Team

Members, invitations, roles and the permission matrix, teams, branches and API keys (Settings → Team).

GET/v1/api-keys

API keys

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.integrations.

Response · 200

datarequired: array of ApiKey
metarequired: object
meta.allowedrequired: boolean
The plan includes the API (Growth and above).

Request

curl -X GET 'https://api.propzolo.com/v1/api-keys' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string",
      "prefix": "string",
      "scopes": [
        "string"
      ],
      "created_by": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "status": "active",
      "last_used_at": "2026-10-06T05:30:00.000Z",
      "expires_at": "2026-10-06T05:30:00.000Z",
      "revoked_at": "2026-10-06T05:30:00.000Z",
      "created_at": "2026-10-06T05:30:00.000Z"
    }
  ],
  "meta": {
    "allowed": true
  }
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/api-keys

A key acts as you, limited to its scopes, and stops working if you are deactivated. The key is shown once. It expires after 90 days unless you pick another date (or, flagged in the audit log, never); you are reminded 7 days before. Owners and admins confirm their authenticator code first (step-up).

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.integrations.

Request body

namerequired: string
scopesrequired: array of string
expires_at: DateTime or null
When the key stops working (within two years); unset → 90 days from now.
never_expires: boolean
A key that never expires — allowed, but flagged in the audit log. Not with expires_at.

Response · 201

datarequired: ApiKeyCreated
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/api-keys' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"name":"string","scopes":["string"],"expires_at":"2026-10-06T05:30:00.000Z","never_expires":true}'

Response example

{
  "data": {
    "api_key": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string",
      "prefix": "string",
      "scopes": [
        "string"
      ],
      "created_by": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "status": "active",
      "last_used_at": "2026-10-06T05:30:00.000Z",
      "expires_at": "2026-10-06T05:30:00.000Z",
      "revoked_at": "2026-10-06T05:30:00.000Z",
      "created_at": "2026-10-06T05:30:00.000Z"
    },
    "key": "string"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

DELETE/v1/api-keys/{id}

Revoke an API key

The next request with the key is refused.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.integrations.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: object
data.idrequired: Id
Opaque record id.
data.revokedrequired: true
metarequired: object

Request

curl -X DELETE 'https://api.propzolo.com/v1/api-keys/{id}' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "revoked": true
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/branches

Branches

Offices with address, registrations and member counts. Needs `settings.company`, `settings.users` or `settings.view`.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.company or settings.users or settings.view.

Response · 200

datarequired: array of Branch
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/branches' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string",
      "city": "string",
      "address": "string",
      "phone": "string",
      "rera_number": "string",
      "gstin": "string",
      "latitude": 0,
      "longitude": 0,
      "geofence_m": 0,
      "business_hours": {
        "weekly": [
          {
            "day": 1,
            "open": true,
            "start": "string",
            "end": "string"
          }
        ],
        "holidays": [
          {
            "date": "2026-10-06",
            "name": "string"
          }
        ]
      },
      "is_active": true,
      "members": 0,
      "created_at": "2026-10-06T05:30:00.000Z",
      "updated_at": "2026-10-06T05:30:00.000Z"
    }
  ],
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/branches

Add a branch

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.company.

Request body

namerequired: string
city: string or null
address: string or null
phone: string or null
rera_number: string or null
gstin: string or null
For a branch registered in another state.
latitude: number or null
longitude: number or null
geofence_m: integer or null
business_hours: BusinessHoursInput or null
is_active: boolean

Response · 201

datarequired: Branch
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/branches' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"name":"string","city":"string","address":"string","phone":"string","rera_number":"string","gstin":"string","latitude":0,"longitude":0,"geofence_m":20,"business_hours":{"weekly":[{"day":1,"open":true,"start":"string","end":"string"}],"holidays":[{"date":"2026-10-06","name":"string"}]},"is_active":true}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "name": "string",
    "city": "string",
    "address": "string",
    "phone": "string",
    "rera_number": "string",
    "gstin": "string",
    "latitude": 0,
    "longitude": 0,
    "geofence_m": 0,
    "business_hours": {
      "weekly": [
        {
          "day": 1,
          "open": true,
          "start": "string",
          "end": "string"
        }
      ],
      "holidays": [
        {
          "date": "2026-10-06",
          "name": "string"
        }
      ]
    },
    "is_active": true,
    "members": 0,
    "created_at": "2026-10-06T05:30:00.000Z",
    "updated_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

PATCH/v1/branches/{id}

Edit a branch

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.company.

