Subscriptions API
A subscription is one member's purchase of one plan: the row that says who bought what, on which payment method, for how much, and until when.
A subscription is one member's purchase of one plan: the row that says who bought what, on which payment method, for how much, and until when. Every checkout on the portal or in the bot, every redeemed access code and every cardless trial creates one, so there is no POST here: a subscription comes into being when a member pays or redeems, and these endpoints let you read it, follow the access it granted and drive the rest of its life.
The row carries a payment_status that tracks the provider's view of the money (trialing, active, past_due, paused, canceled, expired and the rest), an ends_at that already includes any outage compensation the member was owed, and, when read individually, its grants: the access ledger with one row per resource the plan unlocks, and per dated window for a pass. A grant says which connector admitted the member, how (bearer_link, membership, role or creator_task), where it stands (pending_identity, pending, held, granted, revoked or failed) and why when it failed. Read the grants, not the payment status, to know whether a member is actually inside the channel.
The lifecycle endpoints are RPC-style actions rather than field edits, because each one talks to a payment provider or a connector on the way: cancel queues the provider-side cancellation and answers 202; pause and unpause suspend and restore access while billing continues; reactivate calls off a scheduled cancellation, on Stripe only, since the other providers end the agreement outright; reissue revokes the member's invite links and mints fresh ones; and remind re-sends a pass holder the links they have not used yet. Every transition announces itself as a subscription.* event. Subscriptions are read across every project the token reaches, a scope:project token sees only its projects, and a subscription of any other project is a 404 on every endpoint here.
Endpoints
/v1/subscriptionsList subscriptionsGET/v1/subscriptions/{subscription}Get a subscriptionGET/v1/subscriptions/{subscription}/grantsList a subscription's grantsPOST/v1/subscriptions/{subscription}/cancelCancel a subscriptionPOST/v1/subscriptions/{subscription}/pausePause a subscriptionPOST/v1/subscriptions/{subscription}/unpauseUnpause a subscriptionPOST/v1/subscriptions/{subscription}/reactivateReactivate a subscriptionPOST/v1/subscriptions/{subscription}/remindRemind a pass holderPOST/v1/subscriptions/{subscription}/grants/reissueReissue a subscription's accesscurl "https://api.subscriby.net/v1/subscriptions?status=active" \ -H "Authorization: Bearer $SUBSCRIBY_TOKEN"The held subscriptions across every project the token reaches, newest first, paged with page and per_page (default 25; limit is accepted as an alias). status matches a single payment status and plan_id scopes to one plan. Rows carry no grants.
A token minted with scope:project:<uuid> entries lists only the subscriptions of those projects, and a subscription of any other project is 404 RESOURCE_NOT_FOUND on every endpoint of this resource.
Requires ability
The token must hold this ability, or the call is refused with 403.
Authorization
bearerToken A personal access token minted on the dashboard under Settings, then Tokens, sent as Authorization: Bearer sbt_live_…. The token carries the abilities each endpoint lists under Requires ability and is frozen to one team.
In: header
Query Parameters
Match a single payment status: trialing, active, incomplete, expired, past_due, canceled, unpaid, paused, processing, succeeded, capturable or failed. An unknown value is refused.
Scope to one plan.
uuidThe 1-based page to return. A page past the last answers an empty data array with meta.total still filled, so a loop can stop without guessing.
1 <= value1Rows per page, 1 to 100. A higher value clamps to the cap silently. Defaults to 25.
1 <= value <= 10025The column to order by. Defaults to created_at; a column the endpoint does not offer falls back to the default rather than failing.
"created_at"asc or desc. Defaults to desc.
"desc"Value in
- "asc"
- "desc"
Legacy alias of per_page, kept for clients that predate it. per_page wins when both are sent.
1 <= value <= 100Responses
200OKapplication/json
The page of held subscriptions, newest first.
401UnauthorizedAUTHENTICATION_REQUIREDapplication/json
The request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an sbt_test_ token on production).
