API Reference

What signing in and up offers: {providers, captcha: {provider, siteKey} | null, legal: {termsVersion, privacyVersion}}.

Begin a sign-up with {email, password, name?, referralCode?, agree: true, marketingOptIn?, captchaToken}: a 6-digit code is emailed, valid 10 minutes. An address is emailed at most once a minute and five times a day: sooner, 429 rate_limited, with reason: "code_just_sent" within the minute. Answers 202 {attemptId, email, codeExpiresAt}. Passwords are 8–128 characters (72 bytes at most), not a common password and not the email address (400 weak_password).

Finish it with {attemptId, code}: opens the account, its address verified, and answers 201 {user}. Five wrong codes end the sign-up (400 code_attempts_exceeded). When the Terms or the Privacy Policy changed since the sign-up began: 409 legal_version_outdated with the versions in force, nothing used up; send the code again with {termsVersion, privacyVersion} once the person agreed to them.

Email a new code with {attemptId}; at most one a minute and five a day per address (within the minute, 429 with reason: "code_just_sent").

Exchange {email, password} for {user, token}, the token a JWT for scripts. After repeated failures a CAPTCHA token is needed as well (400 captcha_required).

Email a password reset link with {email, captchaToken}; always 202, whether or not an account has the address.

Set a new password with {token, password} from the link (valid once, for 30 minutes); every existing session and JWT of the account ends.

A link that verifies the account’s email address, opened in a browser: it changes nothing, and answers 303 to the console’s confirmation page, which confirms with the POST below. Mail scanners that open the link verify nothing.

Verify the address with {token} from the link (valid 24 hours): {status: "verified" | "already_verified"}, and nothing else about the account. 409 token_used, 400 token_expired, 400 invalid_token. Verifying grants the trial credit when its other condition, a card on file, is met.

Email the signed-in user a new verification link: 202 {sent: true, email, expiresAt}. One a minute and five a day (429 rate_limited with Retry-After); 409 email_already_verified; 503 email_unavailable where the deployment sends no email.

A browser’s sign-in with a provider (google, microsoft or x): ?intent=signin (with ref and next), link or reauth. The round trip is bound to the browser by an HttpOnly cookie (__Host-rt_oauth over https) and uses PKCE (and, for Google and Microsoft, an OpenID Connect nonce); the callback, GET /v1/auth/:provider/callback, signs the browser in or sends it to complete a sign-up, and a failure comes back as /console/login?error=<code>.

Complete a sign-up that began with a provider, in the browser that holds it, with {email?, agree: true, marketingOptIn?, referralCode?, captchaToken}: 201 {user} for the address the provider vouches for, else a code is emailed (202) and /v1/auth/signup/verify finishes it. GET /v1/auth/signup/pending says who is signing up.

A nonce for signing in with a Web3 wallet (Sign-In with Ethereum, EIP-4361), where the deployment offers it: {nonce}, valid 5 minutes and once. ?intent=link or reauth need the browser’s session.

Sign in with {message, signature, intent}: an EIP-4361 message for this site carrying the nonce, signed by the wallet (an ordinary wallet’s signature is checked offline). Signs the browser in (200) or begins a sign-up to complete (202, a wallet has no email address); 400 wallet_expired or wallet_failed otherwise.

Sign out: ends the session the cookie names and clears the cookie; with a JWT, ends the session it was issued with, and so the JWT. 204.

Prove again who is using a console session with {password}, before a sensitive action within the next 10 minutes. 204; 403 invalid_credentials; 400 session_required with a bearer JWT (sign in again instead).

Read the current account: {user, legal, orgs:[{orgId,name,role}], orgRemovals:[{id,orgId,orgName,removedAt,contact,disabledKeys}]}. orgRemovals lists the organizations an owner or admin took the caller out of in the last 90 days (not one they were added back to since), with whom to ask (contact, or null) and how many of the keys they issued were disabled with the removal (disabledKeys, 0 when none were).

The account’s live sessions: {sessions:[{id, createdAt, lastSeenAt, ip, userAgent, method, current}]}.

End one of the account’s sessions. 204; 404 session_not_found. Ending another one than the caller’s needs a sign-in or re-authentication within 10 minutes, else 403 reauth_required.

