Server-side gating

curl https://api.fictura.co/api/v1/entitlements/<user_id> \
  -H "x-api-key: gk_..."

<user_id> is any identifier you've given Fictura for the user — your account id, the RevenueCat app user id, or the device id; the lookup matches all three. An unknown user answers status: "none" with a 200, so one code path handles everyone, and the check never creates a user as a side effect.

How the verdict is computed

• Recomputed from the billing ledger on every RevenueCat and Stripe webhook, and the clock is re-checked on every read — a lapsed subscription reads as lapsed immediately.
• Cancellation does not end access — it flips will_renew to false; access runs to expires_at. Only an expiration event closes the window.
• A failed payment grants grace_period — still is_active: true — while the card retries.
• Sandbox rides the same verdict: the environment of the user's most recent granting event wins, so a test purchase answers is_active: true with environment: "SANDBOX". Check the environment field before granting production access.
• Fails closed: a granting event with no expiry to reason about yields unknown, never active.

The complete field-by-field contract, statuses, and both response shapes are in the API reference. Prefer keeping your own table? Feed it from the billing webhook — same events, same truth.