Parameters

idpathrequired: Id
Opaque record id.

Request body

name: string
city: string or null
address: string or null
phone: string or null
rera_number: string or null
gstin: string or null
For a branch registered in another state.
latitude: number or null
longitude: number or null
geofence_m: integer or null
business_hours: BusinessHoursInputInput or null
is_active: boolean

Response · 200

datarequired: Branch
metarequired: object

Request

curl -X PATCH 'https://api.propzolo.com/v1/branches/{id}' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"name":"string","city":"string","address":"string","phone":"string","rera_number":"string","gstin":"string","latitude":0,"longitude":0,"geofence_m":20,"business_hours":{"weekly":[{"day":1,"open":true,"start":"string","end":"string"}],"holidays":[{"date":"2026-10-06","name":"string"}]},"is_active":true}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "name": "string",
    "city": "string",
    "address": "string",
    "phone": "string",
    "rera_number": "string",
    "gstin": "string",
    "latitude": 0,
    "longitude": 0,
    "geofence_m": 0,
    "business_hours": {
      "weekly": [
        {
          "day": 1,
          "open": true,
          "start": "string",
          "end": "string"
        }
      ],
      "holidays": [
        {
          "date": "2026-10-06",
          "name": "string"
        }
      ]
    },
    "is_active": true,
    "members": 0,
    "created_at": "2026-10-06T05:30:00.000Z",
    "updated_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

DELETE/v1/branches/{id}

Remove a branch

Only once no active member belongs to it; records keep their history.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.company.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: object
data.idrequired: Id
Opaque record id.
data.deletedrequired: true
metarequired: object

Request

curl -X DELETE 'https://api.propzolo.com/v1/branches/{id}' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "deleted": true
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/invitations

Pending invitations

Invitations not yet accepted, newest first; expired ones are flagged so they can be sent again.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.users or settings.view.

Response · 200

datarequired: array of Invitation
metarequired: object
meta.seatsrequired: SeatUsage

Request

curl -X GET 'https://api.propzolo.com/v1/invitations' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "id": "cmusrceel0000q7kaafxqi1om",
      "email": "string",
      "phone": "string",
      "role": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "branch": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "reports_to": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "invited_by": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "expires_at": "2026-10-06T05:30:00.000Z",
      "created_at": "2026-10-06T05:30:00.000Z",
      "expired": true
    }
  ],
  "meta": {
    "seats": {
      "used": 0,
      "pending_invitations": 0,
      "limit": 0,
      "available": 0,
      "plan": {
        "code": "string",
        "name": "string"
      },
      "status": "trialing"
    }
  }
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/invitations

Invite someone

Invite by mobile number or email with a role (never one with more access than yours), branch and manager. Replaces an earlier pending invitation for the same person. Needs a free seat.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.users.

Request body

email: string or null
phone: string or null
Any format; NRI numbers keep their code.
role_idrequired: Id
Opaque record id.
branch_id: Id or null
Opaque record id.
reports_to_id: Id or null
Opaque record id.

