---
title: "Write a customer read-only request."
description: "The minimum contract for an authenticated, purpose-bound query if a Sandbox is prepared."
updated: "27 August 2026"
availability: "REFERENCE RESPONSE"
candidate_route: "/docs/api/quickstart"
---

# Write a customer read-only request.

The minimum contract for an authenticated, purpose-bound query if a Sandbox is prepared.

**REFERENCE RESPONSE:** Fixed request and response contract for review · not an executable client or service

## Begin with approved coordinates and credentials

- An environment ID assigned to the customer organization
- A short-lived credential delivered to an approved user
- The processing purpose and data scope stated in the applicable agreement
- An execution environment that follows the organization’s secret-handling policy

> **Access boundary:** The examples contain no working environment ID or token. Documentation alone cannot call a Sandbox.

## Keep secrets out of source and shell history

The example names variables only. An actual host is not published in this candidate. If an environment is later approved and issued, inject its exact coordinate and credentials from an approved secret manager or the secure channel agreed for the evaluation.

**Environment coordinate**

```bash
export HARBINGER_BASE_URL='https://<issued-environment-host>'
export HARBINGER_SUBJECT_ID='<approved-subject-id>'
export HARBINGER_DATA_PURPOSE='<approved-purpose>'
# Inject HARBINGER_PREVIEW_TOKEN from the approved secret manager
```

## Query the approved subject change view

The order and organization approval bind HARBINGER_DATA_PURPOSE to HARBINGER_SUBJECT_ID. A financial evaluation purpose cannot be reused against the supply-chain subject, or vice versa.

A successful response identifies the request, dataset cut, organization, purpose, authority state, and the observations supporting the returned change candidate. Fact, decision, and execution authority remain NONE.

**GET /changes**

```bash
curl --fail-with-body --silent --show-error \
  -H "Authorization: Bearer ${HARBINGER_PREVIEW_TOKEN}" \
  -H "Harbinger-Data-Purpose: ${HARBINGER_DATA_PURPOSE}" \
  "${HARBINGER_BASE_URL}/v1/subjects/${HARBINGER_SUBJECT_ID}/changes"
```

## Requests outside the grant fail closed

- 401 — missing or invalid credential
- 400 — processing-purpose header is absent
- 403 — purpose, capability, or data scope is not approved
- 405 — a method other than GET is used
- 404 — an unavailable resource or a non-existent recommendation, approval, command, or execution route

---

Published route: /docs/api/quickstart