Add members to an org unit

curl --request POST \
  --url https://api.zenzap.co/v2/org-units/{orgUnitId}/members \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-Signature: <api-key>' \
  --data '
{
  "memberIds": [
    "550e8400-e29b-41d4-a716-446655440003"
  ]
}
'

import requests

url = "https://api.zenzap.co/v2/org-units/{orgUnitId}/members"

payload = { "memberIds": ["550e8400-e29b-41d4-a716-446655440003"] }
headers = {
    "Authorization": "Bearer <token>",
    "X-Signature": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    Authorization: 'Bearer <token>',
    'X-Signature': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({memberIds: ['550e8400-e29b-41d4-a716-446655440003']})
};

fetch('https://api.zenzap.co/v2/org-units/{orgUnitId}/members', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.zenzap.co/v2/org-units/{orgUnitId}/members",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'memberIds' => [
        '550e8400-e29b-41d4-a716-446655440003'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "X-Signature: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.zenzap.co/v2/org-units/{orgUnitId}/members"

	payload := strings.NewReader("{\n  \"memberIds\": [\n    \"550e8400-e29b-41d4-a716-446655440003\"\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("X-Signature", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.zenzap.co/v2/org-units/{orgUnitId}/members")
  .header("Authorization", "Bearer <token>")
  .header("X-Signature", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"memberIds\": [\n    \"550e8400-e29b-41d4-a716-446655440003\"\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.zenzap.co/v2/org-units/{orgUnitId}/members")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["X-Signature"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"memberIds\": [\n    \"550e8400-e29b-41d4-a716-446655440003\"\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "memberIds": [
    "550e8400-e29b-41d4-a716-446655440001",
    "550e8400-e29b-41d4-a716-446655440002",
    "550e8400-e29b-41d4-a716-446655440003"
  ]
}

"text is required"

"unauthorized"

"Topic not found"

"internal server error"

Org units

Add members to an org unit

Add one or more members to an org unit.

Validation:

All members must exist and be in your organization (returns 400 “Invalid member” otherwise)
Maximum 5 members per request; duplicates are removed

Behavior: Idempotent — members already in the unit are ignored.

Rate limit: 1 request per minute per bot, shared with the remove-members endpoint (returns 429 if exceeded).

Org-unit restriction: If your organization restricts communication to within org units, your bot must be a member of the org unit; otherwise a 404 is returned. A bot that does not belong to any org unit cannot access any of them (every org unit returns 404).

POST

org-units

{orgUnitId}

members

Add members to an org unit

curl --request POST \
  --url https://api.zenzap.co/v2/org-units/{orgUnitId}/members \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --header 'X-Signature: <api-key>' \
  --data '
{
  "memberIds": [
    "550e8400-e29b-41d4-a716-446655440003"
  ]
}
'

import requests

url = "https://api.zenzap.co/v2/org-units/{orgUnitId}/members"

payload = { "memberIds": ["550e8400-e29b-41d4-a716-446655440003"] }
headers = {
    "Authorization": "Bearer <token>",
    "X-Signature": "<api-key>",
    "Content-Type": "application/json"
}

response = requests.post(url, json=payload, headers=headers)

print(response.text)

const options = {
  method: 'POST',
  headers: {
    Authorization: 'Bearer <token>',
    'X-Signature': '<api-key>',
    'Content-Type': 'application/json'
  },
  body: JSON.stringify({memberIds: ['550e8400-e29b-41d4-a716-446655440003']})
};

fetch('https://api.zenzap.co/v2/org-units/{orgUnitId}/members', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.zenzap.co/v2/org-units/{orgUnitId}/members",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_POSTFIELDS => json_encode([
    'memberIds' => [
        '550e8400-e29b-41d4-a716-446655440003'
    ]
  ]),
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>",
    "Content-Type: application/json",
    "X-Signature: <api-key>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://api.zenzap.co/v2/org-units/{orgUnitId}/members"

	payload := strings.NewReader("{\n  \"memberIds\": [\n    \"550e8400-e29b-41d4-a716-446655440003\"\n  ]\n}")

	req, _ := http.NewRequest("POST", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("X-Signature", "<api-key>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

