Examples

The current RFQ create and organization-owned RFQ/quote read contract is generated at /api/v1/marketplace/openapi.json. The older /docs/api/openapi.yaml publication is a separate reference; do not assume the documents are identical. Confirm the environment origin and approved capabilities during onboarding.

Use these snippets as starting points, but always validate payloads and response handling against the published contract at /docs/api/openapi.yaml.

---

cURL: check the disabled estimate boundary

curl -X POST https://api.nowtoprint.com/api/v1/estimate \
  -H "Authorization: Bearer ntp_partner_v2_<issued-key-id>_<secret>" \
  -H "Content-Type: application/json" \
  -d '{
    "category": "brochure",
    "quantity": 500,
    "specifications": {
      "pageCount": 16
    }
  }'

---

Node.js: create a live RFQ

const response = await fetch('https://api.nowtoprint.com/api/v1/rfq', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NOWTOPRINT_API_KEY}`,
    'Content-Type': 'application/json',
  },
  body: JSON.stringify({
    catalogProductUid: 'ntp:book:a5:softcover:books',
    title: 'Spring book batch',
    category: 'book',
    quantity: 2500,
    deliveryCity: 'Istanbul',
  }),
});

if (!response.ok) {
  const problem = await response.json();
  throw new Error(`RFQ creation failed: ${problem.code ?? response.status}`);
}

const created = await response.json();
console.log(created.id, created.trackingCode);

---

RFQ, quote, and order readiness

RFQ create, owned-RFQ detail, and owned-RFQ supplier quote reads are live. Quote acceptance and orders remain launch-disabled. Generate clients only from the published contract and treat 422, 429, and catalog-context 503 responses as typed RFQ outcomes, not generic success.

---

Node.js: verify webhook signatures

// Durable Marketplace delivery only: use a Standard Webhooks-compatible verifier.
// Preserve rawBody bytes and read webhook-id, webhook-timestamp, webhook-signature.
// Verify HMAC over `${id}.${timestamp}.${rawBody}`, check timestamp freshness,
// and compare decoded signatures with a constant-time comparison before parsing.

Use the raw request body for verification before parsing JSON. Webhook event delivery remains pilot/rollout controlled; do not assume quote or order events are public-current production enablements.

---

Production notes

• keep keys and webhook secrets in managed server-side secrets
• do not trust client-side integrations with direct live credentials
• log request IDs, not credentials
• treat webhook consumers as idempotent workers for approved pilots
• do not treat API keys as switches for Master Data data-product GA access

These comments are not a standalone verifier implementation. Follow the webhook guide for exact signature formats; XJMF and the /api/v1/webhooks delivery helper use different contracts.

Use a published product and its category from the approved environment in place of the sample catalogProductUid; the example ID is not proof of a production record. Validate the HTTP status and Content-Type contract before treating a response as success.