Response · 201

datarequired: InvitationCreated
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/invitations' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"email":"string","phone":"string","role_id":"cmusrceel0000q7kaafxqi1om","branch_id":"cmusrceel0000q7kaafxqi1om","reports_to_id":"cmusrceel0000q7kaafxqi1om"}'

Response example

{
  "data": {
    "invitation": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "email": "string",
      "phone": "string",
      "role": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "branch": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "reports_to": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "invited_by": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "expires_at": "2026-10-06T05:30:00.000Z",
      "created_at": "2026-10-06T05:30:00.000Z",
      "expired": true
    },
    "url": "string",
    "share": {
      "message": "string",
      "whatsapp_url": "string",
      "email_url": "string"
    }
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

DELETE/v1/invitations/{id}

Withdraw an invitation

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.users.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: object
data.idrequired: Id
Opaque record id.
data.revokedrequired: true
metarequired: object

Request

curl -X DELETE 'https://api.propzolo.com/v1/invitations/{id}' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "revoked": true
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/invitations/{id}/resend

Send an invitation again

Issues a fresh link valid for another 7 days; the old link stops working.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.users.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: InvitationCreated
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/invitations/{id}/resend' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "invitation": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "email": "string",
      "phone": "string",
      "role": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "branch": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "reports_to": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "invited_by": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "expires_at": "2026-10-06T05:30:00.000Z",
      "created_at": "2026-10-06T05:30:00.000Z",
      "expired": true
    },
    "url": "string",
    "share": {
      "message": "string",
      "whatsapp_url": "string",
      "email_url": "string"
    }
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/members

Team members

Everyone in the workspace with role, branch, manager, status, 2FA and devices, plus seat usage. Needs `settings.users`, `settings.company` or `settings.view`.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.users or settings.company or settings.view.

Parameters

statusquery: "active" | "inactive" | "all"
qquery: string

Response · 200

datarequired: array of Member
metarequired: object
meta.seatsrequired: SeatUsage
meta.countsrequired: object
meta.counts.activerequired: integer
meta.counts.inactiverequired: integer

Request

curl -X GET 'https://api.propzolo.com/v1/members' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "id": "cmusrceel0000q7kaafxqi1om",
      "user_id": "cmusrceel0000q7kaafxqi1om",
      "name": "string",
      "email": "string",
      "phone": "+919812345678",
      "image_url": "string",
      "two_factor_enabled": true,
      "role": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "key": "string",
        "name": "string",
        "is_owner": true,
        "requires_two_factor": true
      },
      "branch": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "reports_to": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "teams": [
        {
          "id": "cmusrceel0000q7kaafxqi1om",
          "name": "string"
        }
      ],
      "status": "invited",
      "designation": "string",
      "employee_code": "string",
      "languages": [
        "string"
      ],
      "specializations": [
        "string"
      ],
      "service_locality_ids": [
        "string"
      ],
      "lead_capacity": 0,
      "shift": {
        "days": [
          1
        ],
        "start": "string",
        "end": "string"
      },
      "call_tracking_enabled": true,
      "devices": 0,
      "joined_at": "2026-10-06T05:30:00.000Z",
      "last_active_at": "2026-10-06T05:30:00.000Z",
      "deactivated_at": "2026-10-06T05:30:00.000Z",
      "created_at": "2026-10-06T05:30:00.000Z",
      "is_self": true,
      "can_manage": true
    }
  ],
  "meta": {
    "seats": {
      "used": 0,
      "pending_invitations": 0,
      "limit": 0,
      "available": 0,
      "plan": {
        "code": "string",
        "name": "string"
      },
      "status": "trialing"
    },
    "counts": {
      "active": 0,
      "inactive": 0
    }
  }
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/members/localities

Localities for service areas

Search the locality master (global + the company’s own) by name, or resolve ids.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.users or settings.company or settings.view.

Parameters

qquery: string
idsquery: string
Comma-separated ids to resolve.

Response · 200

datarequired: array of object
data[].idrequired: Id
Opaque record id.
data[].namerequired: string
data[].cityrequired: string
data[].staterequired: string
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/members/localities' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string",
      "city": "string",
      "state": "string"
    }
  ],
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/members/options

Members for pickers

The members you work with, A → Z: `view` — whose leads you see (deactivated members included, for filters); `assign` — the active members you may give leads to. Names only (no phone or email).

Access: Signed-in members only (web or Android session) — not for API keys.

