API reference

Every endpoint an integrator can call: the Data API (/api/v1/…, company API key) and the signed inbound webhook (/hooks/…). The pages are generated from the product’s OpenAPI schema (version 0.1.0), so paths, fields, types and limits match the running API.

Base URL: your console address, e.g. https://<your-console-host>. In the examples it is $RZ_API, and the key is $RZ_KEY.

export RZ_API="https://<your-console-host>"
export RZ_KEY="rz_live_xxx"

Endpoints

Method	Path	Scope
GET	/api/v1/me	—
PUT	/api/v1/catalog/products	ingest:catalog
DELETE	/api/v1/catalog/products/{item_ref}	ingest:catalog
PUT	/api/v1/catalog/categories	ingest:catalog
DELETE	/api/v1/catalog/categories/{kategori_id}	ingest:catalog
PUT	/api/v1/kb/articles	ingest:kb
PUT	/api/v1/orders	ingest:orders
GET	/api/v1/requests	read:requests
PUT	/api/v1/sepetler	ingest:carts
GET	/api/v1/sepetler	read:carts
DELETE	/api/v1/sepetler/{dis_id}	ingest:carts
PUT	/api/v1/musteriler	ingest:customers
DELETE	/api/v1/musteriler/{dis_id}	ingest:customers
GET	/api/v1/cagrilar	calls:read
GET	/api/v1/cagrilar/{call_id}	calls:read
GET	/api/v1/konular/istatistik	calls:read
POST	/api/v1/aramalar	calls:write
GET	/api/v1/aramalar/{arama_id}	calls:read or calls:write
GET	/api/v1/amaclar	calls:write
POST	/api/v1/buton-token	calls:write
PUT	/api/v1/uyumluluk	ingest:catalog
PUT	/api/v1/servis-kayitlari/{kayit}/durum	servis:write
POST	/api/v1/servis-kayitlari/{kayit}/onay	servis:write
GET	/api/v1/firsatlar	firsat:read
GET	/api/v1/firsatlar/{lead_id}	firsat:read
GET	/api/v1/raporlar/cagri-kayitlari	rapor:read
GET	/api/v1/raporlar/{rapor}/gunluk	rapor:read
POST	/api/v1/sohbet-token	sohbet:write
POST	/hooks/{org_slug}/{source}	HMAC signature

The browser endpoints of the embeddable button (GET /api/v1/buton/amaclar, POST /api/v1/buton/aramalar, GET /api/v1/zitena-buton.js) are not in the OpenAPI schema; they are called by the script itself and are described on the button page.

What is not included

An endpoint is included only if it authenticates with a company API key (the FirmaApiAnahtari security scheme) or with a webhook signature. Everything else is left out:

Group	Operations
infrastructure health check	1
console session endpoints (cookie auth), used by the web console only	378
platform operator (super admin) endpoints	86
public endpoints for the marketing site and console chrome	9

Console features (settings, webhooks, API keys, calls in the UI) are documented as console guides rather than as API endpoints, because they need a signed-in console session and are not a stable integration contract.

The machine-readable schema is published with these docs: /openapi/public.json.