Keep the business data.
Move the identity.

const base = process.env.PIIPE_URL;

async function post(path, body) {
  const response = await fetch(base + path, {
    method: "POST",
    headers: { "content-type": "application/json" },
    body: JSON.stringify(body),
    signal: AbortSignal.timeout(10_000),
  });
  const data = await response.json();
  if (!response.ok || !data.ok) throw new Error(data.error);
  return data;
}

const login = await post("/api/login", {
  organization_id: process.env.PIIPE_ORGANIZATION_ID,
  app_id: Number(process.env.PIIPE_APP_ID),
  client_secret: process.env.PIIPE_CLIENT_SECRET,
});

const identity = await post("/api/read", {
  tenant_session: login.session,
  lookup: "subject",
  subject: "crm_customer_12345",
  subject_type: "customer_id",
  record_mode: "fields",
  fields: "email,phone",
});
console.log({
  ok: identity.ok,
  status: identity.response?.status,
  request_id: identity.response?.request_id,
  audit_id: identity.response?.audit_id,
});

func post(ctx context.Context, base, path string, input, output any) error {
    body, err := json.Marshal(input)
    if err != nil { return err }

    request, err := http.NewRequestWithContext(ctx, http.MethodPost, base+path, bytes.NewReader(body))
    if err != nil { return err }
    request.Header.Set("Content-Type", "application/json")

    client := &http.Client{Timeout: 10 * time.Second}
    response, err := client.Do(request)
    if err != nil { return err }
    defer response.Body.Close()

    payload, err := io.ReadAll(response.Body)
    if err != nil { return err }
    var envelope map[string]any
    if err := json.Unmarshal(payload, &envelope); err != nil {
        return err
    }
    if response.StatusCode/100 != 2 || envelope["ok"] != true {
        return fmt.Errorf("Piipe request rejected: %v", envelope["error"])
    }
    return json.Unmarshal(payload, output)
}

// Call /api/login with organization_id, app_id and client_secret.
// Piipe returns login.session bound to the fixed piipe-api application principal.

static JsonNode post(String base, String path, Object body)
    throws Exception {
  ObjectMapper json = new ObjectMapper();
  HttpRequest request = HttpRequest.newBuilder(URI.create(base + path))
      .timeout(Duration.ofSeconds(10))
      .header("Content-Type", "application/json")
      .POST(HttpRequest.BodyPublishers.ofString(
          json.writeValueAsString(body)))
      .build();

  HttpClient http = HttpClient.newBuilder()
      .connectTimeout(Duration.ofSeconds(5))
      .build();
  HttpResponse<String> response = http
      .send(request, HttpResponse.BodyHandlers.ofString());
  JsonNode result = json.readTree(response.body());

  if (response.statusCode() / 100 != 2 ||
      !result.path("ok").asBoolean()) {
    throw new IllegalStateException(
        result.path("error").asText());
  }
  return result;
}

using System.Net.Http.Json;
using System.Text.Json;

using var http = new HttpClient {
    BaseAddress = new Uri(
        Environment.GetEnvironmentVariable("PIIPE_URL")!),
    Timeout = TimeSpan.FromSeconds(10),
};

async Task<JsonElement> Post(string path, object body) {
    using var response = await http.PostAsJsonAsync(path, body);
    var data = await response.Content
        .ReadFromJsonAsync<JsonElement>();

    if (!response.IsSuccessStatusCode ||
        !data.GetProperty("ok").GetBoolean()) {
        throw new Exception(data.GetProperty("error").GetString());
    }
    return data;
}

function piipe_post(string $base, string $path, array $body): array {
    $curl = curl_init($base . $path);
    curl_setopt_array($curl, [
        CURLOPT_POST => true,
        CURLOPT_RETURNTRANSFER => true,
        CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
        CURLOPT_POSTFIELDS => json_encode($body, JSON_THROW_ON_ERROR),
        CURLOPT_CONNECTTIMEOUT => 5,
        CURLOPT_TIMEOUT => 10,
    ]);

    $raw = curl_exec($curl);
    $error = curl_error($curl);
    $status = curl_getinfo($curl, CURLINFO_RESPONSE_CODE);
    curl_close($curl);
    if ($raw === false) {
        throw new RuntimeException($error);
    }
    $data = json_decode($raw, true, flags: JSON_THROW_ON_ERROR);
    if ($status < 200 || $status >= 300 || empty($data['ok'])) {
        throw new RuntimeException($data['error'] ?? "HTTP $status");
    }
    return $data;
}

require "json"
require "net/http"
require "openssl"
require "uri"

def piipe_post(base, path, body)
  uri = URI.join("#{base}/", path.delete_prefix("/"))
  request = Net::HTTP::Post.new(uri)
  request["Content-Type"] = "application/json"
  request.body = JSON.generate(body)

  http = Net::HTTP.new(uri.host, uri.port)
  http.use_ssl = uri.scheme == "https"
  http.verify_mode = OpenSSL::SSL::VERIFY_PEER
  http.open_timeout = 5
  http.read_timeout = 10
  response = http.request(request)
  data = JSON.parse(response.body)

  unless response.is_a?(Net::HTTPSuccess) && data["ok"]
    raise(data["error"] || "HTTP #{response.code}")
  end
  data
end

BASE="https://api.piipe.io"

LOGIN="$(curl --fail-with-body --silent --show-error \
  --connect-timeout 5 --max-time 10 \
  -H 'Content-Type: application/json' \
  -d '{
    \"organization_id\": \"org_your_opaque_piipe_id\",
    \"app_id\": 42,
    \"client_secret\": \"read-from-secret-store\"
  }' \"$BASE/api/login\")"

SESSION="$(printf '%s' \"$LOGIN\" | jq -er '.session')"

curl --fail-with-body --silent --show-error \
  --connect-timeout 5 --max-time 10 \
  -H 'Content-Type: application/json' \
  -d "{
    \"tenant_session\": \"$SESSION\",
    \"lookup\": \"subject\",
    \"subject\": \"crm_customer_12345\",
    \"subject_type\": \"customer_id\",
    \"record_mode\": \"fields\",
    \"fields\": \"email,phone\"
  }" \
  "$BASE/api/read" |
  jq '{ok, status: .response.status,
       request_id: .response.request_id,
       audit_id: .response.audit_id}'