API and MCP

Everything you do in Zeebra can also be done from code with the REST API, or by an AI agent over MCP (the Model Context Protocol). Both run the same operations, with the same checks and limits as the app. The API reference lists every operation.

API keys

Workspace owners and admins create keys in Settings → API. A workspace can have up to 20. A key is shown once, when you create it: store it somewhere safe. There are two kinds:

• Full access: everything in the API reference. Keep it on your server.
• Signups only: can only add signups (add_signup), so it is safe in website or app code.

Revoke a key you no longer use; anything using it stops working at once. The API page shows when each key was last used.

The REST API

Send the key as a bearer token:

curl https://zeebra.ai/api/v1/overview \
  -H "Authorization: Bearer YOUR_KEY"

• Requests and answers are JSON. Results are in data; lists that come in pages also have meta (page, per_page, total, last_page). Ask for a page with ?page=2&per_page=50.
• Contacts can be filtered and sorted on any property, custom ones too (as field:<key>): /api/v1/contacts?filter[status]=active&filter[tag]=VIP&filter[field:plan]=is:Pro&sort=-created_at. A filter's value is operator:value (contains:acme, gte:10, between:1,5, in_period:last_30_days, is_set:) or just a value. For AND/OR, send a rule tree in where, like a segment's. get_segment_fields lists the fields and operators; export_contacts takes the same filters.
• Errors answer {"error": {"code": "…", "message": "…"}} with a matching status: unauthorized (401), subscription_required (402, the workspace needs a plan: sending, test emails, imports, exports, domains, new keys, webhooks and signups wait for one), forbidden (403), not_found (404), conflict (409, the campaign's state doesn't allow it), validation_failed (422, with fields), rate_limited (429, with Retry-After), upstream_error (502, Amazon SES or DNS).
• Each key can make up to 300 requests a minute.
• The OpenAPI document describes every operation for code generators and API tools.

Sending safely

Sending can't be undone, so sending takes two steps:

1. review_campaign returns the checks and audience.recipients, the number of people it will go to. checks lists every check with its id, level (block or warning), whether it passed, and what to fix.
2. send_campaign (or schedule_campaign) takes that number as confirm_recipients. If the audience changed in between, it is refused and you review again.

A campaign's publish_to says where it goes: email (the default), both (email, and your public pages once it goes out) or web (the public pages only). A web-only campaign sends no email, so its review has only the content checks and you send it with confirm_recipients set to 0.

AI agents over MCP

The MCP server is at https://zeebra.ai/mcp. Every API operation is a tool there; the ones that send or delete are marked as destructive, so agents ask you before using them.

With an app that supports OAuth (Claude, ChatGPT): add Zeebra as a connector with the MCP address. You sign in to Zeebra, choose which workspace the app may use (one you own or manage), and approve. Connected apps are listed in Settings → API, where you can disconnect them.

With an API key (Claude Code, Cursor, Codex and other tools): give the MCP address and an Authorization: Bearer YOUR_KEY header. For example, in Claude Code:

claude mcp add --transport http zeebra https://zeebra.ai/mcp \
  --header "Authorization: Bearer YOUR_KEY"

Webhooks and the command line

Webhooks send your server a signed request when contacts change and emails are delivered, opened, clicked, bounce or are marked as spam. The zeebra CLI runs every operation from a terminal or an AI agent's shell.

For AI tools reading the docs

llms.txt lists these docs for language models, and llms-full.txt has all of them, including the full API reference, in one file.