Capability SKUs

AuthSpoke is one platform with many capabilities. Capability SKUs define what a tenant has licensed; the navigation, APIs and experience adapt automatically. New tenants are AI-first by default.

Read your capabilities#

curl "https://your-company.authspoke.com/api/v1/platform/capabilities" -H "Authorization: Bearer $TOKEN"

{
  "capabilities": {
    "AI_CONTROL_PLANE": true,
    "IDENTITY_FOUNDATION": false,
    "WORKFORCE_SSO": false,
    "DIRECTORY": false,
    "SCIM": false,
    "API_GATEWAY": false,
    "ADVANCED_REPORTING": false,
    "COMPLIANCE_SUITE": false
  },
  "features": { "RELATIONSHIP_GRAPH": true, "AI_ASSISTANT": true }
}

This endpoint is read-only. Clients use it to decide what to render; managing SKUs is a provider-only operation.

Default experience#

Every new tenant receives AI_CONTROL_PLANE and nothing else. The traditional IAM surface (Users, Applications, SSO, SCIM, Directory) stays hidden until IDENTITY_FOUNDATION is licensed — so the product appears intentionally designed around AI operations.

Server-side enforcement#

Capability checks are enforced on the server, not the client. Calling a capability-gated endpoint without the SKU returns:

{ "error": "capability_not_licensed", "capability": "IDENTITY_FOUNDATION", "message": "This capability is not enabled for your tenant." }

This guarantees a consistent answer across the UI, SDKs, CLI and AI agents — the frontend is never the sole gate.

Capabilities vs. feature flags vs. kill switches#

These are three separate concepts and must never be conflated:

• Capability SKUs — licensing: what a tenant has purchased. See this page.
• Feature Flags — rollout within an enabled capability.
• Kill Switches — operational emergency controls, global, no redeploy.