Skip to main content
The ZeroClick REST API manages your catalog (sellers, services, meters, plans, and prices) and handles usage checks, usage reports, and analytics. The endpoint pages that follow are generated from the live OpenAPI document the API serves, so they always match production. The interactive playground on each page sends real requests; authenticate it with your API key.

​
Base URL

All endpoints live under /v1/ and speak JSON over HTTPS.

​
Authentication

Authenticate with an API key as a bearer token. Keys start with zc_ and are shown once. Create them in the dashboard under Settings → API keys. See keys and secrets.
Every key is scoped to your organization and carries one or more scopes: Auth requirements differ by route group:
  • Usage endpoints accept API keys only, with the split read and write scopes above. A dashboard session cannot call them.
  • Sellers (including signing secrets), Services, Meters, Plans, Plan meter prices, Analytics, and Sandbox accept an API key (admin:read for reads, admin:write for writes) or a dashboard session.
  • API keys, Organizations, Users, and Stripe Connect (except POST /v1/stripe-connect/account-link, which accepts admin:write) are dashboard-session-only. An API key gets 403 {"error":"auth_type_not_allowed"}. This is why API keys cannot mint more API keys.
A key missing a required scope gets 403 {"error":"insufficient_scope"}.

​
Conventions

Ids are prefixed strings, returned in the id field and used in path and query parameters: Lists are parent-scoped and unpaginated. List endpoints filter by a required parent id (GET /v1/services?sellerId=sel_…, GET /v1/meters?serviceId=svc_…, GET /v1/plan-meter-prices?planId=pln_…) and return the full set in one response. There are no cursors or page parameters. Timestamps are ISO 8601 strings in UTC. There are no webhooks; poll the analytics endpoints instead.

​
Errors

Errors return a machine-readable envelope, with an optional human-readable reason:
The errors reference catalogs every code.