Get one owned product (full formData)

GET 
/api/v1/products/:id

Required scope: dpp:read. Cross-tenant / unknown id returns 404 (never 403), so the API never confirms a product exists in another tenant. A malformed (non-UUID) {id} returns 400 VALIDATION before any lookup.

Request

Responses

200

OK

400

400 — INVALID_JSON, VALIDATION_ERROR, VALIDATION (the {id} path segment is not a UUID), or IDEMPOTENCY_KEY_REQUIRED.

403

403 — missing scope (FORBIDDEN_SCOPE) or module (FORBIDDEN_MODULE).

404

404 — not found OR owned by another tenant (NOT_FOUND; IDOR-safe).

503

503 — the API is not enabled on this environment (FEATURE_DISABLED).