// $identifierValue bevat de OPRF-uitvoer; zie de lookup-stap hieronder
$resource = json_encode([
    'resourceType' => 'List',
    'extension' => [[
        'url' => 'http://minvws.github.io/generiekefuncties-docs/StructureDefinition/nl-gf-localization-custodian',
        'valueReference' => [
            'identifier' => [
                'system' => 'http://fhir.nl/fhir/NamingSystem/ura',
                'value'  => $custodianUra,
            ],
        ],
    ]],
    'subject' => [
        'identifier' => [
            'system' => 'http://minvws.github.io/generiekefuncties-docs/NamingSystem/nvi-identifier',
            'value'  => $identifierValue,
        ],
    ],
    'source' => [
        'identifier' => [
            'system' => 'urn:ietf:rfc:3986',
            'value'  => $sourceId,
        ],
        'type' => 'Device',
    ],
    'status' => 'current',
    'mode' => 'working',
    'emptyReason' => [
        'coding' => [[
            'system' => 'http://terminology.hl7.org/CodeSystem/list-empty-reason',
            'code' => 'withheld',
        ]],
    ],
]);

[$status, $body] = curlRequest($certFile, $keyFile, '<nvi-api-url>/api/fhir/List', [
    CURLOPT_POST       => true,
    CURLOPT_POSTFIELDS => $resource,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer ' . $jwtNvi,
        'Content-Type: application/fhir+json',
        'Accept: application/fhir+json',
    ],
]);

import requests

# identifier_value bevat de OPRF-uitvoer; zie de lookup-stap hieronder
NVI_BASE_URL  = "<nvi-api-url>/api"
CUSTODIAN_URA = "<custodian-ura>"
SOURCE_ID     = "<bron-id>"

resource = {
    "resourceType": "List",
    "extension": [{
        "url": "http://minvws.github.io/generiekefuncties-docs/StructureDefinition/nl-gf-localization-custodian",
        "valueReference": {
            "identifier": {
                "system": "http://fhir.nl/fhir/NamingSystem/ura",
                "value": CUSTODIAN_URA,
            }
        }
    }],
    "subject": {
        "identifier": {
            "system": "http://minvws.github.io/generiekefuncties-docs/NamingSystem/nvi-identifier",
            "value": identifier_value,
        }
    },
    "source": {
        "identifier": {
            "system": "urn:ietf:rfc:3986",
            "value": SOURCE_ID,
        },
        "type": "Device",
    },
    "status": "current",
    "mode": "working",
    "emptyReason": {
        "coding": [{
            "system": "http://terminology.hl7.org/CodeSystem/list-empty-reason",
            "code": "withheld",
        }]
    },
}

session = requests.Session()
session.cert = ("client-cert.pem", "client-key.pem")
resp = session.post(
    f"{NVI_BASE_URL}/fhir/List",
    headers={
        "Authorization": f"Bearer {token}",
        "Content-Type":  "application/fhir+json",
        "Accept":         "application/fhir+json",
    },
    json=resource,
)
resp.raise_for_status()

// $jwe en $rawBlind komen uit pseudonymiseBsn() — zie PRS-integratie
$blindFactor = sodium_bin2base64($rawBlind, SODIUM_BASE64_VARIANT_URLSAFE);
$json = json_encode([
    'evaluated_output' => $jwe,
    'blind_factor'     => $blindFactor,
], JSON_UNESCAPED_SLASHES);

// base64url: geen padding, - en _ i.p.v. + en /
$identifierValue = rtrim(strtr(base64_encode($json), '+/', '-_'), '=');

$system = 'http://minvws.github.io/generiekefuncties-docs/NamingSystem/nvi-identifier';
$query  = 'subject:identifier=' . $system . '|' . $identifierValue;

[$status, $body] = curlRequest($certFile, $keyFile,
    '<nvi-api-url>/api/fhir/List?' . $query,
    [
        CURLOPT_HTTPGET    => true,
        CURLOPT_HTTPHEADER => [
            'Authorization: Bearer ' . $jwtNvi,
            'Accept: application/fhir+json',
        ],
    ]
);

$bundle = json_decode($body, true);
foreach ($bundle['entry'] ?? [] as $entry) {
    $r = $entry['resource'];
    echo $r['id'] . "\n";
}

import base64, json, requests

# jwe en raw_blind komen uit de PRS OPRF-flow — zie PRS-integratie
NVI_BASE_URL = "<nvi-api-url>/api"

identifier_json = json.dumps(
    {"evaluated_output": jwe, "blind_factor": base64.urlsafe_b64encode(raw_blind).decode()},
    separators=(",", ":"),
)
identifier_value = base64.urlsafe_b64encode(identifier_json.encode()).rstrip(b"=").decode()

system = "http://minvws.github.io/generiekefuncties-docs/NamingSystem/nvi-identifier"
query  = f"subject:identifier={system}|{identifier_value}"

session = requests.Session()
session.cert = ("client-cert.pem", "client-key.pem")
resp = session.get(
    f"{NVI_BASE_URL}/fhir/List?{query}",
    headers={
        "Authorization": f"Bearer {token}",
        "Accept":         "application/fhir+json",
    },
)
resp.raise_for_status()
bundle = resp.json()
for entry in bundle.get("entry", []):
    r = entry["resource"]
    print(r["id"])