ZapyFlow API
A REST API for everything your workspace does — conversations, orders, appointments, contacts, CRM, campaigns and channels. 210 operations, 48 scopes, version 2026-10-12.
Base URL
text
https://api.zapyflow.com.brThe machine-readable contract lives at /openapi.json (OpenAPI 3.1) and is generated from the running server — not written by hand.
Your first call
Create a key in the dashboard under Developers → API keys. The secret is shown once, at creation. Give it only the scopes the integration needs.
bash
curl https://api.zapyflow.com.br/api/conversations \
-H "Authorization: Bearer $ZAPYFLOW_API_KEY"What a key is — and is not
A key is an authenticated principal of one workspace, not an impersonation of the person who created it. Three consequences worth knowing before you build:
| Rule | What it means for you |
|---|---|
| A key never exceeds its creator | Effective permissions are the intersection of the key's scopes with the capabilities of the role that created it. If that member is demoted, the key narrows on the next request. |
| Personal account endpoints are closed to every key | Profile, password, email, sessions and account deletion are unreachable with a key — including keys created before scopes existed. |
| Keys are workspace-scoped | A key can never read or write another workspace's data, regardless of the ids you pass. |
Next
- Authentication — headers, 401 semantics, key rotation
- Scopes — the full list, generated from the server's authorization table
- Webhooks — signature scheme, retries, and known-answer test vectors