Skip to main content
Billing covers the organization plan, governed-action usage, seats, invoices, and payment methods. Alerts for past due, limit reached, and scheduled plan changes appear in the dashboard only.

​
Overview

Dome meters governed actions from the durable audit trail. Plans include a permanent free SKU and paid tiers with usage caps and platform fees. SIEM streaming and other add-on capabilities depend on plan entitlements. The typical workflow is:
  1. Check status and usage for the active plan and current period.
  2. Change plan or seats when you need a different SKU or seat count.
  3. Manage payment methods and invoices for collection.
Card capture completes in the dashboard (or Stripe.js). The CLI can list methods and start setup, but it is not a full card-entry path.

​
Requirements

Before you begin:
  • Authenticate to Dome with an organization-scoped role that can manage billing
  • Use the dashboard for payment-method capture and billing alert banners

​
Permissions

​
Check status and usage

Read the active plan, period usage, and free-tier caps when they apply.
Requires billing.manage.
dome usage-caps is read-only and returns empty for paid orgs.
Reference: dome billing

​
Change plan or seats

Change the SKU or seat count for the organization. Use --dry-run to preview.
Requires billing.manage.
Reference: dome billing change-plan

​
Manage payment methods and invoices

List invoices and payment methods. Add a card through the dashboard.
Requires billing.manage.
Reference: dome billing invoices

​
Org lock and plan limits

Every org member sees a read-only lock banner when the organization is suspended for billing reasons. Enterprise orgs are never locked for billing. Upgrades apply on the next request. Downgrades and cancellations keep the current plan until the period ends, then the org moves to the target SKU. Downgrading may put existing assets — extra tenants, workspaces, seats, agents, or connections — over the target plan’s caps. The dashboard blocks the switch and lists the over-limit resources; remove them first, then retry. Creates that hit a SKU cap return HTTP 429 and emit access.denied with reason=quota_exceeded (see access.denied reasons). Use dome usage-caps to inspect free-tier caps when they apply.

​
Next steps

  • Export data for continuous SIEM streaming when your plan includes it
  • Set usage limits for workspace Quotas (runtime spend caps, separate from plan metering)
  • Manage access for who can administer the organization