Put a Mellon in front of anything.

export MELLON=http://localhost:3000

# 1. Create an account. The response includes a session token.
TOKEN=$(curl -s -X POST "$MELLON/api/accounts" -H 'Content-Type: application/json' \
  -d '{"username":"dana","rules":"The requester must say the passphrase osprey lantern and name the harbor town of Kettleby."}' \
  | jq -r .token)

# Later, sign in again by proving it is you:
#   curl -s -X POST "$MELLON/api/sessions" -H 'Content-Type: application/json' \
#     -d '{"username":"dana","statement":"Passphrase osprey lantern. I grew up in Kettleby."}'

# 2. Provision a lock linked to your account.
LOCK=$(curl -s -X POST "$MELLON/api/locks" -H 'Content-Type: application/json' \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"name":"On-call DB password","rules":"Only the current on-call engineer, during an active incident, with an incident ID.","secret":"hunter2"}' \
  | jq -r .lock.id)

# 3. Make an attempt. "secret" is present only when granted.
curl -s -X POST "$MELLON/api/locks/$LOCK/attempt" -H 'Content-Type: application/json' \
  -d '{"input":"I am Sam, on call this week, handling incident INC-2291 (primary DB failover)."}' | jq

# 4. Read the attempt log with your session.
curl -s "$MELLON/api/locks/$LOCK/attempts" -H "Authorization: Bearer $TOKEN" | jq

// Node 18+ or any modern runtime with fetch.
const MELLON = process.env.MELLON ?? 'http://localhost:3000';
const post = (path, body, token) => fetch(`${MELLON}${path}`, {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', ...(token && { Authorization: `Bearer ${token}` }) },
  body: JSON.stringify(body),
}).then((r) => r.json());

// 1. Create an account (or POST /api/sessions to sign in later).
const { token } = await post('/api/accounts', {
  username: 'dana',
  rules: 'The requester must say the passphrase osprey lantern and name the harbor town of Kettleby.',
});

// 2. Provision a lock linked to the account.
const { lock } = await post('/api/locks', {
  name: 'On-call DB password',
  rules: 'Only the current on-call engineer, during an active incident, with an incident ID.',
  secret: 'hunter2',
}, token);

// 3. Make an attempt.
const verdict = await post(`/api/locks/${lock.id}/attempt`, {
  input: 'I am Sam, on call this week, handling incident INC-2291 (primary DB failover).',
});
console.log(verdict.granted, verdict.secret ?? verdict.checks.filter((c) => !c.pass));

import os
import requests

MELLON = os.environ.get("MELLON", "http://localhost:3000")
s = requests.Session()

# 1. Create an account (or POST /api/sessions to sign in later).
r = s.post(f"{MELLON}/api/accounts", json={
    "username": "dana",
    "rules": "The requester must say the passphrase osprey lantern and name the harbor town of Kettleby.",
})
s.headers["Authorization"] = f"Bearer {r.json()['token']}"

# 2. Provision a lock linked to the account.
lock = s.post(f"{MELLON}/api/locks", json={
    "name": "On-call DB password",
    "rules": "Only the current on-call engineer, during an active incident, with an incident ID.",
    "secret": "hunter2",
}).json()["lock"]

# 3. Make an attempt (no credentials needed).
verdict = requests.post(f"{MELLON}/api/locks/{lock['id']}/attempt", json={
    "input": "I am Sam, on call this week, handling incident INC-2291 (primary DB failover).",
}).json()
print(verdict["granted"], verdict.get("secret"))