End every other session, and every JWT issued with one: {revoked}. The console's own session is replaced by a fresh cookie, which ends the JWT its sign-in returned. Needs a sign-in or re-authentication within 10 minutes, else 403 reauth_required.

The account’s sign-in methods: {identities:[{id, provider, display, email, createdAt, lastUsedAt}], hasPassword}.

Remove a sign-in method. 204; 409 last_sign_in_method when it is the only way in; needs a sign-in or re-authentication within 10 minutes (403 reauth_required).

Accept the Terms of Service and Privacy Policy in force with {termsVersion, privacyVersion} (the versions /v1/me names): {legal}; 409 legal_version_outdated for any other version.

Give or withdraw consent to marketing email with {marketingOptIn}: {preferences: {marketingOptIn}}. Each change is recorded with when it was made; agreeing again keeps the first time.

Claim the trial credit when both its conditions, a verified email address and a card on file, came true while the trial was switched off; otherwise it is granted by itself when the second is met. {outcome, trial}: outcome is granted, or why not (already_granted, email_unverified, no_card, not_eligible, refused, disabled, …), and trial the trial’s status, as /v1/me shows it.

Change the display name with {name} (1–80 characters).

Change the password with {currentPassword, newPassword}. Every other session and JWT ends; the answer carries a new token.

Change the account’s email address with {email}: a 6-digit code is emailed to the new address, valid 10 minutes (202 {changeId, email, codeExpiresAt}), at most one a minute and five a day per address. Needs a sign-in or re-authentication within 10 minutes (403 reauth_required); 400 disposable_email. POST /v1/me/email/verify with {changeId, code} changes it: every other session and JWT ends, the answer carries a new token, and the old address is told.

A copy of the personal data Token Engine holds about the account, as one JSON document: profile, sign-in methods, sessions of the last six months, API key metadata (with where each key was last used from), organizations, legal acceptances, consents, trial, balance, cards and invoices. It holds no secret. Needs a sign-in or re-authentication within 10 minutes, else 403 reauth_required; five an hour, then 429 with Retry-After.

Close the account with {confirmEmail}, its address typed. Needs a sign-in or re-authentication within 10 minutes. Every API key and session ends at once; 409 with blockers while it is the only owner of an organization with other members, its balance is below zero, or reseller commission or a payout is open. Its personal details are anonymised 30 days later.

List personal API keys, or an organization’s with orgId. expiringWithin=<days> (1 to 365) lists only the keys not yet expired whose expiry comes within that many days, soonest first; status=active|disabled|expired only the keys in that state. To whoever may manage a key — its own user, an organization’s owners and admins, or the member who issued it — each key also shows lastUsed: {at, ip, userAgent, requestId, model} of the request that last recorded its use (at most once a minute; null before any), kept six months at most.

One key as the list shows it, to whoever may see it there.

A key’s daily trend: {keyId, from, to, rows}, one row per UTC day of the last days days (1 to 90, 30 when left out, today so far included) with its requests, failed requests, tokens and chargeCredits (and each token sum and the charge as an exact decimal string, …Exact), as /v1/usage?group_by=day counts them, for this key alone.

Disable, enable or delete several keys at once with {action: "disable"|"enable"|"revoke", ids: […], orgId?}: 1 to 100 keys of the personal account, or of the organization orgId names. All of them change, or none: a key that is not the account’s is 404 key_not_found, and the rules of PATCH and DELETE apply to each (403 insufficient_role, 403 key_held). The answer is {action, changed, unchanged}: the ids it changed, and those already as asked. Each key stops, or works again, from its next request.

Create keys with {name, orgId?, expiresAt?, spendCap?: {credits, window: "daily"|"monthly"|"total"}, allowedModels?, quantity?} (the older monthlyQuotaCredits is still accepted). An expiresAt must be in the future: one now or earlier is refused with 400 invalid_request (omit it, or pass null, for a key that never expires). allowedModels takes exact ids of models GET /v1/models lists and vendor/* wildcards (omit it, or pass ["*"], for every model); an id it does not list is refused with 400 invalid_request, as a mistyped one is, and a request for any other model is refused with 403 model_not_allowed. A key belongs to the personal account by default; name an organization and its usage is charged to that organization’s shared balance. allowedModels takes exact catalog model ids and vendor/* wildcards (omit it, or pass ["*"], for every model); any other model is refused with 403 model_not_allowed. A quantity above one returns {data:[…]}. This response is the only time a key’s secret is shown.