Parameters

scopequery: "view" | "assign"

Response · 200

datarequired: array of MemberOption
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/members/options' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string",
      "active": true
    }
  ],
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/members/{id}

A team member

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.users or settings.company or settings.view.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: MemberDetail
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/members/{id}' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "user_id": "cmusrceel0000q7kaafxqi1om",
    "name": "string",
    "email": "string",
    "phone": "+919812345678",
    "image_url": "string",
    "two_factor_enabled": true,
    "role": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "key": "string",
      "name": "string",
      "is_owner": true,
      "requires_two_factor": true
    },
    "branch": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string"
    },
    "reports_to": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string"
    },
    "teams": [
      {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      }
    ],
    "status": "invited",
    "designation": "string",
    "employee_code": "string",
    "languages": [
      "string"
    ],
    "specializations": [
      "string"
    ],
    "service_locality_ids": [
      "string"
    ],
    "lead_capacity": 0,
    "shift": {
      "days": [
        1
      ],
      "start": "string",
      "end": "string"
    },
    "call_tracking_enabled": true,
    "devices": 0,
    "joined_at": "2026-10-06T05:30:00.000Z",
    "last_active_at": "2026-10-06T05:30:00.000Z",
    "deactivated_at": "2026-10-06T05:30:00.000Z",
    "created_at": "2026-10-06T05:30:00.000Z",
    "is_self": true,
    "can_manage": true,
    "direct_reports": 0,
    "open_leads": 0,
    "service_localities": [
      {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string",
        "city": "string"
      }
    ]
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

PATCH/v1/members/{id}

Edit a team member

Role (never one with more access than yours), branch, manager (the reporting paths of everyone below are recomputed), designation, languages, specialisations, localities, lead capacity and shift.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.users.

Parameters

idpathrequired: Id
Opaque record id.

Request body

role_id: Id
Opaque record id.
branch_id: Id or null
Opaque record id.
reports_to_id: Id or null
Their manager; the reporting tree drives the team scope.
designation: string or null
employee_code: string or null
languages: array of "en" | "hi" | "kn" | "ta" | "te" | "ml" | …
specializations: array of "resale" | "rentals" | "projects" | "commercial" | "plots"
service_locality_ids: array of Id
Opaque record id.
lead_capacity: integer or null
shift: object or null
Working hours for routing; null follows the company hours.
shift.daysrequired: array of integer
shift.startrequired: string
shift.endrequired: string
call_tracking_enabled: boolean

Response · 200

datarequired: MemberDetail
metarequired: object

Request

curl -X PATCH 'https://api.propzolo.com/v1/members/{id}' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"role_id":"cmusrceel0000q7kaafxqi1om","branch_id":"cmusrceel0000q7kaafxqi1om","reports_to_id":"cmusrceel0000q7kaafxqi1om","designation":"string","employee_code":"string","languages":["en"],"specializations":["resale"],"service_locality_ids":["cmusrceel0000q7kaafxqi1om"],"lead_capacity":0,"shift":{"days":[1],"start":"string","end":"string"},"call_tracking_enabled":true}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "user_id": "cmusrceel0000q7kaafxqi1om",
    "name": "string",
    "email": "string",
    "phone": "+919812345678",
    "image_url": "string",
    "two_factor_enabled": true,
    "role": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "key": "string",
      "name": "string",
      "is_owner": true,
      "requires_two_factor": true
    },
    "branch": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string"
    },
    "reports_to": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string"
    },
    "teams": [
      {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      }
    ],
    "status": "invited",
    "designation": "string",
    "employee_code": "string",
    "languages": [
      "string"
    ],
    "specializations": [
      "string"
    ],
    "service_locality_ids": [
      "string"
    ],
    "lead_capacity": 0,
    "shift": {
      "days": [
        1
      ],
      "start": "string",
      "end": "string"
    },
    "call_tracking_enabled": true,
    "devices": 0,
    "joined_at": "2026-10-06T05:30:00.000Z",
    "last_active_at": "2026-10-06T05:30:00.000Z",
    "deactivated_at": "2026-10-06T05:30:00.000Z",
    "created_at": "2026-10-06T05:30:00.000Z",
    "is_self": true,
    "can_manage": true,
    "direct_reports": 0,
    "open_leads": 0,
    "service_localities": [
      {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string",
        "city": "string"
      }
    ]
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/members/{id}/deactivate

Deactivate a team member

Signs them out of this workspace everywhere, disables API keys they created and frees their seat. The last active owner cannot be deactivated, nor can you deactivate yourself.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.users.

