Use this from the customer-facing return page after a partner-hosted checkout
(CKO-03 / WooCommerce) to show whether provisioning has completed. It is
public (no key or secret) and returns only catalog + lifecycle fields — never
contact, address, or payment data — so it is safe to call from the browser.
Endpoint
Authentication
None. This is the only external-checkout read that requires no credential.
It is rate-limited to 60 requests / minute per IP.
Path parameters
Response
TTL / expiry
Semantics match the authenticated GET /external-checkout/sessions/{id}:
pending / redirected sessions past their expiry return 410 Gone.
completed sessions never expire.
Poll every few seconds on the return page until provisioned is true (or
subscription_status is ACTIVE), then stop. The endpoint degrades gracefully
— a transient backend hiccup still returns the session status rather than a 500.