cURL cheat sheet — the whole workshop flow

Every block below is paste-ready: in a terminal as-is, or in Postman without an account via Import → paste one cURL command → Send (that Postman mode accepts nothing but cURL). Fill in Your values below and the commands prefill themselves — the copy icon on each block copies the filled-in command. Prefer a ready-made collection? See the quick-start.

Your values — filled straight into the commands below; they stay in this browser tab and are sent nowhere except the API when you run a command.

00 · Get your own credentials → 201, no auth

curl -X POST https://api.cybernotes.it/mtpl/v1/demo-clients

Returns a throwaway client_id and client_secret. Paste both into the panel above and every command below fills itself in. The secret is shown once — but a fresh pair is always one request away, so nothing is lost if you miss it. Credentials extend themselves while you use them; abandoned ones are removed along with their policies.
In a live workshop instead? Use the analyst-NN id on your card with the secret the facilitator reads out — that path is unchanged, and skips this step.

01 · Coverage options → 200, no auth

curl https://api.cybernotes.it/mtpl/v1/coverage-options

02 · Get a bearer token → 200, valid 60 min

curl -X POST https://api.cybernotes.it/mtpl/v1/auth/token \
  -H "Content-Type: application/json" \
  -d '{"client_id":"YOUR_CLIENT_ID","client_secret":"YOUR_CLIENT_SECRET"}'

Paste the access_token value into the Bearer token field at the top — every command below fills itself in. Decode the token at jwt.io.

03 · Insure a vehicle → 201 Created

curl -X POST https://api.cybernotes.it/mtpl/v1/policies \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"regNumber":"YOUR-PLATE"}'

A plate is suggested in the panel above — change it if you like (letters/digits/dashes). Paste the returned policy id into the Policy id field up top.

04 · Send 03 again, same plate → 409 duplicate-policy

One active policy per vehicle across the whole register. Read the application/problem+json body: type, title, detail.

05 · List your policies → 200, paginated

curl "https://api.cybernotes.it/mtpl/v1/policies?page=1&pageSize=20" \
  -H "Authorization: Bearer YOUR_TOKEN"

Log in as fleet.demo (rerun 02) to see 70+ policies — then try page=2.

06 · Get one policy → 200 (or a 404 worth reading)

curl https://api.cybernotes.it/mtpl/v1/policies/POLICY_ID \
  -H "Authorization: Bearer YOUR_TOKEN"

07 · Update it → 200, status becomes "updated"

curl -X PUT https://api.cybernotes.it/mtpl/v1/policies/POLICY_ID \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"holder":"Demo Holder (renamed)"}'

08 · Cancel it — twice → 200 both times (idempotent)

curl -X POST https://api.cybernotes.it/mtpl/v1/policies/POLICY_ID/cancel \
  -H "Authorization: Bearer YOUR_TOKEN"

09 · Trip the rate limit → five 200s, then 429 + Retry-After

curl -i https://api.cybernotes.it/mtpl/v1/limited/ping

Send it six times within a minute (Postman: click Send repeatedly). Terminal loop: for i in 1 2 3 4 5 6; do curl -s -o /dev/null -w "%{http_code}\n" https://api.cybernotes.it/mtpl/v1/limited/ping; done

10 · Signed register check (Workshop 3) → 200 with a valid signature, verbose 401 without

BODY='{"regNumber":"ABC-101"}'
SIG=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "YOUR_HMAC_SECRET" | awk '{print $NF}')
curl -X POST https://api.cybernotes.it/mtpl/v1/signed/policy-check \
  -H "Content-Type: application/json" \
  -H "X-Signature: $SIG" \
  --data-binary "$BODY"

Terminal only (needs openssl): the signature is HMAC-SHA256 over the exact body bytes, hex-encoded. In Postman, compute SIG in a terminal first and paste it into an X-Signature header — then change one character in the body and watch the 401 explain itself.