Examples

Use these snippets as starting points, but always validate payloads and response handling against the published contract at /docs/api/openapi.yaml.

---

cURL: request an estimate

curl -X POST https://api.nowtoprint.com/api/v1/estimate \
  -H "Authorization: Bearer ntp_test_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "category": "brochure",
    "quantity": 500,
    "specifications": {
      "pageCount": 16
    }
  }'

---

Node.js: handle RFQ launch-disabled response

const response = await fetch('https://api.nowtoprint.com/api/v1/rfq', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NOWTOPRINT_API_KEY}`,
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({
    title: 'Spring brochure batch',
    category: 'brochure',
    quantity: 2500,
    deliveryCity: 'Istanbul',
  }),
});

if (!response.ok) {
  if (response.status === 501) {
    const problem = await response.json();
    console.log('RFQ public launch is disabled for this environment', problem);
    return;
  }

  throw new Error(`RFQ creation failed: ${response.status}`);
}

const rfq = await response.json();
console.log(rfq.id);

---

RFQ, quote, and order readiness

Do not generate public clients for RFQ detail, supplier quotes, quote acceptance, or orders until those operations are present in /docs/api/openapi.yaml. The current published RFQ create/list operations are launch-disabled and return 501.

---

Node.js: verify webhook signatures

import crypto from 'node:crypto';

export function verifyWebhookSignature(payload: string, signature: string, secret: string) {
  const digest = crypto.createHmac('sha256', secret).update(payload).digest('hex');
  return signature === `sha256=${digest}`;
}

Use the raw request body for verification before parsing JSON. Webhook event delivery remains pilot/rollout controlled; do not assume quote or order events are public-current production enablements.

---

Production notes

• keep keys and webhook secrets in managed server-side secrets
• do not trust client-side integrations with direct live credentials
• log request IDs, not credentials
• treat webhook consumers as idempotent workers for approved pilots
• do not treat API keys as switches for Master Data data-product GA access