403ForbiddenTOKEN_MISSING_ABILITYapplication/json
The token is valid but does not carry the ability this endpoint requires; error.context.required_ability names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers FORBIDDEN, TEAM_TIER_REQUIRED or CONNECTOR_TIER_REQUIRED with the same status, and says so in its own description.
422Validation failedVALIDATION_FAILEDapplication/json
The payload broke a rule, and error.fields maps each offending key to its messages. A refusal from the domain, such as a plan that cannot go on sale or a member who cannot be removed, uses the same code with error.message saying why and no fields.
On this endpoint: VALIDATION_FAILED: when status is not a payment status or plan_id is not a UUID.
429Too many requestsRATE_LIMITEDapplication/json
The token has spent its 300 requests a minute or 10,000 an hour; Retry-After says when the next one is accepted.
One subscription with its grants embedded.
payment_status is one of trialing, active, incomplete, expired, past_due, canceled, unpaid, paused, processing, succeeded, capturable or failed (the subscriby://enums/subscription-status MCP resource lists them).
compensation_seconds is the outage time Outage Compensation has banked on the purchase, 0 for almost every subscription. ends_at already includes it: a one-time purchase simply ends later, while a recurring plan's ends_at runs that many seconds past the period the member last paid for, so the renewal the gateway bills is ends_at minus compensation_seconds.
Requires ability
The token must hold this ability, or the call is refused with 403.
MCP tool
Runs the same action from an agent, behind the same ability.
Authorization
bearerToken A personal access token minted on the dashboard under Settings, then Tokens, sent as Authorization: Bearer sbt_live_…. The token carries the abilities each endpoint lists under Requires ability and is frozen to one team.
In: header
Path Parameters
The subscription, resolved by the route binder.
uuidResponses
200OKapplication/json
The subscription, its access grants embedded.
401UnauthorizedAUTHENTICATION_REQUIREDapplication/json
The request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an sbt_test_ token on production).
403ForbiddenTOKEN_MISSING_ABILITYapplication/json
The token is valid but does not carry the ability this endpoint requires; error.context.required_ability names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers FORBIDDEN, TEAM_TIER_REQUIRED or CONNECTOR_TIER_REQUIRED with the same status, and says so in its own description.
404Not foundRESOURCE_NOT_FOUNDapplication/json
An id in the path names nothing the token can see. TENANT_MISMATCH: the project sits outside the token's scope:project: allow-list, or the token carries no team scope. Both answer 404 rather than 403 so that existence outside the token's scope cannot be inferred.
429Too many requestsRATE_LIMITEDapplication/json
The token has spent its 300 requests a minute or 10,000 an hour; Retry-After says when the next one is accepted.
curl https://api.subscriby.net/v1/subscriptions/$SUBSCRIPTION_ID/grants \ -H "Authorization: Bearer $SUBSCRIBY_TOKEN"Every grant the purchase holds, one per resource and dated window, oldest first. Never paginated.
A grant is the access ledger's record that a purchase admits its holder to one resource: one row per resource, and per dated window for a pass. It says which connector gave the access, how (mode), where it stands (state) and, when it failed, why. Read it to know whether a member is actually in the channel rather than inferring it from the payment status.
modeisbearer_link(a personal invite link the member comes through),membership(the connector added the member itself),role(a role was assigned) orcreator_task(the creator has to do something by hand).stateispending_identity(the member has not linked an account on that connector yet;member.resource_pendingwas raised, and the grant is issued the moment they connect one),pending(issued, not yet used),held(issued ahead of a pass window and released when it opens),granted,revokedorfailed.identity_idis the connector account admitted, the same id the member's identities endpoint returns, ornullwhile none is linked or for a hand-arranged perk.referenceis the connector's handle on the grant (the invite link on a connector that grants by link),nullbefore anything was issued. Treat it as a secret: whoever holds a bearer link can use it.- A
failedgrant carriesfailure_kind(unreachable,not_permitted,target_missing,rate_limited,configuration,transient,other) andfailure_detail, the sentence the creator sees in the dashboard.
