API products

An API product groups related open APIs. Once access is enabled, an Application can call those APIs at the specified version. Each product provides a Base URL, audience, scopes, schemas, quotas, and support information.

Open APIs and permissions in the Developer Console to view products and request access. Product names and descriptions are available in Chinese and English; scope, audience, and route identifiers remain fixed.

Basic concepts

Name	Description	Example
Application	Integration configuration for a product in one environment	Sandbox Application for acme-workflow
API product	A group of APIs with versions, addresses, and call requirements	OEM Core API
API access grant	Operations, data range, and quota available to the current identity	Read-only billing access for application identity

After creating an Application, request API access separately. Each request also checks the access token, organization, and resource permissions.

One Application supports application (service/confidential) and user (public + PKCE) identities. Each has a separate OAuth client and API access grant. Their permission states and revocation actions are independent.

Request API access

1. Sign in to the Developer Console and open APIs and permissions for the target Application.
2. Select Application permissions or User permissions for your scenario.
3. Select an API product and review its permissions, version, and environment.
4. Click Request access, select the required scopes, and submit. Access is enabled after automatic validation succeeds.

Permission states mean:

State	Meaning	Next step
Available	The Application has no subscription to this API Product	Click “Request access”, choose one or more published scopes, and submit the request
Configuration required	A legacy request needs actual scope provisioning	Check it and select Configure and enable
Enabled	The scope is configured and callable in the current environment	Use the scope and the audience/routes from the issued contract
Suspended / Revoked	The current API access grant is suspended or revoked	Contact product support
Not included	The API Product is subscribed, but this scope is outside the approved set	The Console does not append scopes to an existing subscription; follow the support process for a new product grant

Each retry-safe request is bound to the current Application, environment, identity, and API product. Once submitted, the page shows its status and available actions.

The platform binds the requested scopes and audience to the current identity's OAuth client. Start testing when the status is Bound. For Drifted or Temporarily unverifiable, check the configuration or retry later.

Map scopes to APIs, events and resources

1. Filter scopes by identity, product, status or data sensitivity in APIs and permissions.
2. Inspect related APIs, events and resource boundaries, then select the minimum set. Bulk selection affects currently available scopes; it does not extend active grants.
3. Review the complete selection. After saving, check grant status and actual binding status separately.

Information	Meaning
Related APIs	Public method and route; calls still require current scopes and resource access
Related events	Informational associations, not subscriptions; absent registration does not prove that a resource has no events
Data sensitivity	Data classification, not customer scope or resource authorization
Resource boundary	Current Application, environment and request-time rules, not a grant for a particular customer or resource
Customer resource authorization	Current customer authorization must cover requested resources; API scopes alone are insufficient

Configure reception separately with the event guide. A visible permission or Active label does not replace invocation checks. Recover original unknown requests; read current state after a conflict before confirming.

Get call configuration

The platform creates the OAuth client after configuration validation succeeds. Obtain the Client ID, issuer, audience, scopes, and credentials from the Developer Console for sign-in or API calls.

See Integration entry points and permissions for the authorization model.

Integration guides

Choose a guide for your task, then configure the required permissions in your Application's APIs and permissions page.

API product	Integration guide
SaaS subscription and payment API	Catalog, checkout and subscriptions; Platform pages
Token Packages and Multimodal API	Purchase packages, read allowance and invoke models
Independent Order Payment	One-time orders and original payment recovery

The guides describe supported calls. Access still depends on the product status, Application permissions and user authorization in the current environment. Product updates do not add permissions to existing Applications.

Shared endpoints and unavailable capabilities

Request access by product for SaaS commerce (including optional free activation), Token, independent order payment, order management, and business operations. Endpoints in the same product use their corresponding scopes.

The shared endpoints below use their own user authentication rules and require no separate commerce permission. See each guide for paths and scopes.

Capability	Integration guide	Status
Application directory (1 operation)	Read applications visible to the current customer	Defined public endpoint; use the current environment contract
User authorization (5 operations)	Read options, create, list, check and revoke	Defined public endpoints; verify current person and business Scopes on each request
User and customer space	Personal spaces and multi-application user correlation	Current Application user authentication; no additional API Product; see guide for availability
Product access snapshot	Interface description and restrictions	Not available to standard applications; excluded from the 28 public operations

Capability catalog

The main integration capabilities are listed below. Enable the corresponding API product and permissions before making a call.

Capability	Representative operation	Current status
Product access	Query organization product state and entitlements	Only authorized status fields are returned
SaaS subscription	Query, cancel, or change plan	Sandbox API Product is implemented; Production is not open
Payment/refund status	Query Checkout Operations and receive payment/refund events	Implemented in Sandbox; redacted status only
Asynchronous operations	Query Checkout outcome by operation_id	Implemented in Sandbox
Webhooks	Receive subscribed subscription, payment, refund, and access events	Implemented in Sandbox; Webhook endpoint verification and automatic configuration required

The stable Sandbox commerce routes are:

• GET /open-platform/v1/products (commerce.catalog.read)
• POST /open-platform/v1/checkout-sessions (commerce.checkout.create)
• GET /open-platform/v1/operations/{id} (commerce.checkout.read)
• GET /open-platform/v1/subscriptions, GET /open-platform/v1/subscriptions/{id} (commerce.subscription.read)
• POST /open-platform/v1/subscriptions/{id}:cancel, POST /open-platform/v1/subscriptions/{id}:change-plan (commerce.subscription.manage)

These routes are callable only after the current Application receives the matching API Product, scope, audience, and environment grant. Production routes are not open. The platform verifies provider callbacks; third parties receive redacted payment.* and payment.refund.* events through an approved Webhook Subscription.

Call requirements

• Use only the contract Base URL, version, routes, and schemas.
• Send a token with the required audience and least-privilege scopes.
• Include an Idempotency-Key on every command.
• Pin a supported version and monitor deprecation notices.
• Do not infer external routes from unpublished pages, source code, or service hostnames.
• Access data through public APIs rather than connecting directly to GoodVision databases.

Product status and environment

The platform publishes API products with the service version. Developers do not create or manually publish products. active permits configuration and calls; deprecated means disabled until reactivated; revoked means withdrawn. Product updates and service restarts do not automatically restore disabled or revoked products.

Product status, Application API access, and user consent are checked separately. After Sandbox acceptance, configure a separate Production Application, credentials, and scopes, and use the Production API version.

• Order Management: appmarket-orders/v1

• Business operations：appmarket-operations/v1