Skip to main content
GET
/
oauth
/
profiles
curl (runnable — bearer token)
curl https://phosra-api-sandbox-production.up.railway.app/oauth/profiles \
  -H "Authorization: Bearer sbxtok_9xRWtUBLsk1omBYjWWe-20KbCxTO1Noh"
[
  {
    "id": "mia",
    "displayName": "Mia",
    "subject_ref": "a11ce0fa-0000-4000-8000-0000000000a1",
    "kind": "child"
  },
  {
    "id": "leo",
    "displayName": "Leo",
    "subject_ref": "a11ce0fa-0000-4000-8000-0000000000a2",
    "kind": "child"
  },
  {
    "id": "ava",
    "displayName": "Ava",
    "subject_ref": "a11ce0fa-0000-4000-8000-0000000000a3",
    "kind": "child"
  }
]
Sandbox only. Hosted on the census host root (not /api/v1), gated on PHOSRA_ENV==sandbox — 404 elsewhere.
Returns a bare JSON array of the seeded sandbox child profiles (Mia / Leo / Ava) for a valid Authorization: Bearer sbxtok_… token from POST /oauth/token. The response is not wrapped in an object — it is the array itself.

​
Worked example

Fully runnable — supply a token from the token leg: 
curl https://phosra-api-sandbox-production.up.railway.app/oauth/profiles \
  -H "Authorization: Bearer sbxtok_9xRWtUBLsk1omBYjWWe-20KbCxTO1Noh"
Real 200 response (captured from the hosted sandbox): 
[
  { "id": "mia", "displayName": "Mia", "subject_ref": "a11ce0fa-0000-4000-8000-0000000000a1", "kind": "child" },
  { "id": "leo", "displayName": "Leo", "subject_ref": "a11ce0fa-0000-4000-8000-0000000000a2", "kind": "child" },
  { "id": "ava", "displayName": "Ava", "subject_ref": "a11ce0fa-0000-4000-8000-0000000000a3", "kind": "child" }
]
A missing or non-sbxtok_ bearer token returns 401 invalid_token. The subject_ref is the stable child id that downstream policy and enforcement legs key on.

Authorizations

​
Authorization
string
header
required

SANDBOX-ONLY opaque bearer ("sbxtok_…") issued by POST /oauth/token, presented to GET /oauth/profiles. Not a production credential — the sandbox reference OAuth surface is stateless and gated on PHOSRA_ENV==sandbox.

Response

Bare array of child profiles (NOT wrapped in an object).

​
id
string
required

Unique identifier for this resource.

Example:

"mia"

​
displayName
string
required

Human-readable child display name shown on the consent page.

Example:

"Mia"

​
subject_ref
string
required

Stable child id downstream policy/enforcement legs key on.

Example:

"a11ce0fa-0000-4000-8000-0000000000a1"

​
kind
string
required

Profile kind; always child for the seeded sandbox family.

Example:

"child"