Rename, disable or re-enable a key, or change its expiry (to a time in the future, or null for none), spend cap, allowed models or routing defaults. A model the key already allows, or falls back to, is kept when sent back with the rest, even once GET /v1/models no longer lists it; one added is checked as on creation. A deleted key is 404 key_not_found.

Give a key a new secret and keep everything else — its id, limits, budgets, routing and usage — with {overlapSeconds?}: how long the replaced secret keeps working, a whole number of seconds from 0 (it stops at once) to 86400, an hour when left out. After that the old secret is refused with 401 invalid_api_key, saying it was rotated; rotating again during an overlap stops the earlier secret at once. The answer is the key as listed — while the old secret works, with its previousKeyPrefix and previousKeyExpiresAt — and its new secret, shown this once. Whoever may change a key may rotate it; an expired key is refused with 409 key_expired.

Revoke one of the caller’s API keys.

Create an organization with {name}; the creator becomes its owner.

List the organizations the caller belongs to, with their role.

List an organization’s members; the caller must be one.

Add an existing user with {email, role}; owner or admin only. The person added is emailed the organization’s name, their role and who added them.

Change a member’s role with {role: "owner" | "admin" | "member"}: the membership, {id, userId, orgId, role}. Granting or revoking admin or owner is an owner’s call (403 insufficient_role); anyone may lower their own role, nobody raise it (403 cannot_escalate_own_role). The last active owner cannot be demoted (409 last_owner); 404 member_not_found. The member is emailed when someone else changes their role.

Remove a member: owners remove anyone, admins plain members; removing yourself is leaving. 204. Add ?disableKeys=true to disable, in the same step, every key of the organization’s that the member issued and that still works: 200 {disabledKeys:[{id,name,keyPrefix}]}; each stays disabled until an owner or admin enables it again. Otherwise the organization’s API keys are the organization’s and keep working: revoke any the member may still hold a copy of. Someone removed by someone else is emailed who removed them.

Leave an organization. 204; 409 last_owner for its last active owner: make someone else an owner first.

The organization’s activity, newest first, for its owners and admins: who added or removed members, changed roles, keys, budgets, rate limits, routing defaults or content logging, and credit adjustments. ?since=&until= (ISO 8601), action or actionPrefix (member.), limit (up to 100) and offset: {data:[{id, createdAt, action, targetType, targetId, actor, before, after, reason}], total}. actor.kind is member (with its email and name), former_member, staff (Token Engine staff, never named) or system; no client address is shown, before/after only for the changes listed above and only their own settings, and reason is null (an operator’s reason is not shown). 403 insufficient_role for a plain member.

The same activity as CSV, newest first, at most 50,000 rows; X-RunToken-Export-Rows and X-RunToken-Export-Truncated say how many and whether more matched. The export appears in the activity as audit.export.

List the enabled models this key may call, their providers and customer prices, and each model’s license_url (null when none is recorded), the API endpoints it is served on (api_endpoints), the capabilities its providers serve it with (supports) and when its price took effect (pricing.updated_at): see what a model is served on.

The same catalog for a signed-in session, which the console browses.

One model with the providers serving it (endpoints): each one’s customer price and when it took effect (pricing.updated_at), regions and data policy, its usage policy (policy_url, null when not recorded), whether it is Token Engine First-Party (first_party), the API endpoints it serves the model on (api_endpoints) and the values it takes for each declared parameter (parameters).

What a test message holds while it runs, for the console’s key test: the body is the chat request it will send (at most 16 KB), ?orgId= for an organization’s prices. Answers {"model", "hold"}: the most the request may hold on any deployment of the model at your prices, in credits — the same bound a request’s reservation takes — or null when no deployment would take it. Nothing is sent or charged; 404 model_not_found for an unknown model.

Create an OpenAI-style chat completion, streaming over SSE if asked. A max_tokens (or max_completion_tokens) above the model’s maximum output is refused 400 invalid_request before anything is held or sent. Send an Idempotency-Key to retry without paying twice; below are what a stream cut short is billed, how a reasoning model counts its tokens, and how to ask for a service_tier.

