[madisp]

API is http instead of https and doesn't require signing the request body or parameters :(

[benscarberry]

you are right about http. it should be https, I'll pass it on. But request is already authorized with headers? you can email them [e-mail] and let them know how you'd love to do it, I'm sure they will listen.