The ledger is written by the same job that mints invite links, so a purchase's grants appear moments after member.resource_added fires; a revoked link stays as a revoked row rather than disappearing, so history is never lost.
Requires ability
The token must hold this ability, or the call is refused with 403.
MCP tool
Runs the same action from an agent, behind the same ability.
Authorization
bearerToken A personal access token minted on the dashboard under Settings, then Tokens, sent as Authorization: Bearer sbt_live_…. The token carries the abilities each endpoint lists under Requires ability and is frozen to one team.
In: header
Path Parameters
The subscription, resolved by the route binder.
uuidResponses
200OKapplication/json
Array of AccessGrantResource
401UnauthorizedAUTHENTICATION_REQUIREDapplication/json
The request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an sbt_test_ token on production).
403ForbiddenTOKEN_MISSING_ABILITYapplication/json
The token is valid but does not carry the ability this endpoint requires; error.context.required_ability names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers FORBIDDEN, TEAM_TIER_REQUIRED or CONNECTOR_TIER_REQUIRED with the same status, and says so in its own description.
404Not foundRESOURCE_NOT_FOUNDapplication/json
An id in the path names nothing the token can see. TENANT_MISMATCH: the project sits outside the token's scope:project: allow-list, or the token carries no team scope. Both answer 404 rather than 403 so that existence outside the token's scope cannot be inferred.
429Too many requestsRATE_LIMITEDapplication/json
The token has spent its 300 requests a minute or 10,000 an hour; Retry-After says when the next one is accepted.
curl -X POST https://api.subscriby.net/v1/subscriptions/$SUBSCRIPTION_ID/cancel \ -H "Authorization: Bearer $SUBSCRIBY_TOKEN" \ -H "Idempotency-Key: $(uuidgen)"Cancel is asynchronous: the endpoint answers 202 Accepted once cancellation is queued. Provider-side cancellation (Stripe, PayPal, Razorpay, Paystack and the others) and the accompanying subscription.cancelled event happen on the background worker.
Requires ability
The token must hold this ability, or the call is refused with 403.
Fires one event
Delivered to every endpoint subscribed to it once the change is made.
MCP tool
Runs the same action from an agent, behind the same ability.
Idempotent
Send the header on every call; the same key replays the original response for 24 hours.
Authorization
bearerToken A personal access token minted on the dashboard under Settings, then Tokens, sent as Authorization: Bearer sbt_live_…. The token carries the abilities each endpoint lists under Requires ability and is frozen to one team.
In: header
Path Parameters
The subscription, resolved by the route binder.
uuidHeader Parameters
A key unique to this operation, such as a fresh UUID. The same key replays the original 2xx response for 24 hours (with Idempotent-Replay: true), so a retry after a timeout never repeats the write; the same key with a different body is refused with 409.
uuidResponses
202Acceptedapplication/json
202 with cancellation_queued.
400Bad requestIDEMPOTENCY_KEY_MISSINGapplication/json
Every write needs an Idempotency-Key header. Send a fresh UUID per distinct operation.
On this endpoint: SUBSCRIPTION_ALREADY_ACTIVE: when the subscription is already cancelled, rather than silently succeeding; error.context.subscription_id names it.
401UnauthorizedAUTHENTICATION_REQUIREDapplication/json
The request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an sbt_test_ token on production).
403ForbiddenTOKEN_MISSING_ABILITYapplication/json
The token is valid but does not carry the ability this endpoint requires; error.context.required_ability names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers FORBIDDEN, TEAM_TIER_REQUIRED or CONNECTOR_TIER_REQUIRED with the same status, and says so in its own description.
404Not foundRESOURCE_NOT_FOUNDapplication/json
An id in the path names nothing the token can see. TENANT_MISMATCH: the project sits outside the token's scope:project: allow-list, or the token carries no team scope. Both answer 404 rather than 403 so that existence outside the token's scope cannot be inferred.
