The ZeeDo API

Create a key in Settings → API & webhooks (an owner confirms it is them first), then call the API with it as a bearer token. The base URL is https://api.zeedo.cloud/v1.

curl https://api.zeedo.cloud/v1/me \
  -H "Authorization: Bearer <your API key>"

• Keys belong to the organisation, carry a scope — read, write or admin — and may be kept to one workspace.
• JSON bodies, snake_case fields, times in ISO 8601 UTC.
• Errors are RFC 9457 problem documents: type, title, status, detail and, for a refused field, errors[] with a JSON pointer.
• Lists page with limit (at most 200) and next_cursor.
• Send an Idempotency-Key header with every POST: a repeat within 24 hours answers what the first did.
• 600 requests a minute and 10 open streams per key, with RateLimit-* headers.

An organisation registers one endpoint (Settings → API & webhooks, or POST /webhooks) and chooses its events. Each event is a POST of JSON carrying ids, the type and timestamps — never a person’s name, email or IP address, which you read back through the API with a key.

{
  "id": "evt_eu_01J9ZQ3M7X5V2K8R4T6Y1N0PBA",
  "type": "run.completed",
  "version": 1,
  "occurred_at": "2026-09-27T10:02:31.000Z",
  "org_id": "org_eu_01J9ZQ1C4H8D6F2W5S7K3M9QXE",
  "data": {
    "run_id": "run_eu_01J9ZQ2V8N4B6C1X3Z5Q7W9ERT",
    "bot_id": "bot_eu_01J9ZQ2A3S5D7F9G1H3J5K7L9M"
  }
}

Every delivery is signed: ZeeDo-Signature: t=<unix seconds>,v1=<signature>, where the signature is the hex HMAC-SHA256 of <t>.<raw body> keyed with your endpoint’s secret. After you rotate the secret, the previous one signs beside it for 24 hours, as a second v1. Refuse a signature more than 5 minutes old.

import { createHmac, timingSafeEqual } from 'node:crypto';

// header: the ZeeDo-Signature value; body: the raw request body, before any JSON parsing
export function verified(header, body, secret) {
  const parts = header.split(',');
  const t = parts.find((p) => p.startsWith('t='))?.slice(2);
  if (!t || Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;
  const expected = createHmac('sha256', secret).update(`${t}.${body}`).digest('hex');
  return parts.filter((p) => p.startsWith('v1=')).some((p) =>
    p.length === expected.length + 3 && timingSafeEqual(Buffer.from(p.slice(3)), Buffer.from(expected)));
}

• Answer with any 2xx within 10 seconds. Anything else — an error, a redirect, no answer — is retried with growing waits for 24 hours; then the delivery is a dead letter, kept 7 days and sent again from Settings.
• Deliveries are at least once and in no particular order: skip an id you already handled.
• Requests also carry ZeeDo-Event-Id, ZeeDo-Event-Type and ZeeDo-Delivery-Id. Endpoints are https on port 443 at a public host name.
• Events: alert.fired, approval.decided, approval.requested, billing.service_state_changed, bot.state_changed, budget.threshold, connection.created, connection.error, consent.recorded, memory.note_created, policy.updated, run.cancelled, run.completed, run.failed, run.parked, task.completed and task.created.
• To check your endpoint, press Send a test in Settings → API & webhooks: one delivery of the type webhook.test with an empty data, signed like every other and sent whatever events you chose. At most one a minute.