# Export KINTRA_API for your environment first; the base URL is on the introduction page.
KEY="YOUR_TENANT_KEY_ID"
SECRET="YOUR_SIGNING_SECRET"

# The signature covers the path and query exactly as sent, so both are split
# off the base URL and reused for the request line below.
API_PATH="/${KINTRA_API#*://*/}"
API_HOST="${KINTRA_API%"$API_PATH"}"
METHOD="POST"
PATH_AND_QUERY="$API_PATH/gateway/rewards"

# One compact line, signed and sent unchanged. The server signs a
# re-serialization of the body it parsed, so reformatting this fails with a 401.
BODY='{"title":"YOUR_TITLE","xp_cost":0}'

TIMESTAMP="$(date +%s)"
SIGNATURE="$(printf '%s' "$TIMESTAMP$METHOD$PATH_AND_QUERY$BODY" \
  | openssl dgst -sha256 -hmac "$SECRET" | awk '{print $NF}')"

curl -sS -w '\n%{http_code}' -X "$METHOD" "$API_HOST$PATH_AND_QUERY" \
  -H "X-Tenant-Key: $KEY" \
  -H "X-Tenant-Timestamp: $TIMESTAMP" \
  -H "X-Tenant-Signature: $SIGNATURE" \
  -H "Content-Type: application/json" \
  -H "X-Idempotency-Key: YOUR_IDEMPOTENCY_KEY" \
  --data-binary "$BODY"

const options = {
  method: 'POST',
  headers: {
    'X-Tenant-Signature': '<x-tenant-signature>',
    'X-Tenant-Timestamp': '<x-tenant-timestamp>',
    'X-Idempotency-Key': '<x-idempotency-key>',
    'x-tenant-key': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({
    title: '<string>',
    xp_cost: 123,
    description: '<string>',
    metadata: {},
    min_tier_id: '<string>'
  })
};

fetch('https://api.kintra.io/api/v1/gateway/rewards', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

import requests

url = "https://api.kintra.io/api/v1/gateway/rewards"

payload = {
    "title": "<string>",
    "xp_cost": 123,
    "description": "<string>",
    "metadata": {},
    "min_tier_id": "<string>"
}
headers = {
    "X-Tenant-Signature": "<x-tenant-signature>",
    "X-Tenant-Timestamp": "<x-tenant-timestamp>",
    "X-Idempotency-Key": "<x-idempotency-key>",
    "x-tenant-key": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

{
  "success": true,
  "data": {
    "id": "<string>"
  },
  "errors": [
    {
      "message": "<string>",
      "path": "<string>"
    }
  ],
  "message": "<string>"
}

{
  "success": true,
  "data": {
    "id": "<string>"
  },
  "errors": [
    {
      "message": "<string>",
      "path": "<string>"
    }
  ],
  "message": "<string>"
}

{
  "success": true,
  "data": null,
  "errors": [
    {
      "message": "<string>",
      "path": "<string>"
    }
  ],
  "message": "<string>"
}

{
  "success": true,
  "data": null,
  "errors": [
    {
      "message": "<string>",
      "path": "<string>"
    }
  ],
  "message": "<string>"
}

{
  "success": true,
  "data": null,
  "errors": [
    {
      "message": "<string>",
      "path": "<string>"
    }
  ],
  "message": "<string>"
}