Company

Company profile, RERA & GST, branding, business hours & holidays and the security policy.

GET/v1/company

Company profile

Profile, registrations, locale and branding of the caller’s company. Needs `settings.company` or `settings.view`.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.company or settings.view.

Response · 200

datarequired: CompanyProfile
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/company' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "name": "string",
    "slug": "string",
    "type": "broker",
    "status": "trial",
    "legal_name": "string",
    "address": "string",
    "city": "string",
    "state": "string",
    "pincode": "string",
    "phone": "string",
    "email": "string",
    "website": "string",
    "gstin": "string",
    "pan": "string",
    "rera_numbers": [
      {
        "state": "AN",
        "number": null,
        "kind": "agent"
      }
    ],
    "timezone": "Asia/Kolkata",
    "locale": "string",
    "currency": "string",
    "financial_year_start": 1,
    "brand_color": "string",
    "logo_url": "string",
    "wordmark_url": "string",
    "updated_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

PATCH/v1/company

Update the company profile

Profile fields, GSTIN, PAN, RERA registrations, time zone, locale and financial-year start. A GSTIN must carry the company’s PAN. Status, slug and company type are platform-only.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.company.

Request body

name: string
legal_name: string or null
address: string or null
city: string or null
state: "AN" | "AP" | "AR" | "AS" | "BR" | "CH" | … or null
pincode: string or null
phone: string or null
Any format; stored as E.164.
email: string (email) or null
website: string or null
gstin: string or null
pan: string or null
rera_numbers: array of CompanyReraRegistrationInput
timezone: string
IANA time zone, e.g. Asia/Kolkata.
locale: "en-IN" | "hi-IN"
financial_year_start: integer

Response · 200

datarequired: CompanyProfile
metarequired: object

Request

curl -X PATCH 'https://api.propzolo.com/v1/company' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"name":"string","legal_name":"string","address":"string","city":"string","state":"AN","pincode":"string","phone":"string","email":"name@example.com","website":"string","gstin":"string","pan":"string","rera_numbers":[{"state":"AN","number":"string","kind":"agent"}],"timezone":"Asia/Kolkata","locale":"en-IN","financial_year_start":1}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "name": "string",
    "slug": "string",
    "type": "broker",
    "status": "trial",
    "legal_name": "string",
    "address": "string",
    "city": "string",
    "state": "string",
    "pincode": "string",
    "phone": "string",
    "email": "string",
    "website": "string",
    "gstin": "string",
    "pan": "string",
    "rera_numbers": [
      {
        "state": "AN",
        "number": null,
        "kind": "agent"
      }
    ],
    "timezone": "Asia/Kolkata",
    "locale": "string",
    "currency": "string",
    "financial_year_start": 1,
    "brand_color": "string",
    "logo_url": "string",
    "wordmark_url": "string",
    "updated_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

PATCH/v1/company/branding

Set the brand colour

One brand colour drives buttons, links and the focus ring for everyone in the workspace; null resets it.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.company.

Request body

brand_colorrequired: string or null

Response · 200

datarequired: CompanyProfile
metarequired: object

Request

curl -X PATCH 'https://api.propzolo.com/v1/company/branding' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"brand_color":"string"}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "name": "string",
    "slug": "string",
    "type": "broker",
    "status": "trial",
    "legal_name": "string",
    "address": "string",
    "city": "string",
    "state": "string",
    "pincode": "string",
    "phone": "string",
    "email": "string",
    "website": "string",
    "gstin": "string",
    "pan": "string",
    "rera_numbers": [
      {
        "state": "AN",
        "number": null,
        "kind": "agent"
      }
    ],
    "timezone": "Asia/Kolkata",
    "locale": "string",
    "currency": "string",
    "financial_year_start": 1,
    "brand_color": "string",
    "logo_url": "string",
    "wordmark_url": "string",
    "updated_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/company/branding/{asset}

Start a logo or wordmark upload

Returns a presigned URL for a private upload. After the PUT, attach the key with PUT on the same path: the image is checked, stripped of metadata (EXIF/GPS) and published.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.company.

Parameters

assetpathrequired: "logo" | "wordmark" | "favicon" | "app_icon"

Request body

filenamerequired: string
content_typerequired: "image/png" | "image/jpeg" | "image/webp"
sizerequired: integer

Response · 201

datarequired: ImageUploadTicket
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/company/branding/{asset}' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"filename":"string","content_type":"image/png","size":1}'

Response example

{
  "data": {
    "key": "string",
    "url": "string",
    "method": "PUT",
    "headers": {},
    "expires_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

PUT/v1/company/branding/{asset}

Publish an uploaded logo or wordmark

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.company.