409ConflictIDEMPOTENCY_KEY_REUSEDapplication/json
The key was already used in the last 24 hours with a different request body.
425Too earlyIDEMPOTENCY_REPLAY_IN_PROGRESSapplication/json
The first request with this key is still running; retry in a few seconds and the original response is replayed.
429Too many requestsRATE_LIMITEDapplication/json
The token has spent its 300 requests a minute or 10,000 an hour; Retry-After says when the next one is accepted.
Suspends access: the member is removed from every linked resource, payment_status becomes paused and paused_at is stamped. Billing continues. Answers 202 with the outcome and emits subscription.paused.
Pause suspends access, not billing. The member's payment provider keeps charging on schedule. Subscriby settles through seven providers and only some can hold a recurring charge at all, so a pause meaning "stop billing" would work on some and silently not on others; access is what Subscriby controls directly, so it behaves identically everywhere. If billing must stop, cancel.
Only active and trialing subscriptions can be paused; only a paused one can be unpaused.
Requires ability
The token must hold this ability, or the call is refused with 403.
Fires one event
Delivered to every endpoint subscribed to it once the change is made.
MCP tool
Runs the same action from an agent, behind the same ability.
Idempotent
Send the header on every call; the same key replays the original response for 24 hours.
Authorization
bearerToken A personal access token minted on the dashboard under Settings, then Tokens, sent as Authorization: Bearer sbt_live_…. The token carries the abilities each endpoint lists under Requires ability and is frozen to one team.
In: header
Path Parameters
The subscription, resolved by the route binder.
uuidHeader Parameters
A key unique to this operation, such as a fresh UUID. The same key replays the original 2xx response for 24 hours (with Idempotent-Replay: true), so a retry after a timeout never repeats the write; the same key with a different body is refused with 409.
uuidResponses
202Acceptedapplication/json
202 with the outcome.
400Bad requestIDEMPOTENCY_KEY_MISSINGapplication/json
Every write needs an Idempotency-Key header. Send a fresh UUID per distinct operation.
401UnauthorizedAUTHENTICATION_REQUIREDapplication/json
The request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an sbt_test_ token on production).
403ForbiddenTOKEN_MISSING_ABILITYapplication/json
The token is valid but does not carry the ability this endpoint requires; error.context.required_ability names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers FORBIDDEN, TEAM_TIER_REQUIRED or CONNECTOR_TIER_REQUIRED with the same status, and says so in its own description.
404Not foundRESOURCE_NOT_FOUNDapplication/json
An id in the path names nothing the token can see. TENANT_MISMATCH: the project sits outside the token's scope:project: allow-list, or the token carries no team scope. Both answer 404 rather than 403 so that existence outside the token's scope cannot be inferred.
409ConflictIDEMPOTENCY_KEY_REUSEDapplication/json
The key was already used in the last 24 hours with a different request body.
422Validation failedVALIDATION_FAILEDapplication/json
When the subscription is neither active nor trialing.
425Too earlyIDEMPOTENCY_REPLAY_IN_PROGRESSapplication/json
The first request with this key is still running; retry in a few seconds and the original response is replayed.
429Too many requestsRATE_LIMITEDapplication/json
The token has spent its 300 requests a minute or 10,000 an hour; Retry-After says when the next one is accepted.
Restores access with fresh invite links: the ones revoked at pause never come back. Answers 202 with the outcome (outcome: active) and emits subscription.unpaused.
Requires ability
The token must hold this ability, or the call is refused with 403.
Fires one event
Delivered to every endpoint subscribed to it once the change is made.
MCP tool
Runs the same action from an agent, behind the same ability.
Idempotent
Send the header on every call; the same key replays the original response for 24 hours.
Authorization
bearerToken A personal access token minted on the dashboard under Settings, then Tokens, sent as Authorization: Bearer sbt_live_…. The token carries the abilities each endpoint lists under Requires ability and is frozen to one team.
