/entitlements/available - List the add-ons the caller's organization may buy

Add MCP server to your AI tool

Allow AI tools and LLMs to interact with the API documentation portal through MCP.

MCP server URL


        
          
            https://api.my.nethesis.it/mcp

Standard setup for AI tools providing an mcp.json file

{
  "my.nethesis.it MCP server": {
    "url": "https://api.my.nethesis.it/mcp"
  }
}

GET /entitlements/available

Bearer auth

The catalog items (services and modules) the CALLER's organization may buy/self-activate on the shop, with availability rules applied. The owner organization and Super Admins see the whole catalog.

Responses

200 application/json

Available entitlements retrieved successfully
Hide response attributes Show response attributes object
- code integer
- message string
- data object
  
  Hide data attribute Show data attribute object
  
  available array[object]
  
  One grantable add-on type. Ids are lowercase kebab-case; convention: nsec-<service> (firewall services), ns8-<app> (application enablement on a cluster) or <app>-<module> (per-application-instance modules, scoped: true; applies_to names the application, since the id prefix is ambiguous for hyphenated app names). legacy_alias is the old wire id the appliance feeds still call on GET /auth/service/{id} — legacy ids are never renamed.
  
  Hide available attributes Show available attributes object
  
  One grantable add-on type. Ids are lowercase kebab-case; convention: nsec-<service> (firewall services), ns8-<app> (application enablement on a cluster) or <app>-<module> (per-application-instance modules, scoped: true; applies_to names the application, since the id prefix is ambiguous for hyphenated app names). legacy_alias is the old wire id the appliance feeds still call on GET /auth/service/{id} — legacy ids are never renamed.
  
  id string
  
  Catalog id (lowercase kebab-case, immutable)
  
  display_name string
  
  Human-readable name
  
  description string
  
  Optional longer description
  
  scoped boolean
  
  True when grants can be narrowed to a single application instance via scope (per-application-instance modules). Immutable.
  
  kind string
  
  Both kinds are sellable on the shop — services are firewall add-ons granted system-wide, modules are add-ons for a single application instance of an NS8 cluster
  
  Values are service or module.
  
  system_type string
  
  Restricts the add-on to one system type. Empty/omitted = any type.
  
  Values are nsec or ns8.
  
  legacy_alias string
  
  Old wire id consumers still call on GET /auth/service/{id} (only for types migrated from the legacy my)
  
  applies_to string
  
  Application (applications.instance_of) a module add-on applies to. Empty for system-wide services. Stored explicitly because the - id prefix is ambiguous when the app name itself contains a hyphen (nethvoice-proxy).
  
  purchasable boolean
  
  False when the add-on exists but is not on sale: the shop product is unpublished, or it is sold off-line only. The add-on stays visible wherever it is granted — only the buy action is withheld. Separate from the per-organization allowlist, which answers who may buy rather than whether it is on sale at all.
  
  in_use boolean
  
  True when at least one grant references the item — revoked and expired grants included, since they are kept for audit and block the delete all the same. Clients should disable the delete action for these items: DELETE /entitlements/catalog/{id} answers 409.
  
  created_at string(date-time)
  
  updated_at string(date-time)
401 application/json

Unauthorized - invalid or missing token
Hide response attributes Show response attributes object
- code integer
- message string
- data object | null
403 application/json

Forbidden - insufficient permissions
Hide response attributes Show response attributes object
- code integer
- message string
- data object | null
500 application/json

Internal server error
Hide response attributes Show response attributes object
- code integer
- message string
- data object | null

GET /entitlements/available

curl \
 --request GET 'https://api.your-domain.com/api/entitlements/available' \
 --header "Authorization: Bearer $ACCESS_TOKEN"

Response examples (200)

{
  "code": 200,
  "message": "available entitlements retrieved successfully",
  "data": {
    "available": [
      {
        "id": "nsec-blacklist",
        "display_name": "Blacklist",
        "description": "IP and DNS blacklist feed for NethSecurity",
        "scoped": false,
        "kind": "service",
        "system_type": "nsec",
        "legacy_alias": "ng-blacklist",
        "applies_to": "nethvoice",
        "purchasable": true,
        "in_use": true,
        "created_at": "2026-07-01T10:00:00Z",
        "updated_at": "2026-07-01T10:00:00Z"
      }
    ]
  }
}

Response examples (401)

{
  "code": 401,
  "message": "invalid token",
  "data": {}
}

Response examples (403)

{
  "code": 403,
  "message": "insufficient permissions",
  "data": {}
}

Response examples (500)

{
  "code": 500,
  "message": "internal server error",
  "data": {}
}