How to design RESTful API URI when you can't have user ID on the URI

Make-up scenario:

Let's say I am building a RESTful Web API backend for managing the payment plans for members:

• It's for members so you would have to register with us. Each member would have a member ID internally.
• There are various payment plans: 0% interest for 6 months, 0% interest for 12 months, etc. Each payment plan would have an ID internally.
• The relationship between member and payment plan is many-to-many.
• Each member also would have 1 active plan at a time. You can change it, but there is only 1 active plan allowed for a member.

Now if I want to design an API endpoint to return the information about the member active payment plan, I would normally do something like:

/members/{member-id}/plans/active

I understand that it might be a bad idea to put state on the URI (I had a separate question for that matter), but please bear with me.

Now here is the tricky part: the company's policy states that I can't have the member ID in the URI. They will have some kind of tokens in HTTP header, which is required in order to access the RESTful API endpoints, that contains the member ID.

My API application, which is ASP.NET Core Web API by the way, has no problem creating a filter to parse that token and transform it into member ID, in the code. It's just that my API URIs can't have the member ID anymore.

How would you design the URI in this case?

Without the member ID on the URI, mine would look like

/plans/active

And the data now would be all driven/filtered by that member ID, securely inside the API backend. Is this normal?