Integrate BIOS through code.

Signed request (curl - illustrative / local test)

#!/usr/bin/env bash
# NordixBIOS auth-bridge — what a signed call looks like on the wire (illustrative), and
# how to CRAFT one to test your endpoint locally before going live.
# Requires: bash, curl, openssl, uuidgen.
#
# Deployment: {{DEPLOYMENT_ID}} · signed endpoint (webhookUrl): {{WEBHOOK_URL}}
# Active Verification Key id: {{VERIFICATION_KEY_ID}} (arrives as X-BIOS-Key-Id)
#
# The Verification Key is a SECRET: reveal it once in the panel
# (Keys -> Verification -> Reveal) and keep it in your vault/environment.
# Never hardcode, commit or log it. {{VERIFICATION_KEY}} is a placeholder
# on purpose - NordixBIOS never fills it in, on any surface.
#   export BIOS_VERIFICATION_KEY='<the revealed value>'

WEBHOOK_URL='{{WEBHOOK_URL}}'                    # the endpoint NordixBIOS calls
PATH_WITH_QUERY="/${WEBHOOK_URL#*://*/}"         # path + query, no scheme/host
TIMESTAMP="$(date +%s)"                          # Unix seconds (window: +/- 300 s)
NONCE="$(uuidgen | tr '[:upper:]' '[:lower:]')"  # unique per call (anti-replay)
BODY='{"version":"1","deploymentId":"{{DEPLOYMENT_ID}}","channel":"web","channelUserId":"user@example.com","identifierType":"email","requestedAt":"2026-01-01T12:00:00Z","context":{"messageId":"msg_local_test","locale":"en"}}'

# v1 signing string: timestamp \n nonce \n POST \n path+query \n sha256(body)
BODY_HASH="$(printf '%s' "$BODY" | openssl dgst -sha256 | awk '{print $NF}')"
SIGNING_STRING="$(printf '%s\n%s\nPOST\n%s\n%s' "$TIMESTAMP" "$NONCE" "$PATH_WITH_QUERY" "$BODY_HASH")"
SIGNATURE="$(printf '%s' "$SIGNING_STRING" | openssl dgst -sha256 -hmac "$BIOS_VERIFICATION_KEY" | awk '{print $NF}')"

curl -i -X POST "$WEBHOOK_URL" \
  -H 'Content-Type: application/json' \
  -H 'User-Agent: NordixBIOS-Runtime/1' \
  -H "X-BIOS-Signature: v1=$SIGNATURE" \
  -H "X-BIOS-Timestamp: $TIMESTAMP" \
  -H "X-BIOS-Nonce: $NONCE" \
  -H 'X-BIOS-Key-Id: {{VERIFICATION_KEY_ID}}' \
  -H 'X-BIOS-Delivery: dlv_local_test' \
  --data-raw "$BODY"

# A correct endpoint answers 200 with {"status":"ok",...} / {"status":"unknown_user"}
# / {"status":"blocked"} — and 401 when the signature check fails (contract sec. 7).

Signed request (curl - illustrative / local test)

#!/usr/bin/env bash
# NordixBIOS outbound webhook — what a signed call looks like on the wire (illustrative), and
# how to CRAFT one to test your endpoint locally before going live.
# Requires: bash, curl, openssl, uuidgen.
#
# Subscriber endpoint (this webhook): {{WEBHOOK_URL}} (partner scope)
#
# The signing secret is shown ONCE when the webhook is created (and via the
# audited reveal flow). Keep it in your vault/environment - never hardcode,
# commit or log it.
#   export BIOS_WEBHOOK_SECRET='<the revealed value>'

WEBHOOK_URL='{{WEBHOOK_URL}}'                    # the endpoint NordixBIOS calls
PATH_WITH_QUERY="/${WEBHOOK_URL#*://*/}"         # path + query, no scheme/host
TIMESTAMP="$(date +%s)"                          # Unix seconds (window: +/- 300 s)
NONCE="$(uuidgen | tr '[:upper:]' '[:lower:]')"  # unique per call (anti-replay)
BODY='{"test":true,"event":"sync_completed","at":"2026-01-01T12:00:00Z"}'

# v1 signing string: timestamp \n nonce \n POST \n path+query \n sha256(body)
BODY_HASH="$(printf '%s' "$BODY" | openssl dgst -sha256 | awk '{print $NF}')"
SIGNING_STRING="$(printf '%s\n%s\nPOST\n%s\n%s' "$TIMESTAMP" "$NONCE" "$PATH_WITH_QUERY" "$BODY_HASH")"
SIGNATURE="$(printf '%s' "$SIGNING_STRING" | openssl dgst -sha256 -hmac "$BIOS_WEBHOOK_SECRET" | awk '{print $NF}')"

curl -i -X POST "$WEBHOOK_URL" \
  -H 'Content-Type: application/json' \
  -H 'User-Agent: NordixBIOS-Webhook/1.0' \
  -H "X-BIOS-Signature: v1=$SIGNATURE" \
  -H "X-BIOS-Timestamp: $TIMESTAMP" \
  -H "X-BIOS-Nonce: $NONCE" \
  -H 'X-BIOS-Key-Id: whsec_1' \
  -H 'X-BIOS-Delivery: dlv_local_test' \
  --data-raw "$BODY"

# Your endpoint must answer 2xx fast and deduplicate retries by X-BIOS-Delivery.

REST API calls (curl)

#!/usr/bin/env bash
# NordixBIOS REST API — curl (API key: {{API_KEY_ID}} · base URL: {{API_BASE}})
#
# The API key VALUE is a SECRET: reveal it once in the panel (Keys -> API ->
# Reveal) and keep it in your vault/environment. Never hardcode, commit or log
# it. {{API_KEY}} is a placeholder on purpose - NordixBIOS never fills it in.
#   export BIOS_API_KEY='<the revealed value>'

# 1) List assistants — offset pagination (?page=&perPage=; the response carries
#    meta.page / meta.perPage / meta.total / meta.totalPages). Scope: read.
curl -s "{{API_BASE}}/assistants?page=1&perPage=20" \
  -H "X-API-Key: $BIOS_API_KEY"

# 2) Create an assistant — scope: write. The Idempotency-Key header makes
#    retries safe: resending the SAME key replays the SAME creation instead of
#    duplicating it.
curl -s -X POST "{{API_BASE}}/assistants" \
  -H "X-API-Key: $BIOS_API_KEY" \
  -H 'Content-Type: application/json' \
  -H "Idempotency-Key: $(uuidgen)" \
  --data-raw '{"name":"Support Assistant","language":"en","currency":"EUR","monthlyCostLimit":100}'

Embed snippet (HTML)

<!-- NordixBIOS web widget — paste right before </body>.
     The widget is per-assistant: {{WIDGET_ID}} identifies the assistant's web
     channel (generate or refresh it in the panel: Channels -> Web widget).
     Only the domains you allow-listed for the channel may embed it. -->
<script>
  (function(d,s,c){
    var j=d.createElement(s);j.async=true;
    j.src='{{BASE_URL}}/widget.js';
    j.setAttribute("data-config", JSON.stringify(c));
    d.body.appendChild(j);
  })(document,"script",{"widgetId":"{{WIDGET_ID}}","theme":"auto","position":"bottom-right","apiBase":"{{API_BASE}}"});
</script>