Create an OpenAI-style text completion from a prompt (the legacy completions API), streaming over SSE if asked. A chat-only model answers it through chat.

Create OpenAI-style embeddings with a catalog model that produces them; metered by input tokens.

Create a response with OpenAI’s Responses API (client.responses.create), streaming over SSE if asked. Every chat model serves it through chat completions, and it is billed and limited as the chat request it stands for; what it takes and refuses is in the Responses API.

Create a message with Anthropic's Messages API — what Claude Code and Anthropic's SDKs send — streaming over SSE if asked, on every chat model. It is served through chat completions and billed and limited as the chat request it stands for; POST /v1/messages/count_tokens estimates a request's input tokens. See Anthropic's Messages API and Claude Code.

Totals over the range by group_by: model or key (highest charge first), member (the user who issued each key, by id — '' for keys issued before issuers were recorded; the organization’s members list names them), or day (every UTC day of the range, oldest first, days without requests included). By key and member, every other key (or issuer) the account had in the range — issued before its end, not revoked or expired before its start — follows at zero. Answers {groupBy, from, to, rows: [{key, label, requests, requestsFailed, errorRate, promptTokens, completionTokens, cachedTokens, cacheWriteTokens, totalTokens, chargeCredits, promptTokensExact, completionTokensExact, cachedTokensExact, cacheWriteTokensExact, totalTokensExact, chargeCreditsExact}], refused: {requests, retentionDays, max}}: requestsFailed are the requests that reached a provider and failed, errorRate their share of requests (0 to 1, null without a request); requests refused before any provider are not among requests but counted in refused.requests, of those kept (the latest 100 of 7 days, so at least that many; null when they cannot be read), chargeCredits a number; each token sum and the charge is also given as an exact decimal string under its name with Exact added ("totalTokensExact": "5400000000", "chargeCreditsExact": "10000000000.00000005"), every digit kept where a JSON number would round (past 2^53 tokens, or about 15 significant digits of credits); by key each row also has createdByUserId (null when not recorded); from as clipped to the 12 months. from, to and group_by are required.

The requests themselves, newest first, 50 a page: {data: [{requestId, model, provider, requestKind, promptTokens, completionTokens, cachedTokens, cacheWriteTokens, totalTokens, tokenSource, chargeCredits, latencyMs, ttfbMs, status, errorCode, createdAt}], nextCursor}. Narrow them to a model (its catalog id) or an API key (its id); for the next page send nextCursor as cursor with the same filters.

The request log: the account’s requests, newest first, 50 a page — those served or failed, as /v1/usage/events gives them, and those refused before any provider was called (a disabled or expired key, no credit, a model that does not exist, a rate limit…), kept for 7 days, the latest 100 of an account, and at most 10 a minute of one key (one of them a rate limit’s): {data: [{requestId, createdAt, outcome, status, statusCode, errorCode, message, model, provider, requestKind, apiKey: {id, name, createdByUserId}, promptTokens, completionTokens, cachedTokens, cacheWriteTokens, totalTokens, tokenSource, chargeCredits, latencyMs, ttfbMs}], nextCursor, refusals: {retentionDays, max}}. status is all (the default), succeeded, failed or refused. A refused request has the HTTP statusCode, the errorCode and the message it was answered with, and nothing used or charged. One sent with a key that does not exist, or was deleted, is no one’s, and is not listed.

The account’s usage records over [from, to) as CSV, oldest first, at most 12 months per request and none older than 12 months: created_at, request_id, model, provider, request_kind, status, error_code, api_key_id, api_key_name, prompt_tokens, completion_tokens, cached_tokens, cache_write_tokens, total_tokens, token_source, charge_credits, latency_ms, ttfb_ms. Narrow it to a model (its catalog id) or an API key (its id), as /v1/usage/events. An organization’s with orgId for its members; 404 for any other account.

One request by its id, the X-RunToken-Id header of its answer: {id, status, model, provider, requestKind, tokens: {prompt, completion, cached, cacheWrite, total}, tokenSource, chargeCredits, latencyMs, ttfbMs, errorCode, createdAt}. chargeCredits is what it was charged, a number. 404 not_found for an id that is not the caller’s, or older than 12 months.

