Check access

Your backend is the client. End users of your product never call e10s for entitlements.

Pattern

[Your user] → [Your API] → [e10s check]
                 │
                 └─ knows subscriber_id (from session / tenant)
                    authenticates with service account member API key

1. Authenticate the user in your app
2. Resolve which subscriber the request belongs to
3. POST …/entitlements/check with X-API-Key (member API key)
4. Allow or reject in your API (and compare usage for limits)

Credentials: Authentication.

Check a flag

POST /api/organizations/{organization_id}/subscribers/{subscriber_id}/entitlements/check
X-API-Key: e10s-mk-1-…
Content-Type: application/json

{ "feature": "csv_export" }

200

{
  "feature": "csv_export",
  "kind": "flag",
  "allowed": false,
  "source": "none"
}

Check a limit

{ "feature": "seats" }

{
  "feature": "seats",
  "kind": "limit",
  "limit": 10,
  "source": "plan"
}

const { limit } = await e10s.check(subscriberId, "seats")
const used = await db.users.count({ where: { tenantId } })
if (limit !== null && used >= limit) {
  throw new PaywallError("seat_limit")
}
// create user

limit: null means unlimited — skip the comparison.

List effective entitlements

Useful for admin views or loading a feature map at session start:

GET /api/organizations/{organization_id}/subscribers/{subscriber_id}/entitlements
X-API-Key: e10s-mk-1-…

{
  "features": [
    { "feature": "sso", "kind": "flag", "allowed": true, "source": "plan" },
    { "feature": "seats", "kind": "limit", "limit": 10, "source": "plan" }
  ]
}

Default list is entitled only. Pass ?all=true for every catalog key. See API: Entitlements. Prefer check on the hot path if the catalog is large.

Mapping external ids

If you store external_id on subscribers:

1. Look up subscriber by external_id (list/filter or dedicated get)
2. Check with e10s subscriber_id
3. Cache the mapping in your DB to avoid extra lookups

Failure handling

Situation	Suggested app behavior
Flag allowed: false	403 / paywall in your API
Limit exceeded (used >= limit)	403 / upgrade prompt — e10s only gave you limit
e10s 5xx / timeout	Fail closed (deny) or degrade per your risk tolerance — be explicit
Unknown feature key	Treat as configuration error; fix catalog or caller
401 from e10s	Bad/revoked key — fix credentials, don’t treat as “feature off”

Caching

You may cache check results briefly keyed by (subscriber_id, feature). Invalidate when you change that subscriber's subscription or overrides, and when you change the plan's grants (affects every subscriber on that plan).