Authority and scope

PRINCIPAL="user_01J8Z3K4M5N6P7Q8R9S0T1U2V3"
EMAIL="dana.ortiz@harborgroup.example"
TS=$(date +%s)
SIG=$(printf '%s|%s|%s|%s' "$PRINCIPAL" "$EMAIL" "" "$TS" \
  | openssl dgst -sha256 -hmac "$NEXIO_ASSERTION_SECRET" -hex | sed 's/^.* //')

curl https://api.usenexio.com/api/v1/records/status \
  -H "Authorization: Bearer $NEXIO_API_KEY" \
  -H "X-Nexio-Acting-Principal: $PRINCIPAL" \
  -H "X-Nexio-Acting-Email: $EMAIL" \
  -H "X-Nexio-Records-Assertion: v1.$TS.$SIG"

import hashlib
import hmac
import os
import time

import requests


def records_assertion(secret: str, principal: str, email: str) -> str:
    ts = str(int(time.time()))
    signed = "|".join([principal.strip(), email.strip().lower(), "", ts])
    digest = hmac.new(secret.encode(), signed.encode(), hashlib.sha256).hexdigest()
    return f"v1.{ts}.{digest}"


principal = "user_01J8Z3K4M5N6P7Q8R9S0T1U2V3"
email = "dana.ortiz@harborgroup.example"
response = requests.get(
    "https://api.usenexio.com/api/v1/records/status",
    headers={
        "Authorization": "Bearer " + os.environ["NEXIO_API_KEY"],
        "X-Nexio-Acting-Principal": principal,
        "X-Nexio-Acting-Email": email,
        "X-Nexio-Records-Assertion": records_assertion(os.environ["NEXIO_ASSERTION_SECRET"], principal, email),
    },
    timeout=30,
)
response.raise_for_status()
print(response.json()["scope"])

import { createHmac } from "node:crypto";

function recordsAssertion(secret: string, principal: string, email: string): string {
  const ts = Math.floor(Date.now() / 1000).toString();
  const signed = [principal.trim(), email.trim().toLowerCase(), "", ts].join("|");
  const digest = createHmac("sha256", secret).update(signed).digest("hex");
  return `v1.${ts}.${digest}`;
}

const principal = "user_01J8Z3K4M5N6P7Q8R9S0T1U2V3";
const email = "dana.ortiz@harborgroup.example";
const response = await fetch("https://api.usenexio.com/api/v1/records/status", {
  headers: {
    Authorization: `Bearer ${process.env.NEXIO_API_KEY}`,
    "X-Nexio-Acting-Principal": principal,
    "X-Nexio-Acting-Email": email,
    "X-Nexio-Records-Assertion": recordsAssertion(process.env.NEXIO_ASSERTION_SECRET!, principal, email),
  },
});
if (!response.ok) throw new Error(`status read failed: ${response.status}`);
console.log((await response.json()).scope);