One request by its id, served, failed or refused, with what its row in the request log says and more: {requestId, createdAt, outcome, status, statusCode, errorCode, message, stage, model, provider, requestKind, apiKey, promptTokens, completionTokens, cachedTokens, cacheWriteTokens, totalTokens, tokenSource, chargeCredits, latencyMs, ttfbMs, startedAt, finishedAt, ledger, attempts, route}. ledger is the debit its charge is — {transactionId, type: "debit", amountCredits, balanceAfterCredits, createdAt}, exact decimal strings, the amount negative — or null when nothing was charged; attempts how many times it was sent to a provider; route where each attempt went (provider, providerName, firstParty, regions), what it answered and who served it. A failed request’s message says what its error code means; a refused one’s is the sentence it was answered with, found while kept (7 days; an organization’s with orgId). 404 not_found for an id that is not the caller’s, or older than 12 months.

How a request was routed, those routing refused included (an unknown model, no compliant provider, a price ceiling, the credit hold); a request refused before routing — a disabled key, no credit, an invalid body, a rate limit — has no route and answers 404, and is in the request log (GET /v1/requests) instead. Kept for a limited time (7 days by default): {id, runs: [{startedAt, durationMs, model, preferences, excluded, candidates, reservation, attempts, result, …}]}, oldest run first. preferences are the routing settings that applied and where each came from; excluded the providers left out and why; candidates the ones tried in order, with their prices; attempts what each answered; result the status sent and who served it.

Whether the bodies of the account’s requests and their answers are kept: {enabled, enabledAt, retentionDays: 90, available}. Off unless turned on; available says whether the deployment can keep them. An organization’s for its members.

Turn it on or off with {enabled}: the setting as above. While it is on, each request an API key of the account makes is kept, sealed, for 90 days or until deleted, 256 KiB of each part at most; turning it off keeps no new ones and leaves the others. An organization’s, its owners and admins; 503 content_logging_unavailable to turn it on where the deployment cannot keep them.

A kept request and its answer: {id, runId, createdAt, expiresAt, model, requestKind, stream, statusCode, request, response, truncated: {request, response}}. A user reads their own, an organization’s owners and admins its; 404 not_found for any other, or one expired or deleted.

Delete what was kept of a request, under the same rule. 204; 404 not_found once it is gone.

Delete every kept request of the account at once: {deleted}. An organization’s, its owners and admins.

The account’s budgets per window, the current UTC day, the current UTC month and in total: {budgets: {daily, monthly, total}, held: {daily, monthly, total}, canEdit}, each budget null or {credits, spentCredits, reservedCredits, windowStart, resetsAt}. held is a ceiling a Token Engine administrator set.

Replace them with {daily?, monthly?, total?}, credits from 0.00000001 to 10,000,000: a window left out or null has none. A request past a budget is refused with 402 budget_exceeded; lowering one below what was spent refuses new requests and reverses nothing. A held budget may be lowered, not raised past its hold or removed (403 budget_held).

The account’s routing defaults: {routing, version, platform}, routing null when none are set, platform the deployment’s own data-policy and region defaults under them. version is also the ETag.

Replace them with {route?: "cheapest" | "fastest" | "balanced" | "pinned", providers?: {order, allow_fallbacks}, fallback_models?, max_price?: {input_per_1m, output_per_1m}, data_policy?: {no_training, max_retention_days}, regions?}, or null to remove them: {routing, version}. pinned needs providers.order; an unknown provider or model is 400 invalid_request (a fallback model already saved is kept, even once no longer listed). Send the version read as If-Match to make it conditional: 412 routing_changed when they changed since.

Create a top-up intent with {amount, currency?, orgId?}; the personal account by default.

Read the personal balance. A JWT may pass orgId for an organization’s; an organization’s API key reads its own.

Summarize usage over a period, for the personal account or an organization: {requests, inputTokens, outputTokens, cachedTokens, cacheWriteTokens, totalTokens, costCredits, series: [{date, requests, tokens, costCredits}]}, each token sum and costCredits also as an exact decimal string, …Exact, as for /v1/usage. Usage is shown for the last 12 months: an earlier start is moved up to it, and a period entirely older is refused with 400 range_too_old.

