Access Rights: Check Access

After a customer has purchased a product, check whether they have access to a specific piece of content before serving it. Frisbii Media uses the concept of access right unique IDs — identifiers you define that link a product or issue to an access right.

hasAccess endpoint

try {
    $response = json_decode($client->request('GET',
        "accessRights/{$customer->customerId}/hasAccess?accessRightUniqueIds=ePaper-2020-04-04",
        ['headers' => ['X-plenigo-token' => $yourGeneratedToken]]
    )->getBody()->getContents());
    $hasAccess = $response->accessGranted;
} catch (\GuzzleHttp\Exception\ClientException $e) {
    // 404: customer not found in Frisbii Media
    // With external user management, the customer may not yet exist in Frisbii Media
    // Treat as no access
    $hasAccess = false;
}

Why 404 must be caught

When using external user management, a customer may exist in your system but not yet have been created in Frisbii Media (e.g. they have never attempted a purchase). In this case, hasAccess returns HTTP 404. Guzzle converts this to a ClientException — always catch it and treat it as "no access".

Checking access with a customer session

If you are using Frisbii Media SSO and have the customer's session string, you can check access via the Customer API instead — authenticated by session rather than by API token:

$response = json_decode($client->request('GET',
    'https://customer-api.frisbii-media-stage.com/api/v1.0/accessRights/hasAccess',
    ['headers' => ['X-plenigo-customer-session' => $session]]
)->getBody()->getContents());
if ($response->accessGranted) {
    // show protected content
}

Checking access for multiple access rights at once

You can pass multiple accessRightUniqueIds in a single call using a comma-separated list:

accessRights/{customerId}/hasAccess?accessRightUniqueIds=product-a,product-b,product-c

The response includes an accessGranted boolean as well as details per access right.

accessRightUniqueId — naming convention

The accessRightUniqueId is a string you define. It connects a purchased item to the content it unlocks. It should be:

• Unique per content item — if you sell individual issues, each issue needs its own ID (e.g. ePaper-2020-04-04)

• Stable over time — do not change the ID after products have been sold against it

• Set at purchase time — passed via accessRightUniqueId in the products array of preparePurchase. See Checkout: Advanced Options