org_key), identity and the canonical-order org permission strings it holds. No permission beyond membership (users) or key scoping (org keys) is required — it reveals only the caller's own grants. A non-member user, or an org key scoped to another organization, is a 404. This is one of the two management routes that admit a dtno_ organization API key.