The ledger statement: every change to the balance over [from, to), newest first, 50 a page (limit up to 100): {from, to, type, summary: {openingCredits, closingCredits, netCredits, byType, entries, balanceCredits}, data: [{id, createdAt, type, amountCredits, balanceAfterCredits, description, reference}], nextCursor}. type is topup, debit (a request’s charge), refund, adjustment, commission or expiry; amountCredits the signed change, balanceAfterCredits the balance once it was recorded; reference the request, payment, refund or dispute it refers to. The summary covers every entry of the range, whatever type narrows the page to: opening plus the entries is the closing balance, and a range that ends now closes at the balance. At most 366 days per request, for the last 12 months. An organization’s, its owners and admins.

The same entries as CSV, oldest first: created_at, transaction_id, type, description, amount_credits, balance_after_credits, request_id, payment_id, refund_id, dispute_id, related_transaction_ids.

List invoices, personal or for an organization.

Download a monthly statement as a PDF. Statements are issued automatically once a month closes.

Purchased credit that expires within 30 days, 365 days after its purchase (Terms §4.4): {withinDays: 30, totalCredits, lots: [{purchasedAt, expiresAt, amountCredits}]}, soonest first. Promotional and trial credit are not listed.

Credit the caller’s own card top-ups that are paid but still waiting, should Stripe’s notice of one have gone missing — once, as that notice would: {checked, applied, pending, errors, hasMore}; with hasMore, call it again. For the console’s Refresh balance after a checkout.

Save a card on the personal account, for the trial credit: {id, url}, a Stripe Checkout page that saves the card and charges nothing. Send the browser to url; the card is on file once Stripe confirms it.

The saved cards: {billingAvailable, methods: [{id, brand, last4, expMonth, expYear, status, supportsOffSession, isDefault}], version}, version what a change of the default sends back. Without a payment provider: {billingAvailable: false, methods: [], version: 0}. An organization’s, its owners and admins.

Save a card with {orgId?, manualPaymentRedisplayConsent: true}: {id, url}, a Stripe Checkout page that saves it and charges nothing, as POST /v1/billing/card does. Five card checkouts an hour per user, the two together (429 rate_limited with Retry-After).

Read your personal payment email: {billingAvailable, email}. Before a Customer exists, defaults to your verified sign-in email without creating a Stripe Customer.

Send {email, expectedEmail} with a UUID Idempotency-Key to update your personal Stripe Customer email. Returns {email}. A changed value since you read it returns 409 version_conflict. Recorded unpaid top-up pages you opened are closed, including organization top-ups. Open a new checkout after saving. Sign-in email, cards, history and the independent Link account are unchanged. Organization scope is not accepted; Stripe failures return 502 payment_provider_error.

Make a saved card the default with {orgId?, makeDefault: true, expectedVersion} and an Idempotency-Key header (a UUID): {id, isDefault: true}. 409 version_conflict when the cards changed since expectedVersion; 404 not_found for a card that is not active or not the account’s.

Remove a saved card, with an Idempotency-Key header: {id, status: "detached"}, also when it already was. The default card stays: 409 default_payment_method, make another the default first.

Card payments, newest first: {payments: [{id, kind: "manual" | "auto_topup", amountCents, currency, status, createdAt, updatedAt, succeededAt, failedAt, cancelledAt, receiptEligible}], hasMore, nextCursor}; limit 1–100, 25 by default, and nextCursor as cursor for the next page. An organization’s, its owners and admins.

The refunds and disputes of a succeeded payment: {paymentId, adjustments: [{id, kind: "refund" | "dispute", amountCents, currency, providerStatus, latestProviderEventAt, netCreditImpact, ledgerEntryCount}]}, newest first; netCreditImpact is the credit it took back, a negative decimal string. 404 not_found for a payment that is not the account’s or did not succeed.

Stripe’s receipt of a top-up the caller paid: {receiptUrl}, a page on pay.stripe.com to open. Only whoever paid gets it, for an organization too; 404 not_found for anyone else, 404 receipt_unavailable while Stripe has none.

