Lists the feature flags that change how the Remote API behaves for a company, whether each is
on, and what it changes. Use it to see why a flow behaves the way it does in Sandbox, for
example why contractors are invited without the pricing plan and contract details steps.

applies_to says who a flag's state is for: company flags can differ between companies and
are evaluated for the company admin the API acts as (the token's user, or the company owner for
an integration token); environment flags are the same for every company in the environment.

Only flags that change the public API are listed, and the list can change. A flag that is
removed no longer changes anything: its behaviour is then the same for every company, so check
the API changelog. The state in Sandbox doesn't tell you the state in production.

This endpoint is only available in Sandbox, otherwise it will respond with a 404.

Authentication

This endpoint accepts any one of the following token types:

• Company-scoped access token (OAuth2AuthorizationCode) — obtained by a company manager through the Authorization Code flow or the Refresh Token flow. See Authentication for partners.
• Company-scoped access token (assertion) (OAuth2CompanyManagerAssertion) — obtained through the urn:ietf:params:oauth:grant-type:jwt-bearer grant for a company manager. See OAuth Assertion.
• Client credentials access token (OAuth2ClientCredentials) — obtained through the Client Credentials flow or the Refresh Token flow. See Authentication for partners.
• Customer API token (CustomerAPIToken) — generated by the customer on their Integration Settings page, with the scopes they choose there. See Authorization for customers.

Scopes

Any one of the scopes in a token type's row is enough. all:read and all:write work too.