notifications
POST /v1/webhooks/demo-budget
A hands-on demo site reports that one of its AI budgets ran out.
Authentication
This endpoint is public. It takes no credential and no organisation — it is what our own marketing site and AI answer engines read.
This endpoint takes no organisation id. Your key already identifies the organisation it belongs to, and the response is scoped to it.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X POST https://api.zinndigital.com/v1/webhooks/demo-budget \
-H "Content-Type: application/json" \
-d '{ "demo": <string<tranzly, chat, pbs, seo>>, "limit": <string<day_count, day_usd, month_usd, month_requests, day_calls, visitor_month_usd, ops_day_usd, ops_day_calls>>, "period": <string>, "spent": <number>, "cap": <number> }'Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
Unauthenticated by design — the caller is one of our own hands-on demo WordPress sites (demo.tranzly.io, demo.zinnchat.com, demo.pagebuildersandwich.com, demo.zinnseo.com), which holds no Zinn® credential, so an HMAC over "<timestamp>\n<body>" in X-Zinn-Signature (its own secret) is the authentication; the timestamp is inside the signed material and skew-bounded to five minutes. Files ONE demo.budget_exhausted event per (demo, limit, period) — the event id is derived from those three — which e-mails the owner which demo, which limit, the spend, and step by step how to raise it. A repeat report answers 200 with duplicate: true and sends nothing. ⛔ The demo sends enumerated keys and numbers only; every word of the e-mail is the platform's own.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
X-Zinn-Timestamp (header) | string | Yes | Unix seconds. Inside the signed material; skew-bounded to five minutes. |
X-Zinn-Signature (header) | string | Yes | sha256=<hex> HMAC over "<timestamp>\n<body>". |
Request body
| Name | Type | Required | What it is |
|---|---|---|---|
demo | string<tranzly, chat, pbs, seo> | Yes | Which hands-on demo: tranzly (demo.tranzly.io), chat (demo.zinnchat.com), pbs (demo.pagebuildersandwich.com) or seo (demo.zinnseo.com). Visitors spend no AI on pbs and… |
limit | string<day_count, day_usd, month_usd, month_requests, day_calls, visitor_month_usd, ops_day_usd, ops_day_calls> | Yes | Which budget ran out. Not every demo has every limit (a pair the platform does not know answers 422): day_count, day_usd and day_calls are the visitors' daily budgets on… |
period | string | Yes | YYYY-MM-DD for a day_* limit, YYYY-MM for a month_* limit (UTC). |
spent | number | Yes | — |
cap | number | Yes | — |
count | integer | No | Visitor actions today, for the e-mail. |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
event_id | string | Yes | — |
duplicate | boolean | Yes | This budget was already reported for this period — nothing more was sent. |
Errors this endpoint can return
400 · 422 · 503