Automatic top-ups are not available yet: the setting can be read and saved, switched off, and nothing is charged automatically. The setting: {status, enabled, version, paymentMethodId, thresholdCredits, amountCents, monthlyLimitCents, monthSucceededCents, monthReservedCents, monthRemainingCents, windowMonth}. An organization’s, its owners and admins.

Save it with {orgId?, expectedVersion, enabled, thresholdCredits, amountCents, monthlyLimitCents} (with enabled: true, also paymentMethodId, the default card, and offSessionConsent: true): the setting. amountCents is within the top-up limits and monthlyLimitCents at least that. Turning it on is not available yet: enabled: true is refused with 409 off_session_authorization_unavailable, and nothing is charged automatically. 409 billing_customer_required before a first card or checkout; 409 version_conflict when it changed since expectedVersion.

Switch it off and clear it, with {orgId?, expectedVersion} in the body: the setting.

Top-ups whose unused credit can go back to the card that paid, within 7 days of their purchase (Terms §4.5): {windowDays: 7, topups: [{transactionId, purchasedAt, refundableUntil, amountCredits, refundableCredits, refund}]}, newest first, refund the latest request (pending, refunded or failed) or null. An organization’s, its owners and admins.

Refund what is unused of a top-up: 200 {refund} once Stripe refunded it, 202 {refund} while its answer is pending. Needs a sign-in or re-authentication within 10 minutes (403 reauth_required); ten an hour. 404 topup_not_found; 409 refund_window_closed, nothing_to_refund, refund_in_progress, refund_busy or refund_unavailable; 502 refund_failed when Stripe refused, the credit back on the balance.

The program’s terms on this deployment, for anyone signed in: {maxCommissionPct, maxMarkupPct, commissionMonths, payouts} — the most commission Token Engine gives, as a fraction of its markup (the rate itself is set on approval), the most markup a reseller may add, as a percentage of the platform’s price, the months after a customer signs up that both apply, and payouts: stripe (to a Stripe account the reseller connects) or manual (Token Engine pays directly and records each payout).

Apply to become a reseller; the application starts pending. The account’s address is emailed that it arrived, and again when a Token Engine administrator decides it.

Create a referral code (approved resellers): 4–32 letters, digits, - or _, unique regardless of case.

List the caller’s codes and how many users each referred.

List accrued or paid commissions.

Status, rate, referred users and commission totals.

The markup the reseller adds to the prices of the customers they referred, which those customers pay and the catalog shows them: {appliedMarkupPct, current, scheduled, maxMarkupPct, hold, data, total}, percentages as decimal strings, data every version newest first (limit 1–100, 20 by default).

Change it with {markupPct, effectiveFrom?} (approved resellers): from the start of a UTC day, the next one unless effectiveFrom names a later one; 0 removes it. It replaces a change still scheduled. At most maxMarkupPct (400 markup_above_cap); 400 markup_not_at_day_start, 400 markup_in_past; 403 markup_held above a hold a Token Engine administrator set.

What the reseller’s customers would pay under a markup before it is set: {markupPct, effectiveFrom, data: [{id, name, platform: {input_per_1m, output_per_1m}, customer: {input_per_1m, output_per_1m}}], total} — the catalog’s first three models at the platform’s price and with the markup, at the prices for the start of the next UTC day or the later effectiveFrom, of total models on sale. 400 markup_above_cap above maxMarkupPct.

Withdraw the scheduled change: {voided, current}; the current markup runs on.

The Stripe account commission is paid to: {account}, null before one is connected, else its state (payoutsEnabled, requirements, ready, …). 503 payouts_unavailable where the deployment has no Stripe.

Connect or finish connecting it with {country?} (approved resellers): 201 {account, onboardingUrl, expiresAt}. Send the browser to onboardingUrl, Stripe’s one-time page; it comes back to the console, and an expired link is replaced by calling this again.

What the next payout would transfer, of commission dated before today (UTC): {payableCredits, carriedCredits, transferCents, remainderCredits, heldCents, currency, blockers}; blockers say what stops it (payout_account_missing, payouts_not_enabled, nothing_to_pay, …). A Token Engine administrator starts each payout.

Payouts made, newest first: {data: [{id, method, status, amountCredits, transferCents, settledAt, createdAt, …}], total}.