reseller
POST /v1/reseller/brand/menu
Add a link to your clients' panel.
Authentication
Send an API key as a bearer token. The key must carry the reseller.manage permission; a key without it is refused with 403, not 404.
Where your organisation id goes
This endpoint takes org_id as a query parameter. Leave it out and the call covers your whole tenancy subtree; send it to narrow the call to one organisation.
Your organisation id is on the API keys screen in your dashboard, beside the key itself. It is the same id in every call you make.
Try it
Replace anything in angle brackets with your own values, and the key placeholder with a key from your dashboard.
curl -X POST https://api.zinndigital.com/v1/reseller/brand/menu \
-H "Authorization: Bearer zdk_live_…" \
-H "Content-Type: application/json" \
-d '{ "label": <string>, "url": <string> }'Signed in? The API console in your dashboard fills in your real organisation id and your own key, and runs the request against the live API so you can see the actual response. Open this endpoint in the API console
Details
Adds one navigation link. Requires reseller.manage and the white_label entitlement. ⛔ url accepts https://, http:// or a same-origin path beginning /, and nothing else. Your clients click these from inside an authenticated panel on your hostname, so a javascript: link would run in the origin holding their session — the allow-list is what makes that unrepresentable rather than merely filtered. ⛔ Over the limit is a 422 naming the limit, never a silent truncation at read time: a ninth link that simply never appears is a defect nobody can report.
Parameters
| Name | Type | Required | What it is |
|---|---|---|---|
org_id (query) | Uuid | No | The organization this call acts on. Optional for a caller with exactly one direct membership; required for anyone with more than one — which is every reseller and every agency… |
Request body
| Name | Type | Required | What it is |
|---|---|---|---|
label | string | Yes | — |
url | string | Yes | — |
icon | string | No | — |
position | integer | No | — |
new_tab | boolean | No | — |
visibility | string<both, client, staff> | No | — |
Response
| Name | Type | Required | What it is |
|---|---|---|---|
id | string | Yes | — |
label | string | Yes | — |
url | string | Yes | — |
icon | string | Yes | A design-system icon name from icons, or "" for a label-only item. |
position | integer | Yes | Sort key. Ties break on the label, so the order is total and stable. |
new_tab | boolean | Yes | Renders target="_blank". The panel pairs it with rel="noopener noreferrer" unconditionally — that is set on every external item, not only the new-tab ones, because… |
visibility | string<both, client, staff> | Yes | Who sees it. Filtered server-side on GET /v1/branding: a payload carrying a staff-only link that the app hides has already disclosed it to anybody with a network tab, which… |
external | boolean | Yes | Whether the link leaves the panel. Computed here so every renderer agrees. |
Errors this endpoint can return
401 · 403 · 422