Comment by tylerchurch

> It transmits user input via a HTTP header called SHELLY-INPUT

It sounds like user input is the _only_ input, so why not just use a POST request with a body?