Zapier API reference

Addresses and permissions

The API base URL is https://api.agentinosaurus.xyz/api/zapier. Requests and responses use JSON, except the token endpoint also accepts application/x-www-form-urlencoded. Responses containing account data are not cached.

The automations scope permits listing camera and Event names, requesting sample events, and managing this connection’s subscriptions. It cannot read footage, frames, camera credentials or OpenAI keys, change cameras, or manage billing. Active Business access or an explicitly granted automation entitlement is required for event data, new subscriptions and delivery.

OAuth authorization and tokens

Redirect the user to https://agentinosaurus.xyz/app/settings/integrations/authorize with response_type=code, client_id, redirect_uri, state, scope=automations, code_challenge and code_challenge_method=S256. The redirect URI must exactly match the registered Zapier callback. The user signs in and approves access; summaries are a separate optional permission. Cancellation returns error=access_denied and the original state.

POST /token exchanges the authorization code. Supply grant_type=authorization_code, client_id, client_secret, code, redirect_uri and code_verifier. Codes expire after five minutes and can be used once. Refresh with grant_type=refresh_token, client_id, client_secret and refresh_token.

Access tokens expire after 1,800 seconds. Connections and current refresh tokens have no inactivity expiry. Refresh tokens rotate on use. Retrying the previous token within 60 seconds returns the same successor pair; reuse outside that grace period can revoke the connection. Explicit disconnection and account security changes invalidate access. A billing pause blocks paid features but does not invalidate authentication.

{
  "access_token": "<access-token>",
  "refresh_token": "<refresh-token>",
  "token_type": "Bearer",
  "expires_in": 1800,
  "scope": "automations"
}

Connection and dropdown endpoints

Send Authorization: Bearer <access-token> on every endpoint below. GET /me returns id (the connection ID), account (the account email) and includeSummary (the consent flag). It remains available during a billing pause.

GET /cameras and GET /events return arrays of {id, name}. Pagination uses page=0, then 1, 2 and so on, with up to 100 entries per page; an empty array ends pagination. GET /events?cameraId=<id> returns only Events assigned to that owned camera. Omitting cameraId returns all owned Events.

Create, edit and remove subscriptions

POST /subscriptions accepts url, trigger, cameraId, eventId and includeSummary. url must be the HTTPS hooks.zapier.com/hooks/ address supplied by Zapier, without query parameters. trigger is new_incident, incident_resolved, monitoring_interrupted or monitoring_restored. Camera and Event filters default to empty strings (any); includeSummary defaults to false.

Event filters apply only to incident triggers. When both filters are supplied, the Event must be assigned to that camera. Summary delivery requires both connection consent and subscription opt-in. Up to 100 active subscriptions and 10 current connections are supported per account.

The response is {id: <subscription-id>}. Repeating the same active URL and filters returns its existing ID. Editing filters retires the old subscription and returns a new ID; queued deliveries for the old configuration are cancelled. Keep the returned ID for unsubscribe. A request already in flight may still arrive.

DELETE /subscriptions/<id> removes only a subscription owned by the authenticated connection and returns {ok: true}. It is idempotent and remains available during a billing pause. A delayed unsubscribe for an old ID cannot delete its replacement.

{
  "url": "https://hooks.zapier.com/hooks/standard/<id>/<secret>/",
  "trigger": "new_incident",
  "cameraId": "<camera-id>",
  "eventId": "<event-id>",
  "includeSummary": false
}

Samples and trigger semantics

GET /samples accepts trigger, cameraId, eventId and includeSummary as query parameters. It returns up to three matching recent Message-derived events, or a synthetic example with is_test=true when none are available. Sampling never queues a delivery. A synthetic example can still produce a real downstream action when used to test a Zap.

New Incident emits once per incident, excluding reminders. Incident Resolved emits once when subsequent observations cause the incident to be marked resolved, independently of the Event’s resolution Message setting. Resolved does not guarantee that the underlying situation is safe. Monitoring Interrupted and Monitoring Restored follow the monitoring interruption and recovery lifecycle.

Payload fields are id, type, camera_id, camera_name, event_id, event_name, incident_id, detected_at, summary, incident_url and is_test. IDs are stable per event and intended for deduplication. detected_at is an ISO 8601 timestamp for the transition. Incident and Event fields may be empty on monitoring events. summary is empty unless both permissions allow it. incident_url uses the connection’s selected language and requires sign-in.

{
  "id": "incident:example",
  "type": "new_incident",
  "camera_id": "camera-example",
  "camera_name": "Loading bay",
  "event_id": "event-example",
  "event_name": "Delivery arrives",
  "incident_id": "example",
  "detected_at": "2026-10-20T12:00:00.000Z",
  "summary": "",
  "incident_url": "https://agentinosaurus.xyz/en/app?incident=example",
  "is_test": false
}

Delivery, retries and diagnostics

Events are sent as HTTPS JSON POST requests to the subscription URL. Deliveries can arrive more than once or out of order. A 2xx response means Zapier accepted the event, not that its downstream actions completed. HTTP 408, 429, 5xx and transport failures retry with increasing delays, up to ten attempts. Other unsuccessful responses are permanent failures; HTTP 410 also disables the subscription.

Settings → Integrations shows connection problems, subscription state and recent deliveries. Connection health is checked periodically, including when cameras have no incidents. Unexpected security or billing interruptions generate an email; delivery failure warnings are grouped rather than sent for each attempt. Downgrades pause delivery, and skipped or cancelled events are not replayed after upgrading.

Errors and rate limits

Token errors use OAuth error codes: invalid_client (401), invalid_grant (400) and unsupported_grant_type (400). Other endpoints return {error: <message>}: 400 for invalid inputs, 401 for expired or invalid access, 403 for missing entitlement or consent, 404 for unavailable owned resources, 413 for oversized request bodies and 429 for rate limits. A 401 should trigger one token refresh and retry.

Authenticated Zapier requests are limited to 600 per minute per owner. Network-level protection also limits token exchanges to 60 per minute and other Zapier requests to 3,000 per minute per incoming address. A 429 includes Retry-After; wait that many seconds before retrying. Keep client secrets and tokens server-side and never include them in support logs.