Requests and answers

Addresses, formats and headers every endpoint shares.

Base URL

https://api.zilomail.in/v1

Format

JSON in and out (UTF-8). Send Content-Type: application/json with a body.

Dates

ISO 8601 in UTC (2026-10-17T09:30:00.000Z); calendar dates as YYYY-MM-DD.

Money

Strings with the currency's decimals: "1250.50", never floats. Invoices say their currency.

Ids

Opaque strings. Don't parse them.

Changes

PATCH changes only the fields you send.

Request id

Every answer has X-Request-Id (and errors a requestId): quote it when asking for help.

An answer#

HTTP

HTTP/1.1 200 OK
Content-Type: application/json; charset=utf-8
X-Request-Id: req_3kPq0d1nV2a8sLmG
X-RateLimit-Limit: 600
X-RateLimit-Remaining: 598
X-RateLimit-Reset: 42
ETag: W/"q1v0G4o0sT1nDkx2V9e4Lg"

{ "id": "…", "subject": "Order 1182 shipped", "read": true, … }

Lists#

Every list answers { "data": [...], "next": "…" }. See Pagination.

Files#

Downloads (attachments, ZiloDrive files) answer the file itself with its Content-Type. Uploads to ZiloDrive send the bytes as the body. Mail attachments go inside the JSON as base64.

Browsers#

Single-page apps registered at Your apps may call the API from their own address (CORS); tokens go in the header, never cookies.