{
  "data": [
    {
      "id": "uuid",
      "identifier": "ABCD1",
      "nickname": "Conference Badge",
      "group_id": "uuid",
      "individual_action_id": "uuid",
      "use_schedule": false,
      "scan_count": 42,
      "metadata": { "custom_field": "value" }
    }
  ],
  "count": 1
}

const tag = await fetch('https://api.tappedtags.com/v1/porters', {
  method: 'POST',
  headers: {
    'Authorization': `Bearer ${apiKey}`,
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    identifier: 'DEMO1',
    nickname: 'Demo Tag',
    metadata: { department: 'sales' }
  })
});

const { data } = await tag.json();
console.log(data.id); // Use this ID for assignments

// Assuming you have an action ID
const actionId = 'action-uuid-here';
const porterId = 'tag-id-from-previous-step';

const assign = await fetch(
  `https://api.tappedtags.com/v1/porters/${porterId}/assign`,
  {
    method: 'POST',
    headers: {
      'Authorization': `Bearer ${apiKey}`,
      'Content-Type': 'application/json'
    },
    body: JSON.stringify({
      type: 'action',
      id: actionId
    })
  }
);

const { data } = await assign.json();
console.log('Assignment successful:', data);

const actions = await fetch('https://api.tappedtags.com/v1/actions', {
  headers: { 'Authorization': `Bearer ${apiKey}` }
});

const { data } = await actions.json();
console.log(data); // Array of your actions

async function callApi(endpoint, options = {}) {
  const response = await fetch(endpoint, {
    headers: {
      'Authorization': `Bearer ${apiKey}`,
      'Content-Type': 'application/json',
      ...options.headers
    },
    ...options
  });

  const body = await response.json();

  if (!response.ok) {
    // Handle errors
    const error = body.error || {};
    throw new Error(
      `API Error ${error.status}: ${error.message}`
    );
  }

  return body.data;
}

// Usage
try {
  const tags = await callApi('https://api.tappedtags.com/v1/porters');
  console.log('Tags:', tags);
} catch (err) {
  console.error('Failed to fetch tags:', err.message);
  // Retry logic, alerting, etc.
}

async function getAllScans(porterId, pageSize = 100) {
  const allScans = [];
  let offset = 0;
  let hasMore = true;

  while (hasMore) {
    const scans = await callApi(
      `https://api.tappedtags.com/v1/porters/${porterId}/scans` +
      `?limit=${pageSize}&offset=${offset}`
    );

    allScans.push(...scans);

    // Stop if we got fewer results than requested
    hasMore = scans.length === pageSize;
    offset += pageSize;
  }

  return allScans;
}

const allScans = await getAllScans('tag-id');
console.log(`Got ${allScans.length} scans`);

// INEFFICIENT: 100 API calls
async function slowAssign(tagIds, actionId) {
  for (const tagId of tagIds) {
    await callApi(`https://api.tappedtags.com/v1/porters/${tagId}/assign`, {
      method: 'POST',
      body: JSON.stringify({ type: 'action', id: actionId })
    });
  }
}

// EFFICIENT: 1 API call
async function fastAssign(tagIds, actionId) {
  return await callApi(
    'https://api.tappedtags.com/v1/porters/bulk/assign',
    {
      method: 'PATCH',
      body: JSON.stringify({
        porter_ids: tagIds,
        type: 'action',
        id: actionId
      })
    }
  );
}

// Tag up to 500 at once
await fastAssign(['tag-1', 'tag-2', ..., 'tag-500'], actionId);

async function callApiWithRetry(
  endpoint,
  options = {},
  maxRetries = 3
) {
  let lastError;

  for (let attempt = 0; attempt < maxRetries; attempt++) {
    try {
      const response = await fetch(endpoint, {
        headers: {
          'Authorization': `Bearer ${apiKey}`,
          'Content-Type': 'application/json',
          ...options.headers
        },
        ...options
      });

      const body = await response.json();

      if (!response.ok) {
        const error = body.error || {};

        // Don't retry on 400, 401, 403, 404
        if ([400, 401, 403, 404].includes(error.status)) {
          throw new Error(`API Error: ${error.message}`);
        }

        // Retry on 429 (rate limited), 500, 503
        if (![429, 500, 503].includes(error.status)) {
          throw new Error(`API Error: ${error.message}`);
        }

        lastError = new Error(
          `API Error ${error.status}: ${error.message}`
        );
      } else {
        return body.data;
      }
    } catch (err) {
      lastError = err;
    }

    // Wait before retrying: 1s, 2s, 4s
    if (attempt < maxRetries - 1) {
      const delay = Math.pow(2, attempt) * 1000;
      await new Promise(r => setTimeout(r, delay));
    }
  }

  throw lastError;
}

const crypto = require('crypto');

function validateWebhookSignature(payload, signature, secret) {
  // Create HMAC-SHA256 hash
  const hash = crypto
    .createHmac('sha256', secret)
    .update(JSON.stringify(payload))
    .digest('hex');

  // Use constant-time comparison
  return crypto.timingSafeEqual(
    Buffer.from(hash),
    Buffer.from(signature)
  );
}

// In your webhook handler
app.post('/webhook', (req, res) => {
  const signature = req.headers['x-tapped-signature'];
  const secret = process.env.WEBHOOK_SECRET;

  if (!validateWebhookSignature(req.body, signature, secret)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  // Process webhook...
  res.json({ ok: true });
});

TAPPED_API_KEY=ch_live_xxxxxxxxxxxxxxxxxxxxx
WEBHOOK_SECRET=whk_xxxxxxxxxxxxxxxxxxxxx

require('dotenv').config();

const apiKey = process.env.TAPPED_API_KEY;

if (!apiKey) {
  throw new Error('TAPPED_API_KEY environment variable not set');
}

{
  "error": {
    "status": 400,
    "code": "bad_request",
    "message": "Missing required field: nickname",
    "details": {
      "field": "nickname",
      "reason": "required"
    }
  }
}

X-RateLimit-Limit: 300
X-RateLimit-Remaining: 287
X-RateLimit-Reset: 1681234567

{
  "error": {
    "status": 429,
    "code": "rate_limited",
    "message": "Rate limit exceeded. Try again in 45 seconds."
  }
}