Sample Scripts

import { randomUUID } from 'node:crypto';
import { readFileSync } from 'node:fs';
import jwt from 'jsonwebtoken';

// ---------------------------------------------------------------------------
// Configuration — fill these in for your environment.
// ---------------------------------------------------------------------------

const OAUTH_CLIENT_ID = '<OAuthClientId>'; // Your OAuth Client Id (from your onboarding pack)
const KID = '<KID>'; // The Kid whose PRIVATE key you're using to sign below
const PRIVATE_KEY_PATH = './private_key.pem'; // Path to the PRIVATE key matching that Kid's public key

const GATEWAY_BASE_URL = 'https://gateway.creditbenchmark.com';
const TOKEN_URL = 'https://gateway.creditbenchmark.com/api/security/token';
const AUDIENCE = 'cb-gateway-m2m-blue';

// Any of the metadata endpoints below — change as needed.
const METADATA_ENDPOINT = '/beta/metadata/columns';

/** Builds and signs the RFC 7523 JWT bearer client assertion. */
function buildClientAssertion(): string {
  const privateKeyPem = readFileSync(PRIVATE_KEY_PATH, 'utf8');
  const now = Math.floor(Date.now() / 1000);

  return jwt.sign(
    {
      iss: OAUTH_CLIENT_ID,
      sub: OAUTH_CLIENT_ID,
      aud: AUDIENCE,
      jti: randomUUID(),
      iat: now,
      exp: now + 120,
    },
    privateKeyPem,
    { algorithm: 'ES256', keyid: KID }
  );
}

/** Exchanges the signed client assertion for a short-lived access token. */
async function getAccessToken(): Promise<string> {
  const clientAssertion = buildClientAssertion();

  const body = new URLSearchParams({
    grant_type: 'client_credentials',
    client_assertion_type: 'urn:ietf:params:oauth:client-assertion-type:jwt-bearer',
    client_assertion: clientAssertion,
    OAuthClientId: OAUTH_CLIENT_ID,
  });

  const response = await fetch(TOKEN_URL, {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body,
  });

  if (!response.ok) {
    throw new Error(`Token request failed: ${response.status} ${await response.text()}`);
  }

  const data = (await response.json()) as { accessToken: string };
  return data.accessToken;
}

/** Calls a metadata API using the access token. Swap 'endpoint' for any of
 * the other metadata endpoints. */
async function callMetadataEndpoint(accessToken: string, endpoint: string = METADATA_ENDPOINT): Promise<unknown> {
  const response = await fetch(`${GATEWAY_BASE_URL}${endpoint}`, {
    headers: {
      Authorization: `Bearer ${accessToken}`,
      'Content-Type': 'application/json',
      Accept: 'application/json',
    },
  });

  if (!response.ok) {
    throw new Error(`Metadata request failed: ${response.status} ${await response.text()}`);
  }

  return response.json();
}

(async () => {
  const token = await getAccessToken();
  console.log('Access token acquired.');

  const data = await callMetadataEndpoint(token);
  console.log(`Response from ${METADATA_ENDPOINT}:`);
  console.log(data);
})().catch((err) => {
  console.error(err);
  process.exitCode = 1;
});