Server API

const FP_SECRET_KEY = process.env.FP_SECRET_KEY!

const response = await fetch(`https://api.zeno.id/events/${encodeURIComponent(requestId)}`, {
	headers: { 'Auth-API-Key': FP_SECRET_KEY },
})

if (!response.ok) {
	const { error, message } = await response.json()
	throw new Error(`${response.status} ${error}: ${message}`)
}

const event = await response.json()

import { createClient } from '@zeno-id/server'

const fingerprint = createClient({ secretKey: process.env.FP_SECRET_KEY, endpoint: 'https://api.zeno.id' })

const event = await fingerprint.getEvent(requestId)

import os
from urllib.parse import quote

import requests

session = requests.Session()
session.headers["Auth-API-Key"] = os.environ["FP_SECRET_KEY"]

response = session.get(f"https://api.zeno.id/events/{quote(request_id, safe='')}", timeout=5)
if not response.ok:
    body = response.json()
    raise RuntimeError(f"{response.status_code} {body.get('error')}: {body.get('message')}")

event = response.json()

use Illuminate\Support\Facades\Http;

$response = Http::withHeaders(['Auth-API-Key' => config('services.fingerprint.secret_key')])
    ->acceptJson()
    ->timeout(5)
    ->get('https://api.zeno.id/events/' . rawurlencode($requestId));

if ($response->failed()) {
    // { error, message }, except the CDN's 403, which isn't JSON.
    throw new RuntimeException(sprintf('%d %s: %s', $response->status(),
        $response->json('error') ?? '', $response->json('message') ?? $response->body()));
}

$event = $response->json();

req, err := http.NewRequestWithContext(ctx, http.MethodGet,
	"https://api.zeno.id/events/"+url.PathEscape(requestID), nil)
if err != nil {
	return err
}
req.Header.Set("Auth-API-Key", os.Getenv("FP_SECRET_KEY"))

res, err := httpClient.Do(req) // an http.Client with a Timeout
if err != nil {
	return err
}
defer res.Body.Close()
body, err := io.ReadAll(res.Body)
if err != nil {
	return err
}

if res.StatusCode != http.StatusOK {
	// { error, message }, except the CDN's 403, which isn't JSON.
	var apiErr struct{ Error, Message string }
	if json.Unmarshal(body, &apiErr) != nil {
		apiErr.Message = string(body)
	}
	return fmt.Errorf("%d %s: %s", res.StatusCode, apiErr.Error, apiErr.Message)
}

var event map[string]any // or a struct with the fields you use
err = json.Unmarshal(body, &event)

import { createHash } from 'node:crypto'

const body = JSON.stringify({ externalId: user.id })

await fetch(`https://api.zeno.id/events/${encodeURIComponent(requestId)}`, {
	method: 'PATCH',
	headers: {
		'Auth-API-Key': process.env.FP_SECRET_KEY!,
		'Content-Type': 'application/json',
		'x-amz-content-sha256': createHash('sha256').update(body).digest('hex'),
	},
	body,
})

import hashlib
import json

body = json.dumps({"externalId": user.id}).encode()

# data= sends these exact bytes; json= would serialise again.
response = session.patch(
    f"https://api.zeno.id/events/{quote(request_id, safe='')}",
    data=body,
    headers={
        "Content-Type": "application/json",
        "x-amz-content-sha256": hashlib.sha256(body).hexdigest(),
    },
    timeout=5,
)

// Encode once and send those bytes. An array passed to patch() would be
// encoded again by Laravel; json_encode's \/ and \uXXXX escapes are fine,
// as long as the hashed bytes are the bytes sent.
$body = json_encode(['externalId' => (string) $user->id], JSON_THROW_ON_ERROR);

$response = Http::withHeaders([
        'Auth-API-Key' => config('services.fingerprint.secret_key'),
        'x-amz-content-sha256' => hash('sha256', $body),
    ])
    ->withBody($body, 'application/json')
    ->timeout(5)
    ->patch('https://api.zeno.id/events/' . rawurlencode($requestId));

body, err := json.Marshal(map[string]string{"externalId": user.ID})
if err != nil {
	return err
}
sum := sha256.Sum256(body)

req, err := http.NewRequestWithContext(ctx, http.MethodPatch,
	"https://api.zeno.id/events/"+url.PathEscape(requestID), bytes.NewReader(body))
if err != nil {
	return err
}
req.Header.Set("Auth-API-Key", os.Getenv("FP_SECRET_KEY"))
req.Header.Set("Content-Type", "application/json")
req.Header.Set("x-amz-content-sha256", hex.EncodeToString(sum[:]))

res, err := httpClient.Do(req)

BODY='{"externalId":"user-2077"}'

# --data-binary sends the bytes as they are; -d would strip newlines.
curl -X PATCH "https://api.zeno.id/events/1792578564800.yU4Ety" \
	-H "Auth-API-Key: $FP_SECRET_KEY" \
	-H "Content-Type: application/json" \
	-H "x-amz-content-sha256: $(printf '%s' "$BODY" | openssl dgst -sha256 -r | cut -d' ' -f1)" \
	--data-binary "$BODY"

// Waits out a 429 (Retry-After is 1 second) and tries again, three times.
const call = async (url: string, init: RequestInit = {}, tries = 3): Promise<Response> => {
	const response = await fetch(url, init)

	if (response.status === 429 && tries > 1) {
		const wait = Number(response.headers.get('retry-after') ?? 1)
		await new Promise(resolve => setTimeout(resolve, wait * 1000))
		return call(url, init, tries - 1)
	}

	return response
}

import time

def call(method, url, tries=3, **kwargs):
    """Waits out a 429 (Retry-After is 1 second) and tries again."""
    response = session.request(method, url, timeout=5, **kwargs)
    if response.status_code == 429 and tries > 1:
        time.sleep(float(response.headers.get("Retry-After", 1)))
        return call(method, url, tries - 1, **kwargs)
    return response

use Illuminate\Http\Client\RequestException;
use Illuminate\Support\Facades\Http;

// Laravel: send a 429 again after its Retry-After (1 second), three tries.
$http = Http::withHeaders(['Auth-API-Key' => config('services.fingerprint.secret_key')])
    ->retry(3, fn (int $attempt, Throwable $e) => $e instanceof RequestException
        ? 1000 * (int) ($e->response->header('Retry-After') ?: 1)
        : 1000,
        when: fn (Throwable $e) => $e instanceof RequestException && $e->response->status() === 429,
        throw: false);

// Sends a request again after a 429's Retry-After (1 second), three tries in
// all. newRequest builds it afresh each time, body included.
func call(client *http.Client, newRequest func() (*http.Request, error)) (*http.Response, error) {
	for try := 1; ; try++ {
		req, err := newRequest()
		if err != nil {
			return nil, err
		}
		res, err := client.Do(req)
		if err != nil || res.StatusCode != http.StatusTooManyRequests || try == 3 {
			return res, err
		}
		res.Body.Close()
		wait, _ := strconv.Atoi(res.Header.Get("Retry-After"))
		time.Sleep(time.Duration(max(wait, 1)) * time.Second)
	}
}