Parameters

assetpathrequired: "logo" | "wordmark" | "favicon" | "app_icon"

Request body

keyrequired: string

Response · 200

datarequired: CompanyProfile
metarequired: object

Request

curl -X PUT 'https://api.propzolo.com/v1/company/branding/{asset}' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"key":"string"}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "name": "string",
    "slug": "string",
    "type": "broker",
    "status": "trial",
    "legal_name": "string",
    "address": "string",
    "city": "string",
    "state": "string",
    "pincode": "string",
    "phone": "string",
    "email": "string",
    "website": "string",
    "gstin": "string",
    "pan": "string",
    "rera_numbers": [
      {
        "state": "AN",
        "number": null,
        "kind": "agent"
      }
    ],
    "timezone": "Asia/Kolkata",
    "locale": "string",
    "currency": "string",
    "financial_year_start": 1,
    "brand_color": "string",
    "logo_url": "string",
    "wordmark_url": "string",
    "updated_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

DELETE/v1/company/branding/{asset}

Remove the logo or wordmark

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.company.

Parameters

assetpathrequired: "logo" | "wordmark" | "favicon" | "app_icon"

Response · 200

datarequired: CompanyProfile
metarequired: object

Request

curl -X DELETE 'https://api.propzolo.com/v1/company/branding/{asset}' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "name": "string",
    "slug": "string",
    "type": "broker",
    "status": "trial",
    "legal_name": "string",
    "address": "string",
    "city": "string",
    "state": "string",
    "pincode": "string",
    "phone": "string",
    "email": "string",
    "website": "string",
    "gstin": "string",
    "pan": "string",
    "rera_numbers": [
      {
        "state": "AN",
        "number": null,
        "kind": "agent"
      }
    ],
    "timezone": "Asia/Kolkata",
    "locale": "string",
    "currency": "string",
    "financial_year_start": 1,
    "brand_color": "string",
    "logo_url": "string",
    "wordmark_url": "string",
    "updated_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/company/business-hours

Business hours and holidays

The working week and the holiday calendar on the company clock — the business-hours SLAs, routing shifts and automation delays count only this time.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.company or settings.view.

Response · 200

datarequired: BusinessHours
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/company/business-hours' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "timezone": "Asia/Kolkata",
    "weekly": [
      {
        "day": 1,
        "open": true,
        "start": "string",
        "end": "string"
      }
    ],
    "holidays": [
      {
        "date": "2026-10-06",
        "name": "string"
      }
    ],
    "source": "company",
    "updated_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

PUT/v1/company/business-hours

Replace business hours and holidays

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.company.

Request body

weeklyrequired: array of object
weekly[].dayrequired: integer
weekly[].openrequired: boolean
weekly[].startrequired: string
weekly[].endrequired: string
holidaysrequired: array of HolidayInput

Response · 200

datarequired: BusinessHours
metarequired: object

Request

curl -X PUT 'https://api.propzolo.com/v1/company/business-hours' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"weekly":[{"day":1,"open":true,"start":"string","end":"string"}],"holidays":[{"date":"2026-10-06","name":"string"}]}'

Response example

{
  "data": {
    "timezone": "Asia/Kolkata",
    "weekly": [
      {
        "day": 1,
        "open": true,
        "start": "string",
        "end": "string"
      }
    ],
    "holidays": [
      {
        "date": "2026-10-06",
        "name": "string"
      }
    ],
    "source": "company",
    "updated_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/company/security

Security policy

Which roles must use two-step verification, the session lifetimes and the IP allow-list status.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.security or settings.view.

Response · 200

datarequired: SecurityPolicy
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/company/security' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "two_factor": {
      "roles": [
        {
          "id": "cmusrceel0000q7kaafxqi1om",
          "key": "string",
          "name": "string",
          "audience": "staff",
          "requires_two_factor": true,
          "locked": true,
          "members": 0,
          "members_without_two_factor": 0
        }
      ]
    },
    "sessions": {
      "web_idle_days": 0,
      "web_absolute_days": 0,
      "mobile_idle_days": 0
    },
    "ip_allowlist": {
      "available": true,
      "task": "string"
    }
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

PUT/v1/company/security

Require two-step verification by role

Members of these roles who have not set up an authenticator are asked to on their next request. Owner and Admin stay required.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.security.

Request body

two_factor_role_idsrequired: array of Id
Every role that must use two-step verification (Owner and Admin are always included).

Response · 200

datarequired: SecurityPolicy
metarequired: object

Request

curl -X PUT 'https://api.propzolo.com/v1/company/security' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"two_factor_role_ids":["cmusrceel0000q7kaafxqi1om"]}'

Response example

{
  "data": {
    "two_factor": {
      "roles": [
        {
          "id": "cmusrceel0000q7kaafxqi1om",
          "key": "string",
          "name": "string",
          "audience": "staff",
          "requires_two_factor": true,
          "locked": true,
          "members": 0,
          "members_without_two_factor": 0
        }
      ]
    },
    "sessions": {
      "web_idle_days": 0,
      "web_absolute_days": 0,
      "mobile_idle_days": 0
    },
    "ip_allowlist": {
      "available": true,
      "task": "string"
    }
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/settings/company-rules

Business rules

The company’s on/off business rules and the legally required gates that always apply.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.company or settings.view.

