Zora Support

Zora Support/Docs

Web API

Call Zora Support from your server with the HTTP API—authentication, users, conversations, and messages.

The Web API lets your backend create users, open conversations, send messages, and query workspace data over HTTPS. Use it for CRMs, custom portals, and automation that should not run in the browser.

Authentication

Every request needs an admin API token. In cloud, copy the token from Account → Installation → API token (or the equivalent API panel). Keep it secret—never embed it in frontend JavaScript.

Pass the token either:

  • As a form/query field named token, or
  • As an HTTP header named token

Endpoint

Cloud workspaces call the hosted API endpoint shown in your dashboard (an api.php-style URL on your cloud host). Self-managed endpoints are out of scope for this cloud guide—use the URL printed in your Zora cloud account.

Requests are typically POST with fields:

| Field | Purpose | | --- | --- | | token | Admin secret | | function | API method name (for example get-user, send-message) | | … | Method-specific arguments |

Example shape (pseudo-curl):

curl -X POST "https://YOUR-CLOUD-HOST/script/include/api.php" \
  -d "token=YOUR_TOKEN" \
  -d "function=get-user" \
  -d "user_id=123"

Users (selected methods)

| Function | Use | | --- | --- | | get-user | Fetch a user by ID | | get-user-by | Lookup by email or other key | | get-users / get-new-users / get-online-users | Lists and presence | | search-users | Full-text style search | | add-user / update-user / delete-user | Lifecycle | | get-agent / agents-online | Agent helpers | | login / logout | Session helpers where applicable |

Conversations and messages

| Function | Use | | --- | --- | | get-conversation / get-conversations | Read threads | | get-user-conversations | Threads for one user | | new-conversation | Start a thread (optionally with department or agent) | | update-conversation-status | Archive, restore, and related status changes | | update-conversation-department / update-conversation-agent | Routing | | send-message / update-message / delete-message | Message CRUD | | get-new-messages / get-last-message | Sync helpers | | set-rating / get-rating | CSAT-style ratings |

Response format

Successful calls return JSON with a success flag and a response payload (object or array depending on the method). Errors return a message you should log and surface to operators—not end users—when the token or arguments are invalid.

Security notes

  • Rotate tokens if they leak.
  • Prefer server-to-server calls from your trusted backend.
  • Validate and sanitize any user-supplied IDs before forwarding them to the API.

Related docs