# --- Step 1: Get admin credentials securely ---
$cred = Get-Credential
$domain = "yourdomain"

# --- Step 2: Build login payload ---
$loginBody = @{
    username = $cred.UserName
    password = $cred.GetNetworkCredential().Password
    domain   = $domain
} | ConvertTo-Json

# --- Step 3: API base URL and cert bypass for testing ---
$restApiBaseUrl = "https://horizon.domain.com/rest"
Add-Type @"
    using System.Net;
    using System.Security.Cryptography.X509Certificates;
    public class TrustAllCertsPolicy : ICertificatePolicy {
        public bool CheckValidationResult(ServicePoint srvPoint, X509Certificate certificate,
                                          WebRequest request, int certificateProblem) {
            return true;
        }
    }
"@
[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy

# --- Step 4: Authenticate and get token ---
$tokenResponse = Invoke-RestMethod -Method POST -Uri "$restApiBaseUrl/login" -Body $loginBody -ContentType "application/json"
$token = $tokenResponse.access_token
$headers = @{ "Authorization" = "Bearer $token" }

# --- Step 5: Load and encode icon file ---
$iconFilePath = "C:\path\file.png"
$iconBytes = [System.IO.File]::ReadAllBytes($iconFilePath)
$base64Icon = [System.Convert]::ToBase64String($iconBytes)

# --- Step 6: Upload the icon ---
$iconBody = @{
    data = $base64Icon
    height = 256
    width = 256
} | ConvertTo-Json -Depth 2

$response = Invoke-RestMethod -Method POST -Uri "$restApiBaseUrl/inventory/v1/application-icons" -Headers $headers -Body $iconBody -ContentType "application/json"

# --- Step 7: Retrieve the icon ID from the uploaded base64 data ---
$iconId = ((Invoke-RestMethod -Method GET -Uri "$restApiBaseUrl/inventory/v1/application-icons/custom-icons" -Headers $headers -ContentType "application/json") | Select-Object data,id | Where-Object {$_.data -eq $base64Icon}).id

# --- Step 8: Get application ID by name (e.g., Notepad) ---
$appFilterJSON = @{
    type = "Equals"
    name = "name"
    value = "Notepad"
}
$appFilterURLEncoded = [System.Web.HttpUtility]::UrlEncode(($appFilterJSON | ConvertTo-Json -Depth 2 -Compress))
$appId = (Invoke-RestMethod -Method GET -Uri "$restApiBaseUrl/inventory/v4/application-pools?filter=$appFilterURLEncoded" -Headers $headers).id

# --- Step 9: Associate the custom icon with the application ---
$appIconAssocBody = @{
    application_pool_ids = @("$appId")
    icon_id = "$iconId"
} | ConvertTo-Json -Depth 2

Invoke-RestMethod -Method POST -Uri "$restApiBaseUrl/inventory/v1/application-pools/action/associate" -Headers $headers -Body $appIconAssocBody -ContentType "application/json"