In: header
Path Parameters
The subscription, resolved by the route binder.
uuidHeader Parameters
A key unique to this operation, such as a fresh UUID. The same key replays the original 2xx response for 24 hours (with Idempotent-Replay: true), so a retry after a timeout never repeats the write; the same key with a different body is refused with 409.
uuidResponses
202Acceptedapplication/json
202 with the outcome.
400Bad requestIDEMPOTENCY_KEY_MISSINGapplication/json
Every write needs an Idempotency-Key header. Send a fresh UUID per distinct operation.
401UnauthorizedAUTHENTICATION_REQUIREDapplication/json
The request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an sbt_test_ token on production).
403ForbiddenTOKEN_MISSING_ABILITYapplication/json
The token is valid but does not carry the ability this endpoint requires; error.context.required_ability names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers FORBIDDEN, TEAM_TIER_REQUIRED or CONNECTOR_TIER_REQUIRED with the same status, and says so in its own description.
404Not foundRESOURCE_NOT_FOUNDapplication/json
An id in the path names nothing the token can see. TENANT_MISMATCH: the project sits outside the token's scope:project: allow-list, or the token carries no team scope. Both answer 404 rather than 403 so that existence outside the token's scope cannot be inferred.
409ConflictIDEMPOTENCY_KEY_REUSEDapplication/json
The key was already used in the last 24 hours with a different request body.
422Validation failedVALIDATION_FAILEDapplication/json
When the subscription is not paused.
425Too earlyIDEMPOTENCY_REPLAY_IN_PROGRESSapplication/json
The first request with this key is still running; retry in a few seconds and the original response is replayed.
429Too many requestsRATE_LIMITEDapplication/json
The token has spent its 300 requests a minute or 10,000 an hour; Retry-After says when the next one is accepted.
Calls off a scheduled cancellation at the gateway and locally: the counterpart to cancel, and the win-back path. Answers 202 with the outcome (outcome: reactivated) and emits subscription.reactivated.
Stripe only. On every other provider, cancelling ends the agreement outright, so there is nothing left to resume; the endpoint refuses and the member has to subscribe again. Flipping the record back to active would otherwise claim a recurring subscription the provider will never charge, and the member would keep access indefinitely for free.
An already-expired subscription cannot be reactivated regardless of provider.
Requires ability
The token must hold this ability, or the call is refused with 403.
Fires one event
Delivered to every endpoint subscribed to it once the change is made.
MCP tool
Runs the same action from an agent, behind the same ability.
Idempotent
Send the header on every call; the same key replays the original response for 24 hours.
Authorization
bearerToken A personal access token minted on the dashboard under Settings, then Tokens, sent as Authorization: Bearer sbt_live_…. The token carries the abilities each endpoint lists under Requires ability and is frozen to one team.
In: header
Path Parameters
The subscription, resolved by the route binder.
uuidHeader Parameters
A key unique to this operation, such as a fresh UUID. The same key replays the original 2xx response for 24 hours (with Idempotent-Replay: true), so a retry after a timeout never repeats the write; the same key with a different body is refused with 409.
uuidResponses
202Acceptedapplication/json
202 with the outcome.
400Bad requestIDEMPOTENCY_KEY_MISSINGapplication/json
Every write needs an Idempotency-Key header. Send a fresh UUID per distinct operation.
401UnauthorizedAUTHENTICATION_REQUIREDapplication/json
The request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an sbt_test_ token on production).
403ForbiddenTOKEN_MISSING_ABILITYapplication/json
The token is valid but does not carry the ability this endpoint requires; error.context.required_ability names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers FORBIDDEN, TEAM_TIER_REQUIRED or CONNECTOR_TIER_REQUIRED with the same status, and says so in its own description.
