Plans & feature availability¶
Use this page to see what your organization can access in the console vs API only, and which plan unlocks each capability. Menu visibility is a hint only — the API enforces entitlements.
Check your org: GET /api/v1/orgs/plans (authenticated). HTTP 403 with a
Feature '…' requires plan message means upgrade or wrong role.
Plan ladder (entitlements)¶
| Plan ID (API) | Legacy / UI alias | Rank (higher = more) |
|---|---|---|
eval |
free |
0 |
pilot |
pro |
1 |
essential |
— | 2 |
professional |
— | 3 |
enterprise |
enterprise |
4 |
Docs may say “Free” or “Pro” for readability; your instance returns canonical IDs above.
Console modules (sidebar)¶
Matches the console sidebar configuration. Beta items need VITE_BETA_NAV=true on the
deployment. Some operator-only protect modules are not documented here.
| Console label | Route | Min plan (nav) | Role | Notes |
|---|---|---|---|---|
| Dashboard | /dashboard |
Eval (free) | Member+ | |
| Pentest | /scan |
Eval | Member+ | |
| Internal Exposure | /network |
Enterprise | Member+ | |
| Surface Monitor | /asm |
Pro (pilot band) | Member+ | API gate: surface_monitor |
| CI Gate | /triggers |
Pro | Member+ | API: ci_automation / webhooks |
| Reports | /results |
Eval | Member+ | |
| Compliance | /compliance |
Eval | Member+ | PDF/compliance features may need Pilot+ |
| Organization | /orgs |
Eval | Admin | Users, API keys |
| Integrations | /integrations |
Eval | Admin | |
| Sense Fleet | /sense-fleet |
Eval | Admin | |
| White-Label | /branding |
Enterprise | Admin | API: white_label |
| System Health | /health |
Eval | Admin | SPA route — not the JSON /health probe |
| Cross-Intelligence | /intelligence |
Enterprise | Member+ | |
| Threat Feed | /threat-feed |
Enterprise | Member+ | |
| Swarm | /swarm |
Enterprise | Member+ | Beta nav |
| API Scanner | /api-scanner |
Pro | Member+ | Beta nav; API: api_scanner |
| Security Audit | /security-audit |
Enterprise | Admin | Beta nav |
| API Explorer | /api-explorer |
Enterprise | Admin | Beta nav |
API-only or no console UI¶
| Capability | Min plan (API gate) | Role | Endpoints |
|---|---|---|---|
| Scheduled scans | Essential+ | Admin to create; member to list | /api/v1/orgs/{org_id}/scan-schedules — API guide |
| SSO / OIDC | Professional+ | Platform admin | Env + SSO & RBAC |
| Pentest campaigns (Swarm backend) | Enterprise | Varies | Campaigns API |
There is no “Scheduled scans” screen in the Vue console today — use the API or your own UI.
Selected API feature gates¶
Server-side API gates (may differ slightly from sidebar hiding):
| Feature key | Min plan |
|---|---|
compliance_pdf, remediation_verify, api_scanner |
pilot |
surface_monitor, ci_automation, webhook_ci |
pro (pilot band) |
scheduled_scans |
essential |
sso |
professional |
white_label, internal_exposure, swarm, intelligence, threat_intel, security_audit |
enterprise |
Roles¶
| Role | Typical access |
|---|---|
| Member | Run scans, read reports (within plan) |
| Admin | Organization, integrations, API keys, health, branding (plan permitting) |
| Viewer | Read-only where enabled |