Endpoints
High-level endpoint map for Partner API estimate, launch-disabled RFQ, and excluded private-beta surfaces.
Endpoints
This page provides a human-readable map of the current Partner API routes. The machine-readable
source of truth remains /docs/api/openapi.yaml.
Base URL
https://api.nowtoprint.com/api/v1
Estimate
| Method | Path | Purpose |
|---|---|---|
POST | /api/v1/estimate | Get a print-job pricing signal |
RFQs
| Method | Path | Purpose |
|---|---|---|
POST | /api/v1/rfq | Launch-disabled; authenticates, checks permission, then returns 501 |
GET | /api/v1/rfq | Launch-disabled; authenticates, checks permission, then returns 501 |
RFQ detail, supplier quote, quote acceptance, and order routes are not public-current production
enablements. Treat any route not listed in /docs/api/openapi.yaml as
unavailable for public client generation.
Quote and order flow
Quote and order flow stays outside the public Partner OpenAPI until private-beta evidence, onboarding controls, and rollout state explicitly enable those operations for a partner.
Preflight from Partner API
| Method | Path | Purpose |
|---|---|---|
POST | /api/v1/preflight | Submit a file for commercial-side preflight analysis |
Use the dedicated preflight contract from
/docs/api/preflight-openapi.yaml when you need the queued v3
validation surface directly.
Webhooks
Webhook management and event delivery are not public-current production enablements for every
Partner API key. The /api/v1/webhooks management route is a private-beta control-plane surface
that requires an active registry key with webhooks:manage; quote/order event delivery also depends
on contract, entitlement, and rollout state.
Master Data
Master Data is internal-only for external partners unless a private-beta contract and rollout explicitly enable a sanitized read projection. External GA is not enabled. Public Partner API access does not currently include externally enabled Master Data data-product endpoints, partner reads, or canonical write authority.
Master Data external-dark
Do not treat Master Data contract IDs or API key records as live public endpoints. They stay
runtime-dark for external partners until route exposure, authorization, audit, quota, onboarding,
legal controls, certification controls, and production evidence are complete. Public/partner
routes cannot write canonical L2 truth and must return sanitized projections without private
payload fields. Catalog projection data-products also pass the @nowtoprint/catalog positive
allowlist and contract-shape guard before quota reservation or response serialization, so
sanitized optionPolicy.*[].sourceRef refs can expose only collection/id/version/role, and unexpected metadata fields,
ref paths, signed URLs, Firestore paths, cost, margin, billing, and private evidence fail closed.
Request guidance
- use bearer auth for public Partner OpenAPI requests
- send
Idempotency-Keyon metered reads or writes that may be retried;X-Idempotency-Keyremains accepted for older clients. Keep the value 160 characters or shorter; longer values are rejected, not truncated - trust response headers for entitlement-aware limit behavior
- prefer webhooks only for approved event-delivery pilots; do not assume webhook availability from key format alone
Related docs
War dieser Artikel hilfreich?
Verwandte Artikel
Last updated on