404Not foundRESOURCE_NOT_FOUNDapplication/json
An id in the path names nothing the token can see. TENANT_MISMATCH: the project sits outside the token's scope:project: allow-list, or the token carries no team scope. Both answer 404 rather than 403 so that existence outside the token's scope cannot be inferred.
409ConflictIDEMPOTENCY_KEY_REUSEDapplication/json
The key was already used in the last 24 hours with a different request body.
422Validation failedVALIDATION_FAILEDapplication/json
When the subscription is not cancelled, has already expired, is not on Stripe, or Stripe refuses to resume it.
425Too earlyIDEMPOTENCY_REPLAY_IN_PROGRESSapplication/json
The first request with this key is still running; retry in a few seconds and the original response is replayed.
429Too many requestsRATE_LIMITEDapplication/json
The token has spent its 300 requests a minute or 10,000 an hour; Retry-After says when the next one is accepted.
curl -X POST https://api.subscriby.net/v1/subscriptions/$SUBSCRIPTION_ID/remind \ -H "Authorization: Bearer $SUBSCRIBY_TOKEN" \ -H "Idempotency-Key: $(uuidgen)"The members page's nudge for a pass holder who bought a window but has not joined yet: their invite links are re-sent. Answers 200 with reminded: true when the connector accepted the message, and reminded: false when there was nothing to send: the subscription holds no window, the window has ended or been cancelled, the holder has already queued, or they cannot be reached on their connector. false is the dashboard's "Nothing sent" notice, not a fault, so it is never a 422.
This messages a real person: read the subscription back first and do not repeat the nudge within the same window. To nudge everyone still missing from one window at once, use the pass window remind endpoint.
Requires ability
The token must hold this ability, or the call is refused with 403.
MCP tool
Runs the same action from an agent, behind the same ability.
Idempotent
Send the header on every call; the same key replays the original response for 24 hours.
Authorization
bearerToken A personal access token minted on the dashboard under Settings, then Tokens, sent as Authorization: Bearer sbt_live_…. The token carries the abilities each endpoint lists under Requires ability and is frozen to one team.
In: header
Path Parameters
The subscription, resolved by the route binder.
uuidHeader Parameters
A key unique to this operation, such as a fresh UUID. The same key replays the original 2xx response for 24 hours (with Idempotent-Replay: true), so a retry after a timeout never repeats the write; the same key with a different body is refused with 409.
uuidResponses
200OKapplication/json
200 with subscription_id and reminded.
400Bad requestIDEMPOTENCY_KEY_MISSINGapplication/json
Every write needs an Idempotency-Key header. Send a fresh UUID per distinct operation.
401UnauthorizedAUTHENTICATION_REQUIREDapplication/json
The request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an sbt_test_ token on production).
403ForbiddenTOKEN_MISSING_ABILITYapplication/json
The token is valid but does not carry the ability this endpoint requires; error.context.required_ability names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers FORBIDDEN, TEAM_TIER_REQUIRED or CONNECTOR_TIER_REQUIRED with the same status, and says so in its own description.
404Not foundRESOURCE_NOT_FOUNDapplication/json
An id in the path names nothing the token can see. TENANT_MISMATCH: the project sits outside the token's scope:project: allow-list, or the token carries no team scope. Both answer 404 rather than 403 so that existence outside the token's scope cannot be inferred.
409ConflictIDEMPOTENCY_KEY_REUSEDapplication/json
The key was already used in the last 24 hours with a different request body.
425Too earlyIDEMPOTENCY_REPLAY_IN_PROGRESSapplication/json
The first request with this key is still running; retry in a few seconds and the original response is replayed.
