> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thewo.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Product access

> Understand Operational Evidence entitlement, quota, and idempotent access behavior.

# Product access — Operational Evidence

`POST /v1/evidence/reports` is a protected product operation.

A valid API key identifies the customer, but authentication alone does not guarantee that the customer may execute Operational Evidence.

The current access path is conceptually:

```text theme={null}
valid API key
→ active Operational Evidence entitlement
→ available quota
→ Evidence Report execution
```

## Product entitlement

The customer must be entitled to execute the Operational Evidence `evidence_report` operation.

Entitlement is evaluated before billable execution and before an idempotent POST replay is returned.

If product access is not enabled, the API returns:

```text theme={null}
403 product_not_entitled
```

Example:

```json theme={null}
{
  "error": {
    "code": "product_not_entitled",
    "message": "The customer is not entitled to create Operational Evidence reports.",
    "requestId": "req_123"
  }
}
```

Internal entitlement reasons and identifiers are not exposed.

## Entitlement check unavailable

If The Wo cannot safely evaluate product entitlement, the operation fails closed with:

```text theme={null}
503 entitlement_check_unavailable
```

Example:

```json theme={null}
{
  "error": {
    "code": "entitlement_check_unavailable",
    "message": "Product entitlement validation is temporarily unavailable.",
    "requestId": "req_123"
  }
}
```

Clients may retry a temporary 503 according to their normal retry policy.

## Relationship to quota

Entitlement and quota are different decisions:

```text theme={null}
entitlement
→ whether the customer may use Operational Evidence

quota
→ how much evidence_report capacity remains in the applicable period
```

A customer can therefore be entitled to the product and still receive:

```text theme={null}
429 quota_exceeded
```

when the current quota is exhausted.

## Idempotent retries

Entitlement is checked on every protected create request, including a request that could otherwise replay a completed idempotent result.

If access has been disabled since the original request, the retry is denied instead of using the old idempotency result as an access bypass.

When access remains enabled, existing idempotency behavior is unchanged:

```text theme={null}
same customer
+ same operation
+ same Idempotency-Key
+ same request
→ original result
→ no duplicate provider execution
→ no duplicate Evidence Report
→ no second usage charge
```

## Public metadata

Entitlement implementation data remains internal.

The public Evidence Report success response does not include:

```text theme={null}
customerId
apiKeyId
entitlementId
entitlement reason
subscription or plan identifiers
provider metadata
provider cost
```