Read the workspace's plan entitlements (any member)
Return the plan entitlements for a workspace: its plan key, per-feature flags (scheduled_scans, continuous_scans, api_production, artifact_dashboard, multi_org), billable seat usage, the seat ceiling (null means unlimited), and whether plan limits are enforced on this deployment at all. Readable by every member including viewers, which is the point — the equivalent billing routes are owner-only, so non-owners had no way to learn what their plan allows and clients defaulted to allowing everything. Carries no billing identifiers, invoice data, or billing contact. Feature flags are effective: when billing_enforced is false every flag is true, matching what the API will actually serve.
Deliberately cheap: one COUNT for seat usage, with plan and features read off the workspace row the auth dependency has already loaded. Every member hits this on page load, so resist adding live usage counts here.
Authorizations
Headers
Path Parameters
Cookies
Response
Successful Response
What the caller's workspace plan allows — safe for any member to read.
The canonical paid-feature flags, named explicitly.
Spelled out rather than typed dict[str, bool] because the published schema
is the contract AI agents and CI pipelines read (see CLAUDE.md); an open
additionalProperties: boolean map tells a reader nothing about which keys
exist. Kept in lockstep with CANONICAL_FEATURE_KEYS by a test — a key added
on one side and not the other would otherwise read as a silent false.