Parameters

idpathrequired: Id
Opaque record id.

Request body

reassign_reports_to_id: Id or null
New manager for their direct reports; default: the leaving member’s own manager.

Response · 200

datarequired: MemberDeactivated
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/members/{id}/deactivate' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"reassign_reports_to_id":"cmusrceel0000q7kaafxqi1om"}'

Response example

{
  "data": {
    "member": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "user_id": "cmusrceel0000q7kaafxqi1om",
      "name": "string",
      "email": "string",
      "phone": "+919812345678",
      "image_url": "string",
      "two_factor_enabled": true,
      "role": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "key": "string",
        "name": "string",
        "is_owner": true,
        "requires_two_factor": true
      },
      "branch": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "reports_to": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "teams": [
        {
          "id": "cmusrceel0000q7kaafxqi1om",
          "name": "string"
        }
      ],
      "status": "invited",
      "designation": "string",
      "employee_code": "string",
      "languages": [
        "string"
      ],
      "specializations": [
        "string"
      ],
      "service_locality_ids": [
        "string"
      ],
      "lead_capacity": 0,
      "shift": {
        "days": [
          1
        ],
        "start": "string",
        "end": "string"
      },
      "call_tracking_enabled": true,
      "devices": 0,
      "joined_at": "2026-10-06T05:30:00.000Z",
      "last_active_at": "2026-10-06T05:30:00.000Z",
      "deactivated_at": "2026-10-06T05:30:00.000Z",
      "created_at": "2026-10-06T05:30:00.000Z",
      "is_self": true,
      "can_manage": true,
      "direct_reports": 0,
      "open_leads": 0,
      "service_localities": [
        {
          "id": "cmusrceel0000q7kaafxqi1om",
          "name": "string",
          "city": "string"
        }
      ]
    },
    "sessions_revoked": 0,
    "reportees_moved": 0,
    "open_leads": 0,
    "reassign_url": "string"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/members/{id}/reactivate

Reactivate a team member

Needs a free seat on the plan.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.users.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: MemberDetail
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/members/{id}/reactivate' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "user_id": "cmusrceel0000q7kaafxqi1om",
    "name": "string",
    "email": "string",
    "phone": "+919812345678",
    "image_url": "string",
    "two_factor_enabled": true,
    "role": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "key": "string",
      "name": "string",
      "is_owner": true,
      "requires_two_factor": true
    },
    "branch": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string"
    },
    "reports_to": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string"
    },
    "teams": [
      {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      }
    ],
    "status": "invited",
    "designation": "string",
    "employee_code": "string",
    "languages": [
      "string"
    ],
    "specializations": [
      "string"
    ],
    "service_locality_ids": [
      "string"
    ],
    "lead_capacity": 0,
    "shift": {
      "days": [
        1
      ],
      "start": "string",
      "end": "string"
    },
    "call_tracking_enabled": true,
    "devices": 0,
    "joined_at": "2026-10-06T05:30:00.000Z",
    "last_active_at": "2026-10-06T05:30:00.000Z",
    "deactivated_at": "2026-10-06T05:30:00.000Z",
    "created_at": "2026-10-06T05:30:00.000Z",
    "is_self": true,
    "can_manage": true,
    "direct_reports": 0,
    "open_leads": 0,
    "service_localities": [
      {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string",
        "city": "string"
      }
    ]
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/roles

Roles

Roles with member counts. Needs `settings.roles`, `settings.users`, `settings.security` or `settings.view`.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.roles or settings.users or settings.security or settings.view.

