cURL cheat sheet — the whole workshop flow

Every block below is paste-ready: in a terminal as-is, or in Postman without an account via Import → paste one cURL command → Send (that Postman mode accepts nothing but cURL). Fill in Your values below and the commands prefill themselves — the copy icon on each block copies the filled-in command. Prefer a ready-made collection? See the quick-start.

Your values — filled straight into the commands below; they stay in this browser tab and are sent nowhere except the API when you run a command.

00 · Get your own credentials → 201, no auth

curl -X POST https://api.cybernotes.it/mtpl/v1/demo-clients

Returns a throwaway client_id and client_secret. Paste both into the panel above and every command below fills itself in. The secret is shown once — but a fresh pair is always one request away, so nothing is lost if you miss it. Credentials extend themselves while you use them; abandoned ones are removed along with their policies.
In a live workshop instead? Use the analyst-NN id on your card with the secret the facilitator reads out — that path is unchanged, and skips this step.

01 · Coverage options → 200, no auth

curl https://api.cybernotes.it/mtpl/v1/coverage-options

02 · Get a bearer token → 200, valid 60 min

curl -X POST https://api.cybernotes.it/mtpl/v1/auth/token \
  -H "Content-Type: application/json" \
  -d '{"client_id":"YOUR_CLIENT_ID","client_secret":"YOUR_CLIENT_SECRET"}'

Paste the access_token value into the Bearer token field at the top — every command below fills itself in. Decode the token at jwt.io.

03 · Insure a vehicle → 201 Created

curl -X POST https://api.cybernotes.it/mtpl/v1/policies \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"regNumber":"YOUR-PLATE"}'

A plate is suggested in the panel above — change it if you like (letters/digits/dashes). Paste the returned policy id into the Policy id field up top.

03b · A token that is not allowed to do that → 403 insufficient-scope

curl -X POST https://api.cybernotes.it/mtpl/v1/auth/token \
  -H "Content-Type: application/json" \
  -d '{"client_id":"YOUR_CLIENT_ID","client_secret":"YOUR_CLIENT_SECRET","scope":"policies:read"}'

Same credentials, one extra field. The token you get back carries policies:read and nothing else — check it at jwt.io. Now repeat command 03 with that token instead of your usual one.

401 and 403 are different failures. Command 03 with no Authorization header at all is a 401 — the API does not know who you are. The same command with this weaker token is a 403 — it knows exactly who you are and refuses this action. Read the WWW-Authenticate response header: it names the scope you would need. Asking for a scope wider than your client was granted is refused at the token endpoint; a client cannot widen its own permissions.

04 · Send 03 again, same plate → 409 duplicate-policy

One active policy per vehicle across the whole register. Read the application/problem+json body: type, title, detail.

05 · List your policies → 200, paginated

curl "https://api.cybernotes.it/mtpl/v1/policies?page=1&pageSize=20" \
  -H "Authorization: Bearer YOUR_TOKEN"

Log in as fleet.demo (rerun 02) to see 70+ policies — then try page=2.

06 · Get one policy → 200 (or a 404 worth reading)

curl https://api.cybernotes.it/mtpl/v1/policies/POLICY_ID \
  -H "Authorization: Bearer YOUR_TOKEN"

07 · Update it → 200, status becomes "updated"

curl -X PUT https://api.cybernotes.it/mtpl/v1/policies/POLICY_ID \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"holder":"Demo Holder (renamed)"}'

08 · Cancel it — twice → 200 both times (idempotent)

curl -X POST https://api.cybernotes.it/mtpl/v1/policies/POLICY_ID/cancel \
  -H "Authorization: Bearer YOUR_TOKEN"

09 · Trip the rate limit → five 200s, then 429 + Retry-After

curl -i https://api.cybernotes.it/mtpl/v1/limited/ping

Send it six times within a minute (Postman: click Send repeatedly). Terminal loop: for i in 1 2 3 4 5 6; do curl -s -o /dev/null -w "%{http_code}\n" https://api.cybernotes.it/mtpl/v1/limited/ping; done

10 · Signed register check (Workshop 3) → 200 with a valid signature, verbose 401 without

BODY='{"regNumber":"ABC-101"}'
SIG=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "YOUR_HMAC_SECRET" | awk '{print $NF}')
curl -X POST https://api.cybernotes.it/mtpl/v1/signed/policy-check \
  -H "Content-Type: application/json" \
  -H "X-Signature: $SIG" \
  --data-binary "$BODY"

Terminal only (needs openssl): the signature is HMAC-SHA256 over the exact body bytes, hex-encoded. In Postman, compute SIG in a terminal first and paste it into an X-Signature header — then change one character in the body and watch the 401 explain itself.