INTEGRATION SUITE

Developer Portal

REST API v1 integration, HMAC signed webhooks, and OpenAPI specification

Outbound Webhook Endpoints

Receive real-time HMAC-SHA256 signed event payloads

Sign in to register a webhook endpoint.

The public documentation is available now; endpoint registration is account-scoped and protected.

Endpoint URL	Signing Secret	Status
No webhook endpoints registered yet. Add your server callback URL above.

Interactive Webhook Simulator & Event Playground

LIVE DISPATCHER

Dispatch simulated webhook events to any endpoint with cryptographic HMAC-SHA256 signatures, latency telemetry, and payload inspection.

TARGET WEBHOOK URL

EVENT TYPE

SIGNING SECRET (OPTIONAL)

CUSTOM PAYLOAD (OPTIONAL JSON)

Simulation Telemetry

DISPATCHED REQUEST

ENDPOINT RESPONSE

Cryptographic Signature Verification Snippets (HMAC-SHA256)

<?php
$payload = file_get_contents('php://input');
$signature = $_SERVER['HTTP_X_ZEROREGISTRAR_SIGNATURE'] ?? '';
$secret = 'whsec_your_webhook_secret';

$expected = 'sha256=' . hash_hmac('sha256', $payload, $secret);
if (!hash_equals($expected, $signature)) {
    http_response_code(401);
    exit('Invalid webhook signature');
}
// Signature verified! Process event payload...
$event = json_decode($payload, true);
?>

const crypto = require('crypto');

function verifyWebhook(payloadRaw, signatureHeader, secret) {
    const expected = 'sha256=' + crypto.createHmac('sha256', secret).update(payloadRaw).digest('hex');
    return crypto.timingSafeEqual(Buffer.from(signatureHeader), Buffer.from(expected));
}

import hmac
import hashlib

def verify_webhook(raw_payload: bytes, signature_header: str, secret: str) -> bool:
    expected = 'sha256=' + hmac.new(secret.encode('utf-8'), raw_payload, hashlib.sha256).hexdigest()
    return hmac.compare_digest(expected, signature_header)

Recent delivery history

Last 50 attempts

Event	Endpoint	HTTP	Retries	Payload	Time
No webhook deliveries have been recorded yet.

Interactive API Code Snippets

Test and integrate the ZeroRegistrar REST API v1 in your preferred language

GET /api/v1/subdomains

curl -X GET "https://zeroregistrar.com/api/v1/subdomains" \
  -H "Authorization: Bearer zr_live_YOUR_TOKEN_HERE" \
  -H "Accept: application/json"

Node.js / TypeScript

const response = await fetch('https://zeroregistrar.com/api/v1/subdomains', {
  headers: {
    'Authorization': 'Bearer zr_live_YOUR_TOKEN_HERE',
    'Accept': 'application/json'
  }
});
const data = await response.json();
console.log(data);

Python 3 (requests)

import requests

response = requests.get(
    'https://zeroregistrar.com/api/v1/subdomains',
    headers={'Authorization': 'Bearer zr_live_YOUR_TOKEN_HERE', 'Accept': 'application/json'}
)
print(response.json())

PHP 8.3 (cURL)

<?php
$ch = curl_init('https://zeroregistrar.com/api/v1/subdomains');
curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_HTTPHEADER => [
        'Authorization: Bearer zr_live_YOUR_TOKEN_HERE',
        'Accept: application/json'
    ]
]);
$res = curl_exec($ch);
$data = json_decode($res, true);
?>

Authentication & Rate Limits

Pass your API token as a Bearer token in the Authorization header. Standard tiers allow up to 120 requests/minute with burst capacity.

Generate API Token →

Supported Webhook Events

order.created
payment.completed
payment.failed
subdomain.created
subdomain.provisioned
dns.updated
renewal.due
website.published