Overview

Zentail sales-channel API current

Information

OpenAPI version: 3.0.3

Authentication

zentail_callback_signature

Sent by Zentail, not by you: Zentail does not call these endpoints yet, and once it does it signs every call. The value is v1= followed by the lowercase hex HMAC-SHA256 of the signing string, keyed with your application’s callback signing secret. The signing string is the X-Zentail-Timestamp value, the HTTP method in upper case, the request path and query as sent, and the raw body, joined by a single newline. While a secret is rotated the header holds one comma-separated v1= value per active secret; accept the call if any one matches. Reject a mismatch with HTTP 401. How to verify it: https://developer.zentail.com/sales-channel-integration/callbacks/#verify-that-zentail-sent-the-call

Security scheme type: apiKey

Header parameter name: X-Zentail-Signature

zentail_callback_timestamp

Sent by Zentail, not by you, alongside X-Zentail-Signature: Zentail does not call these endpoints yet, and once it does, this carries the Unix time in seconds when it signed the call. It is the first part of the signing string. Reject a call whose timestamp is more than 300 seconds from your own clock, either way, with HTTP 401. How to verify it: https://developer.zentail.com/sales-channel-integration/callbacks/#verify-that-zentail-sent-the-call

Security scheme type: apiKey

Header parameter name: X-Zentail-Timestamp

zentail_oauth

Authorization-code grant. Zentail issues a one-time code to the application’s registered redirect URL; the application exchanges it at the token URL over HTTP Basic, with as the username and as the password. There is no refresh grant, so a token is obtained by running this flow again. Send the access token as the whole Authorization header value, with NO “Bearer “ prefix: the API matches the header verbatim against the issued token. The scopes below are the vocabulary, not a menu – an application’s grants are fixed when it is registered, and the authorization request’s scope parameter is ignored.

Security scheme type: oauth2

Flow type: authorizationCode

Authorization URL: https://app.zentail.com/oauth2/auth

Token URL: https://api.zentail.com/v1/token

Scopes:

deliverr - Access to the custom Deliverr integration endpoints.
inventory - Full access to inventory endpoints for all warehouses.
inventory:self - Can only see warehouses that use the integration in the SC. And only inventory in those warehouses will be returned or able to be modified.
inventory:warehouse - Access to all warehouses
inventory:warehouse:self - Access to all warehouses that use the integration in the SC.
legacy - Access to all "legacy" endpoints for all integrations.
listing - Reserved for the future
listing:self - Can retrieve listings and submit listing status and submissions for the integration in the SC.
mcp - Undocumented. This scope is in the registry but the authentication reference does not describe it.
report - Full access to reports.
sales - Full access to sales orders for all integrations.
sales:orders - Currently the same as `sales` but reserved to allow that to expand to other sales endpoints.
sales:orders:fulfillment:self - Includes Address information in each Sales Order
sales:orders:inventory:self - Read-only: can retrieve sales orders for the integration in the SC. No create or update access.
sales:orders:self - Can retrieve, create, update sales orders for the integration in the SC
scm - Full access to scm endpoints: inbound shipments, purchase orders, vendors, and warehouses.
scm:inbound_shipments - Access to inbound shipments.
scm:purchase_orders - Access to purchase orders.
ui - Internal scope for the Zentail web app, not for third-party integrations. Covers import validation, inbound shipments, purchase orders, vendors, and warehouses.

API changelog · Built 0c509dd3