Entitlements for internal apps

Overview#

Internal Global Software Services apps (and your own integrations) can ask CentraPoint what the organisation behind an API key is entitled to: its plan, the built-in feature flags and limits, and any custom features defined by the platform. Use this to switch features on or off in your app instead of hard-coding plan names.

How entitlements are resolved#

1. The organisation's plan sets the built-in flags and limits.
2. Platform administrators can override individual flags and limits for one organisation; overrides are already applied.
3. Custom features take their value from the organisation's own override (if it hasn't expired), otherwise from the plan, otherwise they are off.

Get your organisation and entitlements#

Needs the REST API in your plan. Returns the organisation, plan, entitlements and the calling key:

curl -X GET "https://app.centrapoint.co.za/api/v1/me" \
  -H "Authorization: Bearer $CENTRAPOINT_API_KEY"

{
  "tenant": {
    "id": "cmg0t1n2t0001ten0001abcd",
    "name": "Acme (Pty) Ltd",
    "slug": "acme",
    "accountNumber": "CP100042",
    "status": "active",
    "kind": "customer",
    "billingCycle": "monthly",
    "trialEndsAt": null,
    "currentPeriodEnd": "2026-10-31T21:59:59.000Z"
  },
  "plan": {
    "code": "business",
    "name": "Business"
  },
  "entitlements": {
    "features": {
      "featInvoicing": true,
      "featPaymentLinks": true,
      "featRecurring": true,
      "featDebitOrders": true,
      "featReconciliation": true,
      "featApi": true,
      "featAuditLog": true,
      "featCustomBranding": true,
      "featPrioritySupport": false,
      "featAccounting": true,
      "featReports": true,
      "featCustomerPortal": true,
      "featCoupons": true
    },
    "limits": {
      "maxUsers": 10,
      "maxProviders": null,
      "maxCustomers": null,
      "maxMonthlyTransactions": null,
      "maxApiKeys": 5,
      "maxMandates": 500
    },
    "custom": {
      "sms_notifications": {
        "enabled": true,
        "limit": 1000,
        "label": "SMS notifications"
      }
    }
  },
  "apiKey": {
    "name": "Production",
    "prefix": "cp_1a2b3c4d",
    "createdAt": "2026-09-01T10:00:00.000Z"
  }
}

Check one entitlement#

key is a built-in flag, a built-in limit or a custom feature key (a letter followed by 1–63 letters, digits or underscores). Returns { key, enabled, limit }, or 404 not_found for an unknown key.

curl -X GET "https://app.centrapoint.co.za/api/v1/entitlements/sms_notifications" \
  -H "Authorization: Bearer $CENTRAPOINT_API_KEY"

{
  "key": "sms_notifications",
  "enabled": true,
  "limit": 1000
}

Built-in keys#

Custom features#

Platform super administrators define custom features for internal apps under Admin → Features: a lower-case key (e.g. sms_notifications), label, description, category and kind (flag or limit). Each plan can include a feature (with a limit for limit-type features), and individual organisations can be given an override with an optional expiry date. Only active custom features are returned.

Using entitlements in your app#

• Fetch /api/v1/me when a user signs in to your app and cache the result for a few minutes.
• Check limits against your own usage counts; null means unlimited.
• Treat 404 from /api/v1/entitlements/{key} as "not entitled": the key was never defined or the custom feature was deactivated.
• See Authentication for API keys and rate limits.