Response · 200

datarequired: array of Role
metarequired: object
meta.custom_rolesrequired: boolean
The plan allows custom roles and permissions.

Request

curl -X GET 'https://api.propzolo.com/v1/roles' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "id": "cmusrceel0000q7kaafxqi1om",
      "key": "string",
      "name": "string",
      "description": "string",
      "is_system": true,
      "is_owner": true,
      "requires_two_factor": true,
      "audience": "staff",
      "members": 0,
      "members_total": 0,
      "pending_invitations": 0,
      "can_edit": true,
      "can_delete": true,
      "updated_at": "2026-10-06T05:30:00.000Z"
    }
  ],
  "meta": {
    "custom_roles": true
  }
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/roles

Create or duplicate a role

Custom roles are on the Growth plan and above. You can only grant what you hold yourself.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.roles.

Request body

namerequired: string
description: string or null
permissions: map of map of PermissionValue
Omitted: a copy, or no access at all.
copy_from_role_id: Id
Duplicate this role’s permissions.
requires_two_factor: boolean

Response · 201

datarequired: RoleDetail
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/roles' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"name":"string","description":"string","permissions":{},"copy_from_role_id":"cmusrceel0000q7kaafxqi1om","requires_two_factor":true}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "key": "string",
    "name": "string",
    "description": "string",
    "is_system": true,
    "is_owner": true,
    "requires_two_factor": true,
    "audience": "staff",
    "members": 0,
    "members_total": 0,
    "pending_invitations": 0,
    "can_edit": true,
    "can_delete": true,
    "updated_at": "2026-10-06T05:30:00.000Z",
    "permissions": {}
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/roles/{id}

A role with its permissions

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.roles or settings.security or settings.view.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: RoleDetail
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/roles/{id}' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "key": "string",
    "name": "string",
    "description": "string",
    "is_system": true,
    "is_owner": true,
    "requires_two_factor": true,
    "audience": "staff",
    "members": 0,
    "members_total": 0,
    "pending_invitations": 0,
    "can_edit": true,
    "can_delete": true,
    "updated_at": "2026-10-06T05:30:00.000Z",
    "permissions": {}
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

PATCH/v1/roles/{id}

Edit a role

Name, description, permissions (audited with the diff; you can only grant what you hold) and the 2FA requirement (needs `settings.security`). The Owner role’s permissions are fixed.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.roles.

Parameters

idpathrequired: Id
Opaque record id.

Request body

name: string
description: string or null
permissions: map of map of PermissionValue
Resource → action → value, plus `fields` → field rule → mode (registry in docs/04 §4.2).
requires_two_factor: boolean

Response · 200

datarequired: RoleDetail
metarequired: object

Request

curl -X PATCH 'https://api.propzolo.com/v1/roles/{id}' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"name":"string","description":"string","permissions":{},"requires_two_factor":true}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "key": "string",
    "name": "string",
    "description": "string",
    "is_system": true,
    "is_owner": true,
    "requires_two_factor": true,
    "audience": "staff",
    "members": 0,
    "members_total": 0,
    "pending_invitations": 0,
    "can_edit": true,
    "can_delete": true,
    "updated_at": "2026-10-06T05:30:00.000Z",
    "permissions": {}
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

DELETE/v1/roles/{id}

Delete an unused custom role

Seeded roles cannot be deleted; nor can a role still held by a member or a pending invitation.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.roles.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: object
data.idrequired: Id
Opaque record id.
data.deletedrequired: true
metarequired: object

Request

curl -X DELETE 'https://api.propzolo.com/v1/roles/{id}' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "deleted": true
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/roles/{id}/diff

Preview a permission change

What would change, what you may not grant and how many members it affects. Writes nothing.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.roles.

Parameters

idpathrequired: Id
Opaque record id.

Request body

permissionsrequired: map of map of PermissionValue
Resource → action → value, plus `fields` → field rule → mode (registry in docs/04 §4.2).

