Build on Zanelvo

Authentication

Create a scoped API key in your dashboard under Settings → API keys. Keys start with yv_ and carry per-resource scopes like contacts:read / contacts:write. The full key is shown once. Send it as a bearer token (or the X-Api-Key header):

curl https://your-app-url/api/public/v1/contacts \
  -H "Authorization: Bearer yv_live_xxx"

Core endpoints

All responses are JSON; ids are UUIDs. Each call needs the matching scope.

The full interactive schema is available at /docs on your backend.

Webhooks

Subscribe to events (order paid, form submitted, booking created, and more) in Settings → Webhooks. We POST a signed JSON payload to your endpoint and retry with backoff, with a dead-letter queue and one-click replay.

Every delivery carries an HMAC signature header you should verify:

X-Zanelvo-Signature: sha256=<hex>

# verify (python)
import hmac, hashlib
expected = "sha256=" + hmac.new(secret.encode(), body, hashlib.sha256).hexdigest()
assert hmac.compare_digest(expected, header_value)

Limits & safety

• Requests are rate-limited per key; back off on 429 responses.
• Amounts are always computed server-side — clients never set prices or totals.
• Keys are scoped; a read key cannot write. Rotate or revoke keys anytime.
• All outbound URLs you configure are checked against SSRF (no private IPs).