Fac-360
Companies

Plan consumption for this company

A read, and only a read. ADR 0016 point 6 keeps the quota holder on the company and usage.consume_quota is untouched. The period is this company's own plan period, not a window this route picked.

GET
/console/v1/companies/{companyId}/usage

A read, and only a read. ADR 0016 point 6 keeps the quota holder on the company and usage.consume_quota is untouched. The period is this company's own plan period, not a window this route picked.

Authorization

consoleSession
__Host-apf_console<token>

Set by POST /console/v1/sessions. HttpOnly, Secure, SameSite=Strict, Path=/, __Host- prefixed. It is never readable by JavaScript and there is no header alternative: accepting both carriers would let an attacker choose the weaker one.

In: cookie

Path Parameters

companyId*string
Formatuuid

Query Parameters

metric?string
Lengthlength <= 60
Default"documents.accepted"

Response Body

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

application/json

curl -X GET "https://example.com/console/v1/companies/497f6eca-6276-4993-bfeb-53cbbbba6f08/usage" \  -H "Authorization: Bearer apf_v2_tu_credencial"
{  "schemaVersion": "console.1",  "requestId": "d385ab22-0f51-4b97-9ecd-b8ff3fd4fcb6",  "companyId": "8bb73d03-06b4-47c7-80c7-59301f770eda",  "metric": "string",  "planCode": "string",  "metered": true,  "periodUnit": "DAY",  "periodStart": "2019-08-24",  "limit": 0,  "consumed": 0}

Revoke an API credential DELETE DELETE

Immediate, not at expiry: auth.lookup_api_credential re-reads revoked_at on every authenticated request, so the next one fails. Same DEVELOPER floor as minting, deliberately and never higher -- revocation is the emergency action, and a system where creating a credential is easier than killing it has the incentives backwards. Unknown, already revoked, and belonging to another company are one 404.

The request and error log GET GET

The read that exists so a rejected comprobante does not become an email to support. One entry per SUNAT attempt -- retries are never collapsed -- plus operations that never reached SUNAT at all, each with the verbatim response code and description, the transport classification, and the PUBLIC prefix of the credential that started it. The free-form operations.result jsonb is deliberately NOT published: nothing bounds what a future workflow writes into it.