Consolidated consumption across every company in the organization
A read, and only a read. ADR 0016 point 6 keeps the quota holder on the company: a platform with fifty clients has fifty subscriptions and each taxpayer pays its own. usage.consume_quota is untouched. Each company is reported against its own plan period, so a mixed portfolio of DAY and MONTH plans is not flattened onto a window this route picked.
A read, and only a read. ADR 0016 point 6 keeps the quota holder on the company: a platform with fifty clients has fifty subscriptions and each taxpayer pays its own. usage.consume_quota is untouched. Each company is reported against its own plan period, so a mixed portfolio of DAY and MONTH plans is not flattened onto a window this route picked.
Authorization
bearerAuth Tenant-bound, scoped and expiring Apifact credential. Migrated legacy credentials are accepted only on deprecated v1 writes and tenant-scoped v2 read, poll and download routes. Each operation names the single scope it requires in x-required-scope; the scope array of the security requirement itself is empty because OpenAPI 3.0 requires it to be for a non-oauth2 scheme.
In: header
Query Parameters
length <= 60"documents.accepted"Response Body
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
application/json
curl -X GET "https://example.com/api/v2/organizations/usage" \ -H "Authorization: Bearer apf_v2_tu_credencial"{ "schemaVersion": "2.0", "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6", "metric": "string", "organizationId": "7bc05553-4b68-44e8-b7bc-37be63c6d9e9", "companies": [ { "companyId": "8bb73d03-06b4-47c7-80c7-59301f770eda", "ruc": "string", "legalName": "string", "status": "ACTIVE", "planCode": "string", "metered": true, "periodUnit": "DAY", "periodStart": "2019-08-24", "limit": 0, "consumed": 0 } ]}Mint an API credential for a client company POST POST
Creates a COMPANY credential, which can issue comprobantes. ADR 0016 point 3 names this a privilege escalation and does not pretend otherwise: the mitigation is that it is recorded. The credential row and its ops.audit_events row are written in one transaction, and a DEFERRABLE constraint trigger on auth.api_credentials refuses at COMMIT to admit a credential for an organization-owned company without one -- so an unaudited mint is not a policy violation, it is a failed transaction. The token is returned exactly once.
Read one client company, its capabilities, its certificate and its credentials GET GET
Everything needed to answer 'can this client bill, and if not why not'. THE THREE FAILURES ARE ONE ANSWER: a company belonging to another organization, a company that does not exist and an INACTIVE company all return the identical 404, decided by a single SELECT rather than by three branches, so this route cannot be used to discover that a RUC is registered elsewhere. Requires organizations:read; a credential holding companies:manage satisfies it, and one holding only organizations:read can create nothing, mint nothing and enrol nothing.