Product access snapshot
After receiving oem.access_context.changed.v1, query current member permissions with the application service identity.
Request
POST /open-platform/v1/applications/{id}/events/{event_id}/access-snapshot
Use GOODVISION_API_BASE, a Bearer Token issued to the current application service Client, scope openplatform.api.invoke, and an empty JSON object {}. Enable the member-access feature for the application. Ordinary users need no operations role or service permission.
id selects the current application; event_id selects an original access event recorded for it. The original event determines the customer space, product and member. Additional customer, organization, Profile or environment selectors are rejected. This endpoint does not list customers or all members. Credentials from another application cannot read the event.
Apply the result
The response contains application_id, environment, product_code, audience, organization, product_access, exactly one members entry, entitlements, capabilities, and generated_at, with Cache-Control: no-store.
The member identifier membership_id matches space.membership_id in the user context. It is not interchangeable with open_id, union_id or a login subject. Apply permissions only when product_access_allowed is explicitly true, both identity and membership are active, product access is trial or active, and access_revision is at least the original event revision. An unclassified license omits product_license_kind; never infer a builder license.
Verify permissions, product and subscription independently for each application. A shared union_id does not authorize cross-application access. Successful payment, subscription activation or fulfillment cannot substitute for this readback.
Failure and recovery
Persist the event and restrict old permissions first. For 401, obtain a fresh current-application service Token. For 403/404, verify the application, event and feature are still valid. For 503, retain the event and retry within a bounded budget. Missing fields, a mismatched member or an insufficient revision must keep access restricted.
Related: Subscription lifecycle · Event catalog · API products