<?php
// Server-to-server call to a CodeB tenant using an API key.
// European Digital Identity Wallet claims are out-of-band; API keys are
// for background jobs.
// [m2m-cookbook 2026-07-23]
//
// Mint the key at https://<CODEB_TENANT_HOST>/api-keys-admin.html
// Keys have the form ak_XXXXXXXXXXXXXXXX and MUST travel over TLS.

const TENANT  = 'https://<CODEB_TENANT_HOST>';
$apiKey = getenv('CODEB_API_KEY');       // ak_...

function api_get(string $path, string $apiKey): array {
    $ch = curl_init(TENANT . $path);
    curl_setopt_array($ch, [
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . $apiKey],
        CURLOPT_TIMEOUT        => 15,
    ]);
    $body = curl_exec($ch);
    if ($body === false) throw new RuntimeException(curl_error($ch));
    return json_decode($body, true);
}

$users = api_get('/api.ashx?action=users.list', $apiKey);
printf("%d users\n", count($users));