Health and Key Check

const res = await fetch('https://panel.example.com/api/v1/admin/ping');
const { data } = await res.json();

const drift = Math.abs(Date.parse(data.time) - Date.now());

$ch = curl_init('https://panel.example.com/api/v1/admin/ping');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$body = json_decode(curl_exec($ch), true);
curl_close($ch);

// This endpoint WANTS NO KEY: reaching it says nothing about whether your key works.
$up = Api::System()->Ping()['data']['pong'] ?? false;

const res = await fetch('https://panel.example.com/api/v1/admin/whoami', {
  headers: { Authorization: `Bearer ${apiKey}` },
});

if (res.status === 401) return promptForKey();

const { data } = await res.json();
const canReadInvoices = data.permissions.some((s) => s.startsWith('Invoices/'));

$ch = curl_init('https://panel.example.com/api/v1/admin/whoami');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER     => ['Authorization: Bearer ' . $apiKey],
]);

$body = json_decode(curl_exec($ch), true);
curl_close($ch);

// Reading the scopes UP FRONT beats learning them from a 403 on every call.
$me = Api::System()->Whoami()['data'];
$may = fn (string $s) => in_array($s, $me['permissions'], true)
    || in_array(explode('/', $s)[0] . '/*', $me['permissions'], true);