Reference profiles leg — child list (sandbox)

Sandbox only. Hosted on the census host root (not /api/v1), gated on PHOSRA_ENV==sandbox — 404 elsewhere.

Returns a bare JSON array of the seeded sandbox child profiles (Mia / Leo / Ava) for a valid Authorization: Bearer sbxtok_… token from POST /oauth/token. The response is not wrapped in an object — it is the array itself.

Worked example

Fully runnable — supply a token from the token leg:

bash
curl https://phosra-api-sandbox-production.up.railway.app/oauth/profiles \
  -H "Authorization: Bearer $SANDBOX_ACCESS_TOKEN"

Example synthetic sandbox 200 response:

json

[
  { "id": "mia", "displayName": "Mia", "subject_ref": "a11ce0fa-0000-4000-8000-0000000000a1", "kind": "child" },
  { "id": "leo", "displayName": "Leo", "subject_ref": "a11ce0fa-0000-4000-8000-0000000000a2", "kind": "child" },
  { "id": "ava", "displayName": "Ava", "subject_ref": "a11ce0fa-0000-4000-8000-0000000000a3", "kind": "child" }
]

A missing or non-sbxtok_ bearer token returns 401 invalid_token. The subject_ref is the stable child id that downstream policy and enforcement legs key on.