API reference

The Zylar API is a REST API for leads, sequences, inboxes and stats, plus webhook subscriptions for events. It takes JSON in and returns JSON out. Use it to add leads from your own systems, pause and resume sequences, monitor inbox health and pull reporting into your dashboards.

Base URL

All endpoints are relative to:

https://api.zylar.io/v1

Authentication

Create an API key in Settings → API. Send it as a bearer token in the Authorization header on every request. Keys look like zy_live_....

Each key is scoped to one workspace. It can only access the leads, sequences, inboxes and stats in that workspace. If you manage several client workspaces, create a key in each. See Workspaces and roles.

cURL:

curl https://api.zylar.io/v1/sequences \
  -H "Authorization: Bearer zy_live_..."

Node.js (18+, built-in fetch):

const res = await fetch("https://api.zylar.io/v1/sequences", {
  headers: { Authorization: `Bearer ${process.env.ZYLAR_API_KEY}` },
});
const body = await res.json();

Python (requests):

import os
import requests

res = requests.get(
    "https://api.zylar.io/v1/sequences",
    headers={"Authorization": f"Bearer {os.environ['ZYLAR_API_KEY']}"},
)
body = res.json()

Keep keys out of source code and client-side apps. Store them in environment variables or a secrets manager.

Rate limits

The limit is 10 requests per second per key. Requests over the limit return 429 with a Retry-After header. Wait for the number of seconds in that header, then retry.

For bulk work, batch where the API allows it. For example, POST /leads accepts up to 1,000 leads in one request.

Errors

Errors use standard HTTP status codes and a JSON body.

A 404 can also mean the resource exists but belongs to a different workspace than your key.

Leads

List leads

GET /leads

Lists leads, newest first. Results are paginated with a cursor.

Request:

curl "https://api.zylar.io/v1/leads?status=interested&limit=25" \
  -H "Authorization: Bearer zy_live_..."

Response 200 OK:

{
  "data": [
    { "id": "ld_8f2k", "email": "jordan@example.com", "status": "interested" }
  ],
  "next_cursor": "c_91x"
}

To get the next page, pass next_cursor as cursor in your next request.

Add leads

POST /leads

Adds up to 1,000 leads to a sequence. Duplicates and blocklisted addresses are skipped and reported in the response.

Request:

curl -X POST https://api.zylar.io/v1/leads \
  -H "Authorization: Bearer zy_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "sequence_id": "sq_q4_agencies",
    "leads": [
      { "email": "dana@example.com", "first_name": "Dana", "company": "Example Co" }
    ]
  }'

Response 201 Created:

{ "added": 1, "skipped": [] }

Remove a lead

DELETE /leads/{id}

Removes a lead from all sequences. The lead's reply history is kept.

curl -X DELETE https://api.zylar.io/v1/leads/ld_8f2k \
  -H "Authorization: Bearer zy_live_..."

Sequences

List sequences

GET /sequences

Lists the sequences in the workspace with their status and step count.

curl https://api.zylar.io/v1/sequences \
  -H "Authorization: Bearer zy_live_..."

Pause or resume a sequence

PATCH /sequences/{id}

curl -X PATCH https://api.zylar.io/v1/sequences/sq_q4_agencies \
  -H "Authorization: Bearer zy_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "status": "paused" }'

Inboxes

List inboxes

GET /inboxes

Lists connected inboxes with:

curl https://api.zylar.io/v1/inboxes \
  -H "Authorization: Bearer zy_live_..."

See Monitoring and auto-pause for what each status means.

Stats

Get stats

GET /stats

Returns sends, replies, positive replies and meetings, grouped by sequence, step, variant or inbox.

curl "https://api.zylar.io/v1/stats?group_by=variant&from=2026-09-01&to=2026-09-30" \
  -H "Authorization: Bearer zy_live_..."

Webhooks

Create a subscription

POST /webhooks

Subscribes an HTTPS endpoint to one or more events.

curl -X POST https://api.zylar.io/v1/webhooks \
  -H "Authorization: Bearer zy_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://your-app.com/hooks/zylar",
    "events": ["reply.interested", "domain.paused"]
  }'

Response 201 Created:

{ "id": "wh_3n7", "secret": "whsec_..." }

Store the secret. You need it to verify the X-Zylar-Signature header on every delivery. Failed deliveries are retried 5 times over 24 hours. See Webhooks for event descriptions and signature verification code.

No-code alternative

The same events work in Zapier and Make, if you'd rather not write code. See Integrations.

Endpoint summary