HttpResponse<String> response = Unirest.post("https://api.zenzap.co/v2/org-units/{orgUnitId}/members")
  .header("Authorization", "Bearer <token>")
  .header("X-Signature", "<api-key>")
  .header("Content-Type", "application/json")
  .body("{\n  \"memberIds\": [\n    \"550e8400-e29b-41d4-a716-446655440003\"\n  ]\n}")
  .asString();

require 'uri'
require 'net/http'

url = URI("https://api.zenzap.co/v2/org-units/{orgUnitId}/members")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'
request["X-Signature"] = '<api-key>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"memberIds\": [\n    \"550e8400-e29b-41d4-a716-446655440003\"\n  ]\n}"

response = http.request(request)
puts response.read_body

{
  "id": "550e8400-e29b-41d4-a716-446655440000",
  "memberIds": [
    "550e8400-e29b-41d4-a716-446655440001",
    "550e8400-e29b-41d4-a716-446655440002",
    "550e8400-e29b-41d4-a716-446655440003"
  ]
}

"text is required"

"unauthorized"

"Topic not found"

"internal server error"

Authorizations

Authorization

string

header

required

Bearer token for the request. Two flavors:

Static API key — pass your API key (the value returned as apiKey when the bot was created). Must be paired with X-Signature + X-Timestamp (the hmacSignature scheme).
OAuth access token — pass the JWT returned by POST /oauth/token. No signature headers are required.

X-Signature

string

header

required

HMAC-SHA256 signature for request verification. Required only when authenticating with a static API key. Omit when using an OAuth access token.

Headers

X-Signature

string

HMAC signature of the request for authentication and replay protection.

Required only when authenticating with a static API key. If you are using an OAuth access token (issued by POST /oauth/token), omit this header — the JWT carries all the authentication and integrity guarantees.

Replay Protection: The signature includes a timestamp to prevent replay attacks. Requests with timestamps older than 5 minutes are rejected.

The signature payload differs by HTTP method:

POST/PUT/PATCH/DELETE: HMAC-SHA256 of {timestamp}.{body}
GET: HMAC-SHA256 of {timestamp}.{uri}

The signature is calculated as:

Get the current Unix timestamp in milliseconds
Determine the payload:
- For POST/PUT/PATCH/DELETE: Use {timestamp}.{body} where body is the request body
- For GET: Use {timestamp}.{uri} where uri is the full request URI (e.g., /v2/members?limit=10)
Calculate HMAC-SHA256 of the combined payload using your API secret
Hex-encode the output
Include the timestamp in the X-Timestamp header

Example for GET request to /v2/members?limit=10:

timestamp = 1699564800000
payload = "1699564800000./v2/members?limit=10"
signature = HMAC-SHA256(secret, payload)
X-Signature: hex(signature)
X-Timestamp: 1699564800000

Example for POST request with body {"topicId":"123","text":"Hello"}:

timestamp = 1699564800000
payload = '1699564800000.{"topicId":"123","text":"Hello"}'
signature = HMAC-SHA256(secret, payload)
X-Signature: hex(signature)
X-Timestamp: 1699564800000

For multipart/form-data requests, sign the exact raw request body bytes (including boundaries and file bytes) as transmitted.

Pattern: ^[a-f0-9]{64}$

Example:

"a3d5f8e7c2b1d4f6a8e9c7b5d3f1a2e4b6c8d0f2e4a6b8c0d2e4f6a8b0c2d4e6"

X-Timestamp

integer<int64>

Unix timestamp in milliseconds when the request was created. Used for replay protection — requests older than 5 minutes are rejected.

Required only when authenticating with a static API key. Omit when using an OAuth access token.

Example:

1699564800000

Path Parameters

orgUnitId

string<uuid>

required

The ID of the org unit

Body

application/json

memberIds

string[]

required

Member IDs to add (max 5). Must be in your organization. Duplicates are removed.

Required array length: 1 - 5 elements

Example:

["550e8400-e29b-41d4-a716-446655440003"]

Response

Members added successfully

string<uuid>

The org unit ID

Example:

"550e8400-e29b-41d4-a716-446655440000"

memberIds

string[]

Updated member profile IDs in the org unit (bot members use the b@<uuid> form)

List org unit members Remove members from an org unit

⌘I

Overview

Messages

Long Polling

Topics (group chats/channels/conversations)

Org units

Tasks

Members

Polls

OAuth

Agentic

Add members to an org unit

Authorizations

Headers

Path Parameters

Body

Response