Response · 200

datarequired: RoleDiff
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/roles/{id}/diff' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"permissions":{}}'

Response example

{
  "data": {
    "changes": [
      {
        "key": "string",
        "label": "string",
        "from": true,
        "to": true,
        "effect": "widened",
        "dangerous": true
      }
    ],
    "violations": [
      {
        "key": "string",
        "label": "string"
      }
    ],
    "members_affected": 0
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

GET/v1/teams

Teams

Teams with their lead and members. Needs `settings.company`, `settings.users` or `settings.view`.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.company or settings.users or settings.view.

Response · 200

datarequired: array of Team
metarequired: object

Request

curl -X GET 'https://api.propzolo.com/v1/teams' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": [
    {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string",
      "lead": {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string"
      },
      "members": [
        {
          "id": "cmusrceel0000q7kaafxqi1om",
          "name": "string",
          "status": "invited"
        }
      ],
      "created_at": "2026-10-06T05:30:00.000Z",
      "updated_at": "2026-10-06T05:30:00.000Z"
    }
  ],
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

POST/v1/teams

Create a team

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.company.

Request body

namerequired: string
team_lead_id: Id or null
Opaque record id.
member_ids: array of Id
Opaque record id.

Response · 201

datarequired: Team
metarequired: object

Request

curl -X POST 'https://api.propzolo.com/v1/teams' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"name":"string","team_lead_id":"cmusrceel0000q7kaafxqi1om","member_ids":["cmusrceel0000q7kaafxqi1om"]}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "name": "string",
    "lead": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string"
    },
    "members": [
      {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string",
        "status": "invited"
      }
    ],
    "created_at": "2026-10-06T05:30:00.000Z",
    "updated_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

PATCH/v1/teams/{id}

Edit a team

`member_ids` replaces the member list.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.company.

Parameters

idpathrequired: Id
Opaque record id.

Request body

name: string
team_lead_id: Id or null
Opaque record id.
member_ids: array of Id
Opaque record id.

Response · 200

datarequired: Team
metarequired: object

Request

curl -X PATCH 'https://api.propzolo.com/v1/teams/{id}' \
  -H 'Authorization: Bearer pz_live_…' \
  -H 'Content-Type: application/json' \
  -d '{"name":"string","team_lead_id":"cmusrceel0000q7kaafxqi1om","member_ids":["cmusrceel0000q7kaafxqi1om"]}'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "name": "string",
    "lead": {
      "id": "cmusrceel0000q7kaafxqi1om",
      "name": "string"
    },
    "members": [
      {
        "id": "cmusrceel0000q7kaafxqi1om",
        "name": "string",
        "status": "invited"
      }
    ],
    "created_at": "2026-10-06T05:30:00.000Z",
    "updated_at": "2026-10-06T05:30:00.000Z"
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
409 A unique value already exists, a concurrent change won, or the Idempotency-Key is still in use or was sent with a different request.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.

DELETE/v1/teams/{id}

Delete a team

Leads keep their history; the team stops appearing in routing and filters.

Access: Signed-in members only (web or Android session) — not for API keys. Permission settings.company.

Parameters

idpathrequired: Id
Opaque record id.

Response · 200

datarequired: object
data.idrequired: Id
Opaque record id.
data.deletedrequired: true
metarequired: object

Request

curl -X DELETE 'https://api.propzolo.com/v1/teams/{id}' \
  -H 'Authorization: Bearer pz_live_…'

Response example

{
  "data": {
    "id": "cmusrceel0000q7kaafxqi1om",
    "deleted": true
  },
  "meta": {}
}

Errors

401 No valid session or API key (missing, expired or revoked).
403 The caller lacks the permission, API-key scope or support grant this operation needs.
404 Not found — records of another company are reported the same way.
422 Invalid input; `error.fields` maps field paths to messages.
429 Too many requests; retry after the Retry-After header.
500 Unexpected error; quote `error.request_id` to support.