AI Budgets / Quota API

Endpoints

Get Budget Scope Rules - List the flat AI budget scope rules aggregated from all owner sources
Get Budget Hierarchy - Get the AI budget hierarchy tree rooted at the Project (Tenant) node
Get Effective Limit - Compute the effective token-limit preview for a single hierarchy node
Update Budget - Update the AI token budget of an owner entity (org / proxy / project / credential binding)

All endpoints require authentication using a Personal API Access Token (Authorization: Bearer {token}). JHipster JWTs do not work on APIops.

Reads (GET scope-rules / hierarchy / effective-limit) require the AI_BUDGETS asset category with VIEW.
Update (PUT) requires the AI_BUDGETS asset category with MANAGE.

This is the same authority the classic AI Quota screen enforces; APIops does not widen the privilege surface versus the UI.

Budget model - The AI token budget is a four-tier ownership chain: Project (Tenant cap) → API Proxy (App cap) → Credential Organization (Org cap) → Credential binding (leaf limit). The effective limit at any node is the min(...) of all non-null caps in its ownership chain.
Read shape - The read endpoints project the classic AiQuotaResource aggregations (aggregateScopeRules, buildHierarchy, computeEffectiveLimit) into APIops DTOs. No _class discriminator is emitted.
ID-based hierarchy references - Unlike the rest of the APIops surface (which is name-based), the budget hierarchy is addressed by entity IDs. The nodeId in the effective-limit path and the targetId in the update body are the entity IDs surfaced by the scope-rules / hierarchy reads (owner entity ID, nodeId, scopeRef). Resolve them from a read first.
Cross-tenant guard - On update, the body targetProjectId is forced to the authenticated path project. An arbitrary body targetProjectId can never redirect the write to another tenant.
Usage percentages - usagePercent is derived from AiTokenUsageDaily (last 30 days / tokensPerMonth). Until the usage-aggregation job has produced data it is null (the UI renders "—").