from curl_cffi import requests
base='https://mein-portal-registrierung.baloise.de/auth'
ident={'X-Bug-Bounty':'dwbzn'}

def session():
 s=requests.Session(impersonate='chrome'); r=s.get(base+'/ui/app',headers=ident,timeout=30); csrf=s.cookies.get('CSRFT759-S') or ''; return s,{**ident,'X-Same-Domain':'1','X-CSRFT759':csrf,'Accept':'application/json, application/vnd.api+json','Content-Type':'application/json'}
def show(tag,r):
 print('\n###',tag,'id=',getattr(r,'toadex_exchange_id',None),'status=',r.status_code)
 print({k:v for k,v in r.headers.items() if k.lower() in ['location','set-cookie','www-authenticate','x-forward-url','content-type']})
 print(r.text[:12000])
for path in ['/rest/public/user-self-registration/ui/default/flow/id','/rest/public/ui/static/configuration','/rest/public/authentication/ui/configuration/access','/rest/public/authentication/ui/default/application/id']:
 s,h=session(); r=s.get(base+path,headers=h,timeout=30); show(path,r)
# Correct default flow sequence
s,h=session(); r=s.get(base+'/rest/public/user-self-registration/ui/default/flow/id',headers=h,timeout=30); show('default-flow-id',r)
try: fid=r.json().get('flowId') or r.json().get('data',{}).get('attributes',{}).get('flowId')
except: fid=None
print('FID',fid)
if fid:
 r=s.delete(base+'/rest/public/user-self-registration/flow',headers=h,timeout=30); show('delete',r)
 r=s.post(base+f'/rest/public/user-self-registration/flows/{fid}/select',headers=h,data=b'null',timeout=30); show('select '+fid,r)