Print on demand, as an API.

curl -X POST https://api.weprintlocal.co.uk/v1/sandbox/jobs/$ORDER_REFERENCE/advance -H "Authorization: Bearer $WPL_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"to":"Shipped","trackingNumber":"TEST123"}'   # InProduction | Shipped | Delivered

curl -X POST https://api.weprintlocal.co.uk/v1/orders/$ORDER_REFERENCE/hold -H "Authorization: Bearer $WPL_API_KEY" -H "Content-Type: application/json" -d '{"reason":"Checking stock"}'
curl -X POST https://api.weprintlocal.co.uk/v1/orders/$ORDER_REFERENCE/release -H "Authorization: Bearer $WPL_API_KEY"
curl -X PUT https://api.weprintlocal.co.uk/v1/orders/$ORDER_REFERENCE/delivery-address -H "Authorization: Bearer $WPL_API_KEY" -H "Content-Type: application/json" \
  -d '{"name":"Jo Bloggs","line1":"2 Park Row","city":"Leeds","postcode":"LS1 5HD","countryCode":"GB"}'
curl -X POST https://api.weprintlocal.co.uk/v1/orders/$ORDER_REFERENCE/cancel -H "Authorization: Bearer $WPL_API_KEY" -H "Content-Type: application/json" -d '{"reason":"Customer changed their mind"}'
curl -X POST https://api.weprintlocal.co.uk/v1/orders/$ORDER_REFERENCE/issues -H "Authorization: Bearer $WPL_API_KEY" -H "Content-Type: application/json" \
  -d '{"lineNo":1,"kind":"Damaged","description":"Cover creased on arrival","affectedQuantity":1}'
curl -X POST https://api.weprintlocal.co.uk/v1/orders/$ORDER_REFERENCE/notes -H "Authorization: Bearer $WPL_API_KEY" -H "Content-Type: application/json" -d '{"body":"Gift: no prices in the parcel"}'
curl https://api.weprintlocal.co.uk/v1/orders/$ORDER_REFERENCE/activity -H "Authorization: Bearer $WPL_API_KEY"

# Tags: replace the whole set (letters, numbers and - _ . : up to 40 characters; at most 20)
curl -X PUT https://api.weprintlocal.co.uk/v1/orders/$ORDER_REFERENCE/tags -H "Authorization: Bearer $WPL_API_KEY" -H "Content-Type: application/json" -d '{"tags":["rush","school:leeds"]}'

# Cancel one item (line 2) before a printer starts it; the rest of the order carries on
curl -X POST https://api.weprintlocal.co.uk/v1/orders/$ORDER_REFERENCE/lines/2/cancel -H "Authorization: Bearer $WPL_API_KEY" -H "Content-Type: application/json" -d '{"reason":"Customer no longer needs it"}'

# Duplicate: same items, artwork and address as a new order on account at today's prices; starts on hold unless "hold": false
curl -X POST https://api.weprintlocal.co.uk/v1/orders/$ORDER_REFERENCE/duplicate -H "Authorization: Bearer $WPL_API_KEY" -H "Content-Type: application/json" -d '{"hold":true}'

# Download one of the order's artwork files (fileId from lines[].files)
curl https://api.weprintlocal.co.uk/v1/orders/$ORDER_REFERENCE/files/$FILE_ID -H "Authorization: Bearer $WPL_API_KEY" -o artwork.pdf

# Saved views of the orders list (filters are the list's query parameters)
curl https://api.weprintlocal.co.uk/v1/order-views -H "Authorization: Bearer $WPL_API_KEY"
curl -X POST https://api.weprintlocal.co.uk/v1/order-views -H "Authorization: Bearer $WPL_API_KEY" -H "Content-Type: application/json" \
  -d '{"name":"Late rush orders","shared":true,"filters":{"sla":"Late","tag":"rush"}}'
curl -X DELETE https://api.weprintlocal.co.uk/v1/order-views/$VIEW_ID -H "Authorization: Bearer $WPL_API_KEY"

curl -X POST https://api.weprintlocal.co.uk/v1/intake/csv -H "Authorization: Bearer $WPL_API_KEY" -H "Content-Type: text/csv" --data-binary @orders.csv

