Every plan we sell, priced and specified

GET 
/api/v1/billing/catalog

The published offer: what each plan costs and what it includes.

This exists so a price and a cap are written down once, on the server. The client used to carry both — a price grid that no gate compared against the billing provider, and a cap table kept honest by a test that regex-matched a TypeScript file. Both said, in their own comments, to delete them when an endpoint existed.

Every number here is catalogue data about a PLAN. It is never an organization's own entitlements: those resolve through the per-org override layer and reach the client on /auth/me, which is the only surface that can be right for a customer on a negotiated contract.

• Scope required: billing:read. The catalogue names no organization, but it is billing data and it reads like the rest of this router.

Responses

200

Successful Response

400

Bad request — malformed input or failed validation.

401

Missing, expired, or invalid credentials.

403

Authenticated but not authorized for this resource. Note: cross-organization reads return 404, not 403.

404

Resource not found, or hidden for tenant-enumeration safety (the caller lacks permission to know whether the resource exists).

409

Conflict — the current resource state does not allow this operation (e.g. assessment already started, email already in use).

422

Semantic validation failure — request shape was valid but contents were not.

429

Too many requests — rate limited. Retry after the window resets.

500

Internal server error — unexpected failure.