Response · 200

datarequired: object
data.rulesrequired: array of object
data.rules[].keyrequired: string
data.rules[].modulerequired: string
data.rules[].labelrequired: string
data.rules[].descriptionrequired: string
data.rules[].defaultrequired: boolean
data.rules[].onrequired: boolean
data.legal_gatesrequired: array of object
data.legal_gates[].keyrequired: string
data.legal_gates[].labelrequired: string
data.legal_gates[].descriptionrequired: string
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/settings/company-rules' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "rules": [
      {
        "key": "string",
        "module": "string",
        "label": "string",
        "description": "string",
        "default": true,
        "on": true
      }
    ],
    "legal_gates": [
      {
        "key": "string",
        "label": "string",
        "description": "string"
      }
    ]
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

PATCH/v1/settings/company-rules

Switch business rules on or off

A map of rule keys to on/off. Unknown keys (and the legal gates) are refused.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.company.

Request body

No fields.

Response · 200

datarequired: object
data.rulesrequired: array of object
data.rules[].keyrequired: string
data.rules[].modulerequired: string
data.rules[].labelrequired: string
data.rules[].descriptionrequired: string
data.rules[].defaultrequired: boolean
data.rules[].onrequired: boolean
data.legal_gatesrequired: array of object
data.legal_gates[].keyrequired: string
data.legal_gates[].labelrequired: string
data.legal_gates[].descriptionrequired: string
metarequired: object

Request

curl -X PATCH 'https://api.propzolo.com/v1/settings/company-rules' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{}'

Response example

{
  "data": {
    "rules": [
      {
        "key": "string",
        "module": "string",
        "label": "string",
        "description": "string",
        "default": true,
        "on": true
      }
    ],
    "legal_gates": [
      {
        "key": "string",
        "label": "string",
        "description": "string"
      }
    ]
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

{ "data": { "id": "cmusrceel0000q7kaafxqi1om", "name": "string", "slug": "string", "type": "broker", "status": "trial", "legal_name": "string", "address": "string", "city": "string", "state": "string", "pincode": "string", "phone": "string", "email": "string", "website": "string", "gstin": "string", "pan": "string", "rera_numbers": [ { "state": "AN", "number": null, "kind": "agent" } ], "timezone": "Asia/Kolkata", "locale": "string", "currency": "string", "financial_year_start": 1, "brand_color": "string", "logo_url": "string", "wordmark_url": "string", "updated_at": "2026-10-06T05:30:00.000Z" }, "meta": {} }

curl -X PATCH 'https://api.propzolo.com/v1/company' \ -H 'Authorization: Bearer pz_live_…' \ -H 'Content-Type: application/json' \ -d '{"name":"string","legal_name":"string","address":"string","city":"string","state":"AN","pincode":"string","phone":"string","email":"name@example.com","website":"string","gstin":"string","pan":"string","rera_numbers":[{"state":"AN","number":"string","kind":"agent"}],"timezone":"Asia/Kolkata","locale":"en-IN","financial_year_start":1}'

curl -X POST 'https://api.propzolo.com/v1/company/branding/{asset}' \ -H 'Authorization: Bearer pz_live_…' \ -H 'Content-Type: application/json' \ -d '{"filename":"string","content_type":"image/png","size":1}'

{ "data": { "timezone": "Asia/Kolkata", "weekly": [ { "day": 1, "open": true, "start": "string", "end": "string" } ], "holidays": [ { "date": "2026-10-06", "name": "string" } ], "source": "company", "updated_at": "2026-10-06T05:30:00.000Z" }, "meta": {} }

curl -X PUT 'https://api.propzolo.com/v1/company/business-hours' \ -H 'Authorization: Bearer pz_live_…' \ -H 'Content-Type: application/json' \ -d '{"weekly":[{"day":1,"open":true,"start":"string","end":"string"}],"holidays":[{"date":"2026-10-06","name":"string"}]}'

{ "data": { "two_factor": { "roles": [ { "id": "cmusrceel0000q7kaafxqi1om", "key": "string", "name": "string", "audience": "staff", "requires_two_factor": true, "locked": true, "members": 0, "members_without_two_factor": 0 } ] }, "sessions": { "web_idle_days": 0, "web_absolute_days": 0, "mobile_idle_days": 0 }, "ip_allowlist": { "available": true, "task": "string" } }, "meta": {} }

curl -X PUT 'https://api.propzolo.com/v1/company/security' \ -H 'Authorization: Bearer pz_live_…' \ -H 'Content-Type: application/json' \ -d '{"two_factor_role_ids":["cmusrceel0000q7kaafxqi1om"]}'

{ "data": { "rules": [ { "key": "string", "module": "string", "label": "string", "description": "string", "default": true, "on": true } ], "legal_gates": [ { "key": "string", "label": "string", "description": "string" } ] }, "meta": {} }