# orders.csv — rows sharing order_ref form one order
order_ref,customer_name,customer_email,address1,city,postcode,country,sku,quantity,artwork_url
1001,Jo Bloggs,jo@example.com,1 High St,Leeds,LS1 1AA,GB,BOOK-21,1,https://example.com/jo.pdf

curl -X POST https://api.weprintlocal.co.uk/v1/intake/orders -H "Authorization: Bearer $WPL_API_KEY" -H "Content-Type: application/json" \
  -d '[{"externalReference":"1002","customer":{"name":"Jo Bloggs","email":"jo@example.com"},
        "delivery":{"name":"Jo Bloggs","line1":"1 High St","city":"Leeds","postcode":"LS1 1AA","countryCode":"GB"},
        "lines":[{"sku":"BOOK-21","quantity":1,"artwork":[{"role":"Cover","url":"https://example.com/art.pdf"}]}]}]'

import { createHmac, timingSafeEqual } from "node:crypto";

export function verify(rawBody, header, secret, toleranceSeconds = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return false;
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  return parts.v1?.length === expected.length &&
    timingSafeEqual(Buffer.from(parts.v1, "hex"), Buffer.from(expected, "hex"));
}

curl -X POST https://api.weprintlocal.co.uk/v1/orders -H "Authorization: Bearer $WPL_API_KEY" \
  -H "Idempotency-Key: my-order-1001" -H "Content-Type: application/json" \
  -d '{"externalReference":"1001","postbackUrl":"https://example.com/weprintlocal/postbacks",
       "lines":[{"quoteId":"$QUOTE_ID","externalLineId":"A-1","files":{ "Cover": "$COVER_FILE_ID", "Text": "$TEXT_FILE_ID" }}],
       "customer":{"name":"Jo Bloggs","email":"jo@example.com"},
       "deliveryAddress":{"name":"Jo Bloggs","line1":"1 High St","city":"Leeds","postcode":"LS1 1AA","countryCode":"GB"}}'

import { createHmac, timingSafeEqual } from "node:crypto";

// Use the raw request body (exactly the bytes received), not re-serialised JSON.
export function verify(rawBody, header, secret, toleranceSeconds = 300) {
  const parts = Object.fromEntries(header.split(",").map((p) => p.split("=")));
  const t = Number(parts.t);
  if (!t || Math.abs(Date.now() / 1000 - t) > toleranceSeconds) return false;
  const expected = createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
  return parts.v1?.length === expected.length &&
    timingSafeEqual(Buffer.from(parts.v1, "hex"), Buffer.from(expected, "hex"));
}

// Express: app.post("/postbacks", express.raw({ type: "application/json" }), (req, res) => {
//   if (!verify(req.body.toString("utf8"), req.get("x-wpl-signature") ?? "", process.env.WPL_POSTBACK_SECRET)) return res.sendStatus(401);
//   const event = JSON.parse(req.body);
//   if (alreadySeen(event.id)) return res.sendStatus(200);   // a retry or "Send again": ignore
//   remember(event.id); handle(event); res.sendStatus(200);
// });

<?php
function wpl_verify(string $rawBody, string $header, string $secret, int $tolerance = 300): bool {
    $parts = [];
    foreach (explode(',', $header) as $pair) {
        [$k, $v] = array_pad(explode('=', $pair, 2), 2, '');
        $parts[$k] = $v;
    }
    $t = (int)($parts['t'] ?? 0);
    if ($t === 0 || abs(time() - $t) > $tolerance) return false;
    $expected = hash_hmac('sha256', $t . '.' . $rawBody, $secret);
    return hash_equals($expected, $parts['v1'] ?? '');
}

$raw = file_get_contents('php://input');
if (!wpl_verify($raw, $_SERVER['HTTP_X_WPL_SIGNATURE'] ?? '', getenv('WPL_POSTBACK_SECRET'))) {
    http_response_code(401);
    exit;
}
$event = json_decode($raw, true);
// De-duplicate on $event['id'], then handle $event['event'] and $event['data'].
http_response_code(200);

curl "https://api.weprintlocal.co.uk/v1/webhook-deliveries?status=Failed&pageSize=20" -H "Authorization: Bearer $WPL_API_KEY"
curl "https://api.weprintlocal.co.uk/v1/webhook-deliveries?orderReference=$ORDER_REFERENCE" -H "Authorization: Bearer $WPL_API_KEY"

# Send one again now (same body and id, freshly signed) → 202
curl -X POST https://api.weprintlocal.co.uk/v1/webhook-deliveries/$DELIVERY_ID/redeliver -H "Authorization: Bearer $WPL_API_KEY"

# Default postback URL (null clears it) and its signing secret
curl https://api.weprintlocal.co.uk/v1/postback-settings -H "Authorization: Bearer $WPL_API_KEY"
curl -X PUT https://api.weprintlocal.co.uk/v1/postback-settings -H "Authorization: Bearer $WPL_API_KEY" -H "Content-Type: application/json" -d '{"url":"https://example.com/weprintlocal/postbacks"}'
curl -X POST https://api.weprintlocal.co.uk/v1/postback-settings/rotate-secret -H "Authorization: Bearer $WPL_API_KEY"

const res = await fetch("https://api.weprintlocal.co.uk/v1/quotes", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.WPL_API_KEY}`,
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
    "productCode": "SQ-HARDBACK-BOOK",
    "quantity": 1,
    "options": {
      "pages": "24"
    },
    "deliveryServiceCode": "STANDARD"
  })
});
const quote = await res.json();
console.log(quote.total, quote.currency);