429Too many requestsRATE_LIMITEDapplication/json
The token has spent its 300 requests a minute or 10,000 an hour; Retry-After says when the next one is accepted.
curl -X POST https://api.subscriby.net/v1/subscriptions/$SUBSCRIPTION_ID/grants/reissue \ -H "Authorization: Bearer $SUBSCRIBY_TOKEN" \ -H "Idempotency-Key: $(uuidgen)" \ -H "Content-Type: application/json" \ -d '{ "resource_id": "c9e21f37-8a4b-4d56-b1e0-2f7c9d3a6e15" }'The members page's Refresh invite links, for integrations. The grants the member holds are revoked (their personal invite links die) and the job that grants at purchase runs again, issuing fresh grants the bot sends to the member. resource_id is optional: name one resource of the plan to reissue it alone, leave it out to reissue every resource the subscription grants.
Answers 202 once the reissue is queued, where reissued counts the grants revoked; the fresh grants appear on the grants endpoint seconds later. Each revoked grant raises member.resource_reissued and each fresh one member.resource_added.
Requires ability
The token must hold this ability, or the call is refused with 403.
Fires events
Delivered to every endpoint subscribed to them once the change is made.
MCP tool
Runs the same action from an agent, behind the same ability.
Idempotent
Send the header on every call; the same key replays the original response for 24 hours.
Authorization
bearerToken A personal access token minted on the dashboard under Settings, then Tokens, sent as Authorization: Bearer sbt_live_…. The token carries the abilities each endpoint lists under Requires ability and is frozen to one team.
In: header
Path Parameters
The subscription, resolved by the route binder.
uuidHeader Parameters
A key unique to this operation, such as a fresh UUID. The same key replays the original 2xx response for 24 hours (with Idempotent-Replay: true), so a retry after a timeout never repeats the write; the same key with a different body is refused with 409.
uuidRequest body
JSONWhat the request carriesOptionalapplication/json
Which access to reissue: one resource of the plan, or every resource the purchase grants when the body is empty.
Responses
202Acceptedapplication/json
202 with subscription_id, reissued and reissue_queued.
400Bad requestIDEMPOTENCY_KEY_MISSINGapplication/json
Every write needs an Idempotency-Key header. Send a fresh UUID per distinct operation.
401UnauthorizedAUTHENTICATION_REQUIREDapplication/json
The request carries no bearer token, or one that is revoked, malformed, or minted for another environment (an sbt_test_ token on production).
403ForbiddenTOKEN_MISSING_ABILITYapplication/json
The token is valid but does not carry the ability this endpoint requires; error.context.required_ability names the one to grant. An endpoint that also checks who owns a row or which tier the account is on answers FORBIDDEN, TEAM_TIER_REQUIRED or CONNECTOR_TIER_REQUIRED with the same status, and says so in its own description.
404Not foundRESOURCE_NOT_FOUNDapplication/json
An id in the path names nothing the token can see. TENANT_MISMATCH: the project sits outside the token's scope:project: allow-list, or the token carries no team scope. Both answer 404 rather than 403 so that existence outside the token's scope cannot be inferred.
On this endpoint: RESOURCE_NOT_FOUND: when resource_id is not one the plan grants.
409ConflictIDEMPOTENCY_KEY_REUSEDapplication/json
The key was already used in the last 24 hours with a different request body.
422Validation failedVALIDATION_FAILEDapplication/json
The payload broke a rule, and error.fields maps each offending key to its messages. A refusal from the domain, such as a plan that cannot go on sale or a member who cannot be removed, uses the same code with error.message saying why and no fields.
On this endpoint: VALIDATION_FAILED: when the subscription is not active; error.context.subscription_id names it.
425Too earlyIDEMPOTENCY_REPLAY_IN_PROGRESSapplication/json
The first request with this key is still running; retry in a few seconds and the original response is replayed.
429Too many requestsRATE_LIMITEDapplication/json
The token has spent its 300 requests a minute or 10,000 an hour; Retry-After says when the next one is accepted.
Related
How is this guide?
Roles API
A role is the permission set a collaborator holds on a team.
Support Inbox API
The support inbox is where a member who writes to your project bot something it does not recognise ends up: one durable support conversation per (project, member, channel), the saved replies your team answers with, and the project's support settings that decide whether the inbox is open, how you hear about a new thread and how replies are signed.