Users and customer spaces

After login, read open_id, union_id and the customer space. The platform generates identifiers and a default personal space automatically. No user group or additional API Subscription is needed.

Request

POST ${GOODVISION_API_BASE}/open-platform/v1/user-context:resolve

Call from your server with the current Application's user Access Token. Send {} at first entry:

curl --request POST \
  --url "${GOODVISION_API_BASE}/open-platform/v1/user-context:resolve" \
  --header "Authorization: Bearer ${GOODVISION_USER_ACCESS_TOKEN}" \
  --header 'Content-Type: application/json' \
  --data '{}'

Parameter	Location	Required	Description
Authorization	Header	🔴 Required	Bearer <USER_ACCESS_TOKEN> from the current user Client, not an application identity Token
Content-Type	Header	🔴 Required	application/json
JSON request body	Body	🔴 Required	Send {} at first entry; no user or space ID is needed
organization_id	Body	Optional	Omit to prepare or reuse the personal space; send only when the user explicitly selects an existing customer space, with membership checked again

For an explicit existing space selection, send {"organization_id":"<SELECTED_CUSTOMER_SPACE_UUID>"}. Do not send Application, user or permission fields, organization Headers or Query parameters.

Response

These fields are generated and returned by the platform, not request parameters that developers must fill in.

Field	Purpose
application_id, environment	Verify the current Application and environment
user.open_id	User correlation within this Application; suitable as your application's user key
user.union_id	Correlate the same person across Applications owned by one developer in one environment
space.organization_id	Current customer space for subsequent business scope; users do not enter it
space.membership_id	This user's membership in this space
space.display_name	Display label; names do not establish permission
space.kind	personal means default personal entry; selected means explicit selection, not a team classification
resolved_at, expires_at	Resolution and expiry timestamps, at most five minutes apart

Download the response JSON Schema. Verify Application, environment, current selection and expiry on your server, and resolve again when needed. Responses are no-store and expose neither private identity IDs nor Secrets.

open_id and union_id

The platform generates OpenID (open_id) and UnionID (union_id). Read both from the response's user object:

The same person enters	open_id	union_id
Applications A and B under one developer in one environment	Different	Same
The same Application, switching customer spaces	Unchanged	Unchanged
Different developers or environments	Isolated	Isolated

Transferring an Application does not merge historical users. User identifiers grant no product access or paid entitlement.

Recovery

Status	Action
400	Correct the request; keep only the optional customer-space selection
401	Authenticate again in the current Application
403	Stop operations in this space and confirm the Application or membership selection
503	Preserve verified login and the original operation; offer bounded retry

An invalid space never silently becomes another space. Do not use the developer business as a customer fallback or loop through login on 503. Identity and membership confer no product, paid, credit or platform privileges.

For membership-related oem.access_context.changed.v1, correlate data.subject_id with space.membership_id. Subscriptions correlate by Application, environment, customer space and subscription ID. None of these references is interchangeable with sub, open_id or union_id. See Applications, users and events.