Memberships, consent and data handling
Payment, access, disclosure permission and portfolio publication are separate states. Integrate each deliberately.
Keep four decisions separate
| State | Authority |
|---|---|
| Purchase/payment state | Server-confirmed checkout and reconciliation. |
| Membership/access decision | The tenant-scoped verification result. |
| Disclosure permission | The member’s current consent for the membership and purpose. |
| Public portfolio publication | The member’s publish action in their own account. |
A buyer’s purchase does not authorize a vendor to publish a portfolio or collect every profile field. A member’s public handle is not an access credential.
Grant only the fields needed
Consent operations require the member’s own authenticated session. The purpose is membership_verification. Supported fields are membership_status, valid_until, display_name and photo. Ask for only the fields required by the specific member experience.
{
"granted": true,
"purpose": "membership_verification",
"fields": [
"membership_status",
"valid_until"
]
}The member grants consent for a particular membership ID. The vendor owner and integration reader cannot approve consent for the member. Check ownership and the current state before acting.
Respect revocation and missing fields
To revoke, send granted=false with the supported purpose and an empty fields list. A missing or revoked permission should remove data from new views and future processing in your integration. Do not interpret a previously cached name/photo as continuing authorization.
{
"granted": false,
"purpose": "membership_verification",
"fields": []
}The pending-consent listing is not a complete history of every revoked choice. Use the consent records and supported account flow for current decisions. Data deletion and retention requirements depend on your service arrangement; keep only the information your approved workflow needs.
Protect operational data
- Redact bearer credentials, signing secrets, checkout tokens and raw card reads from logs.
- Store tenant ownership with every local record; never select a tenant from untrusted client input alone.
- Keep contact/profile data out of public pages and general telemetry.
- Restrict CSV exports and expire local copies according to your approved retention process.
- Use request IDs and nonsecret resource references when contacting support.
Endpoint reference
Paths below include the API prefix. The OpenAPI server URL already includes /api.
/api/vendor/membershipsRead the signed-in member’s memberships
Returns memberships for the signed-in member. Old pending purchases are filtered after the 30-minute pending window. This route is not an owner’s list of all customers.
Request template
Set the API base to include /api. Replace path placeholders before running.
curl --fail-with-body -X GET "$BEXO_API_BASE/vendor/memberships" \
-H "Authorization: Bearer $BEXO_MEMBER_TOKEN"Response fields
| Field | Type | Details |
|---|---|---|
memberships | array | See the downloadable schema for nested fields. |
/api/vendor/consentsRead a member’s disclosure choices
Returns the signed-in member’s consent records, including purpose, fields, grantedAt and revokedAt.
Request template
Set the API base to include /api. Replace path placeholders before running.
curl --fail-with-body -X GET "$BEXO_API_BASE/vendor/consents" \
-H "Authorization: Bearer $BEXO_MEMBER_TOKEN"Response fields
| Field | Type | Details |
|---|---|---|
consents | array | See the downloadable schema for nested fields. |
/api/vendor/consents/pendingRead pending consent requests
Returns active/grace memberships with no consent record. A previously revoked record is not necessarily included in this list.
Request template
Set the API base to include /api. Replace path placeholders before running.
curl --fail-with-body -X GET "$BEXO_API_BASE/vendor/consents/pending" \
-H "Authorization: Bearer $BEXO_MEMBER_TOKEN"Response fields
| Field | Type | Details |
|---|---|---|
requests | array | See the downloadable schema for nested fields. |
/api/vendor/consents/{membershipId}Grant or revoke membership consent
Only the membership’s member can change consent. Set granted=false and fields=[] to revoke. An owner or terminal integration key cannot grant consent on behalf of a member.
Parameters
| Name | Location | Requirement |
|---|---|---|
membershipId | path | Required. Resource identifier. |
Request template
Set the API base to include /api. Replace path placeholders and prepare request.json from the body fields below before running.
curl --fail-with-body -X PUT "$BEXO_API_BASE/vendor/consents/{membershipId}" \
-H "Authorization: Bearer $BEXO_MEMBER_TOKEN" \
-H "Content-Type: application/json" \
--data @request.jsonRequest body
| Field | Type | Details |
|---|---|---|
grantedRequired | boolean | true grants the listed fields; false revokes access. |
purposeRequired | string | Supported consent purpose.membership_verification |
fieldsRequired | array | Request only the fields needed for the stated purpose. |
Example request body
{
"granted": true,
"purpose": "membership_verification",
"fields": [
"membership_status",
"valid_until"
]
}Response fields
| Field | Type | Details |
|---|---|---|
consent | object | See the downloadable schema for nested fields. |