Write a customer read-only request.

Begin with approved coordinates and credentials

• An environment ID assigned to the customer organization
• A short-lived credential delivered to an approved user
• The processing purpose and data scope stated in the applicable agreement
• An execution environment that follows the organization’s secret-handling policy

Keep secrets out of source and shell history

The example names variables only. An actual host is not published in this candidate. If an environment is later approved and issued, inject its exact coordinate and credentials from an approved secret manager or the secure channel agreed for the evaluation.

export HARBINGER_BASE_URL='https://<issued-environment-host>'
export HARBINGER_SUBJECT_ID='<approved-subject-id>'
export HARBINGER_DATA_PURPOSE='<approved-purpose>'
# Inject HARBINGER_PREVIEW_TOKEN from the approved secret manager

Query the approved subject change view

The order and organization approval bind HARBINGER_DATA_PURPOSE to HARBINGER_SUBJECT_ID. A financial evaluation purpose cannot be reused against the supply-chain subject, or vice versa.

A successful response identifies the request, dataset cut, organization, purpose, authority state, and the observations supporting the returned change candidate. Fact, decision, and execution authority remain NONE.

curl --fail-with-body --silent --show-error \
  -H "Authorization: Bearer ${HARBINGER_PREVIEW_TOKEN}" \
  -H "Harbinger-Data-Purpose: ${HARBINGER_DATA_PURPOSE}" \
  "${HARBINGER_BASE_URL}/v1/subjects/${HARBINGER_SUBJECT_ID}/changes"

Requests outside the grant fail closed

• 401 — missing or invalid credential
• 400 — processing-purpose header is absent
• 403 — purpose, capability, or data scope is not approved
• 405 — a method other than GET is used
• 404 — an unavailable resource or a non-existent recommendation, approval, command, or execution route