Accounts
Accounts are the core multi-tenant unit in Prime. Every subscription, usage counter, API key, and webhook belongs to an account — not directly to a user. A single user can be a member of multiple accounts.
What an account contains
- A plan (
free-tier,starter,standard,premium) with feature limits - Billing information — gateway customer/subscription IDs (Stripe or Lemon Squeezy)
- Usage counters — API calls and scans consumed in the current billing period
- Access state — active, deactivated, or expired
- A list of member users with roles (
owner,admin,developer,user— see Users)
API endpoints
| Method | Endpoint | Description |
|---|---|---|
POST | /account | Sign up — create an account with its owner user |
GET | /account | Get the active account's profile |
DELETE | /account | Close the account (cascades users) |
GET | /account/plans | List public plans (no auth required) |
GET | /account/users | List users and pending invites on the account |
GET | /account/email-preferences | Get marketing/notification email preferences |
PUT | /account/email-preferences | Update email preferences (marketing, usage_alerts, billing, team_updates — security_alerts is always on) |
POST | /invite | Invite a user to join the account |
New accounts are created on the free-tier plan with a 14-day trial window. Self-serve signup via POST /account is disabled when NODE_ENV=production.
Account lifecycle
Trial → Active → Expiring → Expired → Closed
- Trial — new accounts start here with a free-tier plan
- Active — paid subscription confirmed
- Expiring — renewal approaching; warning emails sent
- Expired — subscription lapsed; access may be restricted
- Closed — account deleted, all data cascaded
Background jobs handle transitions automatically. See Background Jobs for cron configuration.
Usage tracking
Each account has an app_usage record tracking consumption in the current billing period:
scans_used— number of scans consumedapi_used— number of API calls made
Counters reset automatically when the billing cycle renews (REFRESH_BILLING_CYCLES_CRON).
Expiry settings
ACCOUNT_EXPIRY_REMINDER_DAYS=14 # Days before expiry to send a warning email
ACCOUNT_CLEANUP_AFTER_DAYS=30 # Days after expiry before permanent deletion