HTTP API

Host is the shop origin. No X-Org-Id header. The Worker owns prices — do not send cents or totals.

• Authorization: Bearer … against https://YOUR-SHOP.odapm.ai
• GET /api/me, GET /api/catalog, POST /api/quotes/price — body is EstimateInput ticks, never cents
• OpenAPI: /api/openapi.json (unauthenticated). EstimateInput schema: /api/schema/estimate-input
• Execute is a separate scope; starter keys cannot run a job
• Rate limits apply. Rotating the app session secret revokes keys too.

The HTTP API lives on that shop origin — not on this marketing site. It ships with the tenant app; a given shop may not have it on yet.