Making your first request

# 1. Set your credentials
API_KEY="your-api-key"
SECRET_KEY="your-secret-key"

# 2. Generate a unique nonce
NONCE=$(uuidgen)

# 3. Build the string to sign: values joined with newlines (GET requests have no body line)
METHOD="GET"
REQUEST_PATH="/api/v1/client"
STRING_TO_SIGN=$(printf '%s\n%s\n%s\n%s' "$API_KEY" "$METHOD" "$REQUEST_PATH" "$NONCE")

# 4. Sign with HMAC-SHA256
SIGNATURE=$(printf '%s' "$STRING_TO_SIGN" | openssl dgst -sha256 -hmac "$SECRET_KEY" -binary | base64)

# 5. Make the request
curl -s -X GET \
  "https://www.api.external.test.mercury.global${REQUEST_PATH}" \
  -H "x-api-key: ${API_KEY}" \
  -H "x-nonce: ${NONCE}" \
  -H "Authorization: HMACSHA256 ${SIGNATURE}" \
  -H "Content-Type: application/json" | jq .

import base64, hashlib, hmac, uuid
import requests

API_KEY = "your-api-key"
SECRET_KEY = "your-secret-key"
BASE_URL = "https://www.api.external.test.mercury.global"

method = "GET"
path = "/api/v1/client"
nonce = str(uuid.uuid4())

# Build and sign the string (GET requests have no body line)
string_to_sign = "\n".join([API_KEY, method, path, nonce])
signature = base64.b64encode(
    hmac.new(SECRET_KEY.encode(), string_to_sign.encode(), hashlib.sha256).digest()
).decode()

response = requests.get(
    f"{BASE_URL}{path}",
    headers={
        "x-api-key": API_KEY,
        "x-nonce": nonce,
        "Authorization": f"HMACSHA256 {signature}",
        "Content-Type": "application/json",
    },
)

print(response.status_code)
print(response.json())

const crypto = require("crypto");

const API_KEY = "your-api-key";
const SECRET_KEY = "your-secret-key";
const BASE_URL = "https://www.api.external.test.mercury.global";

const method = "GET";
const path = "/api/v1/client";
const nonce = crypto.randomUUID();

// Build and sign the string (GET requests have no body line)
const stringToSign = [API_KEY, method, path, nonce].join("\n");
const signature = crypto
  .createHmac("sha256", SECRET_KEY)
  .update(stringToSign, "utf8")
  .digest("base64");

fetch(`${BASE_URL}${path}`, {
  method: "GET",
  headers: {
    "x-api-key": API_KEY,
    "x-nonce": nonce,
    Authorization: `HMACSHA256 ${signature}`,
    "Content-Type": "application/json",
  },
})
  .then((res) => res.json())
  .then((data) => console.log(JSON.stringify(data, null, 2)));

import javax.crypto.Mac;
import javax.crypto.spec.SecretKeySpec;
import java.net.URI;
import java.net.http.*;
import java.nio.charset.StandardCharsets;
import java.util.Base64;
import java.util.UUID;

public class MercuryFirstRequest {
    public static void main(String[] args) throws Exception {
        String apiKey = "your-api-key";
        String secretKey = "your-secret-key";
        String baseUrl = "https://www.api.external.test.mercury.global";

        String method = "GET";
        String path = "/api/v1/client";
        String nonce = UUID.randomUUID().toString();

        // Build and sign the string (GET requests have no body line)
        String stringToSign = String.join("\n", apiKey, method, path, nonce);
        Mac mac = Mac.getInstance("HmacSHA256");
        mac.init(new SecretKeySpec(secretKey.getBytes(StandardCharsets.UTF_8), "HmacSHA256"));
        String signature = Base64.getEncoder()
            .encodeToString(mac.doFinal(stringToSign.getBytes(StandardCharsets.UTF_8)));

        HttpRequest request = HttpRequest.newBuilder()
            .uri(URI.create(baseUrl + path))
            .header("x-api-key", apiKey)
            .header("x-nonce", nonce)
            .header("Authorization", "HMACSHA256 " + signature)
            .header("Content-Type", "application/json")
            .GET()
            .build();

        HttpResponse<String> response = HttpClient.newHttpClient()
            .send(request, HttpResponse.BodyHandlers.ofString());

        System.out.println(response.statusCode());
        System.out.println(response.body());
    }
}

using System.Security.Cryptography;
using System.Text;

var apiKey = "your-api-key";
var secretKey = "your-secret-key";
var baseUrl = "https://www.api.external.test.mercury.global";

var method = "GET";
var path = "/api/v1/client";
var nonce = Guid.NewGuid().ToString();

// Build and sign the string (GET requests have no body line)
var stringToSign = string.Join("\n", apiKey, method, path, nonce);
using var hmac = new HMACSHA256(Encoding.UTF8.GetBytes(secretKey));
var signature = Convert.ToBase64String(
    hmac.ComputeHash(Encoding.UTF8.GetBytes(stringToSign)));

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("x-api-key", apiKey);
client.DefaultRequestHeaders.Add("x-nonce", nonce);
client.DefaultRequestHeaders.TryAddWithoutValidation("Authorization", $"HMACSHA256 {signature}");

var response = await client.GetAsync($"{baseUrl}{path}");
var content = await response.Content.ReadAsStringAsync();

Console.WriteLine(response.StatusCode);
Console.WriteLine(content);

[
  {
    "ClientType": "Corporate",
    "Identifier": "CLIENT-001",
    "ExternalReference": "EXT-REF-001",
    "ExpectedMonthlySpend": 5000,
    "RiskRating": "Low",
    "Contacts": [
      {
        "Identifier": "b7809e48-6407-4b44-b613-921049f2d7e8",
        "FirstName": "Jane",
        "LastName": "Smith",
        "PhysicalAddress": {
          "Street": "1 High Street",
          "City": "London",
          "Region": "Greater London",
          "Postcode": "EC1A 1BB",
          "CountryCode": "GB"
        },
        "DateOfBirth": "1985-06-15"
      }
    ],
    "CorporateDetails": {
      "Name": "Acme Ltd",
      "RegistrationNumber": "12345678",
      "RegisteredAddress": {
        "Street": "1 High Street",
        "City": "London",
        "Region": "Greater London",
        "Postcode": "EC1A 1BB",
        "CountryCode": "GB"
      },
      "IndustryCode": "6419"
    }
  }
]