# Expose an endpoint

Connect an existing frontend to a work through a small JSON API.

Source: https://littleworks.app/docs/http

## Choose the entry point

| Trigger | Who can invoke it |
| --- | --- |
| `callable` | An authenticated merchant or store-scoped agent through Littleworks. No public HTTP function route. |
| HTTP, `auth: "public"` | Anyone who can reach the endpoint, subject to input validation, origin policy, and traffic limits. |
| HTTP, `auth: "merchant"` | An authenticated merchant or store-scoped agent. This is not customer-account authentication. |

## Declare an HTTP trigger

### Manifest trigger

```json
{
  "trigger": {
    "type": "http",
    "method": "POST",
    "auth": "public",
    "origins": [
      "https://your-store.example"
    ]
  }
}
```

Replace the example origin with the exact origin of the frontend, including its scheme. Declare GET or POST. POST accepts a JSON object; GET supplies query parameters as strings. Set an appropriate `inputSchema` for those values.

`deploy_function` returns the endpoint URL for an HTTP work. Use that URL instead of constructing a path from a shop domain. Preview and Live have different URLs and data.

### Call from your frontend

```javascript
const response = await fetch(workUrl, {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ message: "Hello" }),
});

if (!response.ok) throw new Error("The request could not be completed");
const result = await response.json();
```

Here, `workUrl` is the URL returned by deployment. The input must match your work’s schema. Littleworks hosts the endpoint; your agent still needs to build and place the frontend using the appropriate theme or storefront tools.

## Decide what a public request may do

> **An allowed origin is not proof of identity**
> Origins constrain browser access. A non-browser client can omit or forge an Origin header. Public works must validate any customer proof or invitation token that the task requires.

For example, accepting a verified-purchase review requires server-side validation of a purchase-linked invitation. A public endpoint and a customer-supplied order ID alone do not establish eligibility. Never put an agent token in storefront code.

## Return JSON

Return a JSON-compatible value or `Response.json(...)` with a status. Littleworks forwards the body and status, not arbitrary headers, cookies, streaming output, or HTML. This is an API endpoint, not a frontend hosting service.

## Handle traffic protection

Littleworks automatically applies burst limits and store execution budgets. A throttled request receives HTTP 429 with `Retry-After` and `error.retryAt`. Back off; do not automatically replay a mutation. The Shopify admin shows affected works and retry guidance. These limits are platform policy, not merchant settings.