#!/usr/bin/env bash
set -euo pipefail

: "${GRAPH_ACCESS_TOKEN:?Set GRAPH_ACCESS_TOKEN before running this snippet.}"

app_id="${1:-00000003-0000-0000-c000-000000000000}"
encoded_select='$select=id,appId,displayName,appRoles,oauth2PermissionScopes,resourceSpecificApplicationPermissions'

curl -fsSL \
  -H "Authorization: Bearer ${GRAPH_ACCESS_TOKEN}" \
  -H "Accept: application/json" \
  "https://graph.microsoft.com/v1.0/servicePrincipals(appId='${app_id}')?${encoded_select}"