The six user RPCs authenticate a user. Every call requires membership of the request's organization_id (PermissionDenied otherwise) and the paid-plan entitlement for THAT organization, judged alone: paying through one organization grants nothing in another. An unentitled organization answers the same access-denied error other cloud features return. Any member reads every note in the organization; Update and Delete are allowed for the note's author or an organization owner, and PermissionDenied for anyone else. A note id from another organization, or an expired note, is NotFound.

Writes are bounded by a per-organization hourly quota counted over a fixed UTC clock hour (see OrganizationNoteQuota). One accepted create, or one update that changes the body or tags, consumes one unit; deletes, reads and idempotent replays consume none. An exhausted quota is ResourceExhausted with an OrganizationNoteQuotaExceeded error detail.

CreateSessionWebhook registers an endpoint. INVALID_ARGUMENT for a URL the endpoint policy rejects (not https, credentials in the URL, a fragment, or a host that is or resolves to a private, loopback, link-local or metadata address), an empty or unknown event type set, an unknown format, a description over 200 characters, or a caller-supplied secret that is not 16-256 visible ASCII characters. FAILED_PRECONDITION once the organization has 20 endpoints, counting other owners' endpoints the caller cannot see.

CreateTrigger creates a trigger owned by the caller in organization_id, which the caller must be a member of. For an HTTP trigger the response carries the signing secret; it is returned ONLY in this response and can never be read back, only replaced with RotateTriggerSecret.

Webhook configuration management

DeleteOrganization removes an organization the caller owns. Refused unless the organization is empty: no sessions, no entitled cloud account, no other members. The personal organization can never be deleted.

DeleteSessionWebhook permanently deletes an endpoint with its delivery history. While member session sharing is off: NOT_FOUND for another owner's endpoint; an orphaned one may be deleted.

DeleteTrigger permanently deletes a trigger the caller created, or, for an owner of its organization, a member's trigger, together with its secret and invocation history. Its endpoint stops accepting requests immediately.

Cloud billing and access. User-authenticated.

GitHub App repository registration. User-authenticated.

Weekly newsletter opt-in (BOS-1318). User-authenticated. The subscription goes through the Loops form endpoint, the only path Loops gates with double opt-in; see docs/analytics/newsletter.md.

GetOrganizationNoteQuota reports the organization's current quota window without consuming any of it. Same membership and entitlement rules as the other organization-note RPCs.

GetSessionWebhookDelivery returns one delivery with its attempts in order, the request body rendered through the endpoint's current format and the request headers. Never returns a secret. While member session sharing is off: NOT_FOUND for a delivery about another member's session or on another owner's endpoint, FAILED_PRECONDITION for one on an orphaned endpoint.

GetTrigger returns one trigger the caller created, or, for an owner of its organization, a member's trigger. Never returns a secret.

GetTriggerCatalog returns the trigger types, event types, and filter fields bosso accepts. Needs user authentication only; it is static metadata, so no cloud access or organization is required.

IssueAttachToken returns a short-lived JWT bound to (user, session, chat, scope) that the browser uses to authenticate the /ws/attach WebSocket handshake. TTL ~5 minutes.

LeaveOrganization removes the CALLER's own membership. Any member may leave; the last owner of an organization that still has members may not, and nobody may leave their personal organization.