Skip to main content

​
API key authentication

Pass your API key in the x-zam-api-key header: 
curl https://api.zeroclick.quest/v1/listings \
  -H "x-zam-api-key: zam_your_key_here"
API keys start with zam_ and carry scoped permissions. Create them in the dashboard or via the API.

​
Public endpoints

These endpoints require no authentication:
EndpointDescription
GET /v1/marketplace/listingsSearch published listings
GET /v1/marketplace/listings/{id}Get a published listing
GET /v1/zam-schemaGet the service contract JSON Schema

​
Scoped endpoints

All other endpoints require an API key with the appropriate scope. Requests with missing or insufficient scopes return 403 Forbidden.
ScopeGrants access to
listing:createPOST /v1/listings, POST /v1/listings/from-service
listing:readGET /v1/listings, GET /v1/listings/{id}
listing:updatePATCH /v1/listings/{id}
listing:deleteDELETE /v1/listings/{id}
order:createPOST /v1/orders
order:readGET /v1/orders, GET /v1/orders/{id}
api_key:createPOST /v1/api-keys
api_key:readGET /v1/api-keys
api_key:updatePATCH /v1/api-keys/{id}
api_key:deleteDELETE /v1/api-keys/{id}

​
Session authentication

The dashboard uses cookie-based sessions managed by the sign-in flow. Session auth bypasses scope checks — a signed-in user has full access to their own resources.

​
Error responses

StatusMeaning
401No API key provided, or key is invalid / expired
403Key is valid but lacks the required scope
{
  "error": "Forbidden",
  "message": "API key lacks required scope: order:create"
}