Glossary

Precise definitions for every term used across this site. If a page uses a capitalized term (Entitlement, AppRole) without defining it inline, it means exactly what’s written here.

---

Access path

One way a User reaches an Application: their own personal Entitlement, or an org-wide grant from an Organization that includes them. Resolved access is the union of every active path. See Access Control.

Access tier

Which Pricing tier unlocks an Application: free (every User) or standard (Users covered by a Subscription). See Applications.

API Key

A long-lived service credential (satk_live_…/satk_test_…), scoped to the platform or to one Application. An app-scoped key can only ever touch its own Application’s rows. See API Keys.

API version

The version of the REST API a request is written against, sent as a whole number in the required Substratal-Version header. 1 is the only one so far. Unrelated to a webhook payload version. See Conventions → Versioning.

App token

The short-lived (5-minute) JWT an Application verifies locally, with aud set to that Application. Carries entitlement_status and effective_permissions. See Auth → The app token.

Application

(also “App”) One developer’s separately-hosted app (web, iOS, macOS, Windows, Linux, …) that uses Substratal Apps for its users, settings, organizations, tenancy, and storage. This is its catalog entry. See Domain Model → Applications.

AppProfile

Per-app identity data for one user — e.g. a display handle meaningful only inside that one app. Distinct from the global Profile.

AppRole

A Role scoped to one Application, defined by that app’s own catalog entry rather than by the platform. See Domain Model → Roles & Permissions.

AppSettings

Per-app configuration for one user, layered over that user’s global Settings and the Application’s declared defaults. See Workflows → Settings resolution.

Audit Event

An immutable record of who changed what access, when. See Domain Model → Orders & Audit.

Device

One install of an Application on one device, signed in as one User, with the APNs, FCM, or Web Push token that reaches it (dvc_…). Tied to the Session that registered it, so signing out stops its pushes. See Push Notifications → Devices.

Effective permissions

The resolved set of Permissions a user holds for a given Application — the union of the permissions on their app-scoped Roles for that app (explicit assignments plus the app’s default_app_role), and empty unless the User and their Entitlement are both active. Only that app’s own app.<slug>.* keys ever appear; platform Roles govern the hub, not apps. See Access Control.

Entitlement

The join record between a User (or Organization) and an Application: do they own it, and is it currently switched on. The record behind “turn an app on/off for a user.” See Domain Model → Entitlements.

Hub

Shorthand used throughout this site for Substratal Apps itself — the platform this API belongs to.

MCP

Model Context Protocol — the standard this site’s AI-agent-facing tool-call interface implements. See MCP Server. Introduces no new authorization model of its own; see Authentication — no new model.

Notification

One alert or update to one User (ntf_…), from an Application or from the platform. Pushed to the User’s Devices when it can be, and always kept in their inbox for 90 days. See Push Notifications.

Order

Not an entity of this API. It’s the developer’s own commerce record, in their own billing system. An Entitlement carries only an opaque order_id reference to it. See Domain Model → Orders & Audit.

Organization

A domain/grouping object for Users — a company, or a group within a company — used to organize shared admin standing and group-wide Application access. Decoupled from infrastructure placement; see Tenant and Tenant vs. Organization. Pulled into Phase 2; see Organizations.

OrganizationMembership

The join record between a User and an Organization, carrying that User’s standing within that one Organization (org_admin or member) and whether it’s pending (invited, not yet accepted) or active — a User can hold this for any number of Organizations at once. See Domain Model → Users & Organizations.

Payload version

The shape of a webhook’s payloads, a date pinned on each subscription as api_version (currently 2026-10-05) and moved forward only by its owner. Unrelated to the API version. See Webhooks → Payload versions.

Permission

An atomic, checkable capability, written as a dotted key (billing.manage, app.timetrack.export). Never assigned directly to a user — always granted through a Role.

Plan

The subscription tier covering a User: free or standard. A User is on Standard through their own subscription or an Organization’s. Business and Enterprise plans come later. Independent of Tier. See Pricing.

Platform alert

A Notification the platform raises itself about the User’s account, such as a new sign-in or a changed password. Its category is from a fixed catalog under security. and account.. See Push Notifications → Platform alerts.

PlatformRole

A Role that applies across the whole hub rather than one Application — superadmin, support, billing_admin, member.

Profile

Global, cross-app identity and contact data for a User — name, avatar, email, locale. Distinct from AppProfile.

Push credential

An Application’s own key for one push provider: an APNs .p8 key, an FCM service account, or a Web Push (VAPID) key pair (pcr_…). Write-only and KMS-encrypted. Providers deliver only for the app a token was issued to, so every Application brings its own. See Push Notifications → Push credentials.

Role

A named bundle of Permissions. Either a PlatformRole or an AppRole.

Seat

A covered member of an Organization with a Standard subscription: a distinct, active, non-test-mode member included by the subscription’s member selection. The unit an Organization is billed on, $6 each per month. See Pricing.

Session

One successful login (ses_…). Every refresh token and app token minted from it carries its id as sid, and revoking it ends them all. See Auth → Sessions.

Settings

Global, cross-app configuration for a User — locale, timezone, notification preferences. Distinct from AppSettings.

Subscription

A User’s or an Organization’s Standard subscription (sbs_…), billed through Stripe at $6 per covered user per month. While it covers its holder, the platform grants subscription Entitlements to every standard Application. See API Reference → Billing.

Tenant

The infrastructure-placement and data-isolation boundary for an Application’s data — it belongs to the owner of the Application’s catalog entry, and isn’t billed. shared (default), isolated, or dedicated_region. Not the same thing as Organization — see Tenant vs. Organization. See Domain Model → Tenancy.

Tier

Where a Tenant’s data physically lives: shared, isolated, or dedicated_region. Independent of Plan. The non-shared tiers are reserved for business and enterprise pricing, which isn’t offered yet.

User

A person with an account on Substratal. One identity, used everywhere in the hub and, via the Trust Model, in every app they launch from it.

Webhook

A signed HTTPS POST the hub sends an Application when something changes. access.revoked and role.removed are required subscriptions. See Webhooks.