// Server-to-server call to a CodeB tenant using an API key.
// European Digital Identity Wallet claims are out-of-band; API keys are
// for background jobs.
// [m2m-cookbook 2026-07-23]
//
// Mint the key at https://<CODEB_TENANT_HOST>/api-keys-admin.html
// Keys have the form ak_XXXXXXXXXXXXXXXX and MUST travel over TLS.

import java.net.URI;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.time.Duration;

public class CodebApiKeyClient {
    private static final String TENANT  = "https://<CODEB_TENANT_HOST>";
    private static final String API_KEY = System.getenv("CODEB_API_KEY");

    public static void main(String[] args) throws Exception {
        HttpClient c = HttpClient.newBuilder()
            .connectTimeout(Duration.ofSeconds(10)).build();
        HttpRequest req = HttpRequest.newBuilder()
            .uri(URI.create(TENANT + "/api.ashx?action=users.list"))
            .header("Authorization", "Bearer " + API_KEY)
            .timeout(Duration.ofSeconds(15))
            .GET().build();
        HttpResponse<String> r = c.send(req, HttpResponse.BodyHandlers.ofString());
        if (r.statusCode() != 200) throw new RuntimeException("HTTP " + r.statusCode());
        System.out.println(r.body());
    }
}