Read the Live display
Required scopes: live.get.
Service ownership, current scopes and processing policy are checked inside the serialized Live actor. Updates persist before broadcasting. Sequence changes invalidate display and playback validators together; viewer counts do not. Presentation snapshot metadata is read-only in this slice; editing drafts does not publish them. Also accepts finite personal bearer tokens for resources owned by the caller’s personal account. Personal tokens cannot operate organization Lives, use collaborators’/children’s authority, or publish presentations. Current personal token scopes and user permissions are rechecked after waits. Registered delegated OAuth access tokens are accepted within these personal boundaries; /me and account metadata additionally require identity.read.
Response headers:
ETag(200): Strong Live state validator; send unchanged in If-Match for display/playback writes.
Authentication
Organization-owned service token. Issue the initial token in organization credential settings. Scopes are documented per operation via x-required-scopes; they are not OAuth scopes.
Personal bearer credential issued through existing account settings or browser-approved CLI flow. Must be active, finite, unexpired, unrevoked, within any rotation overlap, and bound to an active personal membership/user/account. Explicit scopes intersect current user permissions; empty existing personal scopes inherit current user authority. Not an OAuth grant or service token. Browser cookies are ignored.
Registered public-client OAuth for personal-account resources only. Exact registered HTTPS or fixed-port literal loopback redirect; S256 required; explicit consent. No organization/presentation authority. identity.read is required for /me and account metadata. Scope intersection with current user authority; no empty-scope inheritance.
Path parameters
Response headers
Strong Live state validator; send unchanged in If-Match for display/playback writes.
Response
Personal-account Reader Live resource. Uses account_id instead of organization_id; only the personal account owner can access it with current personal token authority.