Examples

Use these snippets as starting points, but always validate payloads and response handling against the published contract at /docs/api/openapi.yaml.

---

cURL: check the disabled estimate boundary

curl -X POST https://api.nowtoprint.com/api/v1/estimate \
  -H "Authorization: Bearer ntp_test_your_key" \
  -H "Content-Type: application/json" \
  -d '{
    "category": "brochure",
    "quantity": 500,
    "specifications": {
      "pageCount": 16
    }
  }'

---

Node.js: create a live RFQ

const response = await fetch('https://api.nowtoprint.com/api/v1/rfq', {
  method: 'POST',
  headers: {
    Authorization: `Bearer ${process.env.NOWTOPRINT_API_KEY}`,
    'Content-Type': 'application/json',
    'Idempotency-Key': crypto.randomUUID(),
  },
  body: JSON.stringify({
    catalogProductUid: 'ntp:book:a5:softcover:books',
    title: 'Spring brochure batch',
    category: 'book',
    quantity: 2500,
    deliveryCity: 'Istanbul',
  }),
});

if (!response.ok) {
  const problem = await response.json();
  throw new Error(`RFQ creation failed: ${problem.code ?? response.status}`);
}

const created = await response.json();
console.log(created.id, created.trackingCode);

---

RFQ, quote, and order readiness

RFQ create, owned-RFQ detail, and owned-RFQ supplier quote reads are live. Quote acceptance and orders remain launch-disabled. Generate clients only from the published contract and treat 422, 429, and catalog-context 503 responses as typed RFQ outcomes, not generic success.

---

Node.js: verify webhook signatures

import crypto from 'node:crypto';

export function verifyWebhookSignature(payload: string, signature: string, secret: string) {
  const digest = crypto.createHmac('sha256', secret).update(payload).digest('hex');
  return signature === `sha256=${digest}`;
}

Use the raw request body for verification before parsing JSON. Webhook event delivery remains pilot/rollout controlled; do not assume quote or order events are public-current production enablements.

---

Production notes

• keep keys and webhook secrets in managed server-side secrets
• do not trust client-side integrations with direct live credentials
• log request IDs, not credentials
• treat webhook consumers as idempotent workers for approved pilots
• do not treat API keys as switches for Master Data data-product GA access