For developers
Your organisation's developers connect its systems to ZAITRACK through the public API and webhooks. Two places hold what they need.
Developer Studio
Developer Studio: sign in with your ZAITRACK account. What you may change follows your role.
| Area | Who changes it |
|---|---|
| Sandboxes: up to 3 test organisations; Reset (a new id, keys moved) and Delete (keys revoked), each asked first | owners |
| API keys: live keys for the organisation, test keys for a sandbox; shown once; each key's use per day | owners |
| OAuth apps: confidential (with a secret, shown once, Rotate) or public (PKCE); https redirects, or localhost for development; scopes no wider than your roles | owners and admins |
| Webhooks: the signing secret shown once, Send a test, each delivery's payload and attempts, Replay | owners and admins |
| Audit log: filtered, page by page, the chain verified | read |
A viewer reads the OAuth apps, the rate limits and their account; other pages say which permission they lack.
- A key's use is a minimum: it counts the gateway's audited routes and personal access tokens. The page says so under the chart.
- Rate limits are per organisation, with per-route overrides. There are no per-key or per-plan limits.
Not yet
- OAuth apps have no consent screen: an app is for its own organisation's members.
- An access token already issued stays valid for its 15 minutes after its app is deleted. Refresh tokens and new tokens stop at once.
- A sandbox's data becomes unreachable when it is reset or deleted; it is not erased.
The developer site
The developer site documents the public API v1: every operation with its scope and rate limit, errors, pagination, idempotency, regions, webhook events and their signatures, publishing adapters, and recipes.
No SDK is published yet; the site shows how to call the API directly.