0.3 source candidate: a verified Server Key or Customer/Guest session reads local rules and remote flag keys. Remote rules stay on the server; lists contain hashes and sensitive targeting should use server evaluation. Supports private ETag revalidation. Protocol headers are version metadata. This candidate is not published or deployed.
API v1Updated
Make the request
0.3 source candidate: a verified Server Key or Customer/Guest session reads local rules and remote flag keys. Remote rules stay on the server; lists contain hashes and sensitive targeting should use server evaluation. Supports private ETag revalidation. Protocol headers are version metadata. This candidate is not published or deployed.
Credential
Server API key or customer token. Customer calls cannot select another customer.
Permission
features:read
Set the base URL and App ID from SDK setup. These examples use placeholders and do not execute requests. Never put a server key in browser code.
The response tab lists field types, not an example payload. Actual values depend on customer state.
Request parameters
Query parameters
This operation takes no request parameters.
Response fields
Successful responses include requestId and scope. Use the actual business status or accepted field to determine the result. Optional fields are omitted when unavailable.
HTTP 200 · application/json
requestIduuidRequired
Server-generated HTTP request UUID. Include it when reporting a failed request.
scopeobjectRequired
The App and environment of this response. Headers only verify scope; they cannot switch key scope.
Show child fields
projectIdstringRequired
App ID bound to the credential.
minLength: 1
environmentenumRequired
Separate data scope: sandbox or live.
Show allowed values
"sandbox""live"
payloadobjectRequired
The payload value for this operation. Its accepted type and constraints are listed above and below.
Show child fields
scopeobjectRequired
The App and environment of this response. Headers only verify scope; they cannot switch key scope.
Show child fields
projectIdstringRequired
App ID bound to the credential.
minLength: 1
environmentenumRequired
Separate data scope: sandbox or live.
Show allowed values
"sandbox""live"
generationstringRequired
The generation value for this operation. Its accepted type and constraints are listed above and below.
pattern: ^[a-f0-9]{64}$
evaluatedAtdate-timeRequired
UTC server time at which this state was evaluated.
expiresAtdate-time | nullRequired
ISO 8601 UTC expiry. Expired sessions and reservations cannot be reused.
featuresobjectRequired
The features value for this operation. Its accepted type and constraints are listed above and below.
savedGroupsobjectRequired
The savedGroups value for this operation. Its accepted type and constraints are listed above and below.
experimentsobjectRequired
The experiments value for this operation. Its accepted type and constraints are listed above and below.
remoteFeaturesarrayRequired
The remoteFeatures value for this operation. Its accepted type and constraints are listed above and below.
maxItems: 500
Handle errors
Common failures
Code
Recovery
UNAUTHENTICATED
Verify the key or refresh the expired customer token once.
FORBIDDEN
Check current key permissions and customer access.
INVALID_REQUEST
Check field types, UUIDs, decimal strings and mutually exclusive fields.
SCOPE_MISMATCH
Use the App and environment bound to the credential.
Common failures
UNAUTHENTICATED
Recovery
Verify the key or refresh the expired customer token once.
FORBIDDEN
Recovery
Check current key permissions and customer access.
INVALID_REQUEST
Recovery
Check field types, UUIDs, decimal strings and mutually exclusive fields.
SCOPE_MISMATCH
Recovery
Use the App and environment bound to the credential.