AgencyZoom Authentication API

openapi: 3.2.0
info:
  title: Agencyzoom Authentication API
  description: 'Agencyzoom API enables third party applications to integrate with

    Agencyzoom to manage lead, customer, policy, and tasks. The management operations

    include actions such as creation, retrieval, updating, and deletion.


    Currently, Agencyzoom has a rate limit of **120** calls per minute during the day and night as of Aug 17, 2026.


    # Getting Started

    Using authentication endpoints as described below, the integrator can function on hehalf

    of the logged in user. The login endpoint returns a JWT token. Subsequent calls need

    pass the token as HTTP header bearer token.

    ```

    Authorization: Bearer

    ```

    Please note, the permissions afforded to the caller are the same as those for the logged

    in user. Therefore, the user name used for the integration has to be the agency owner

    if the integrated applications would like to access all the functionalities.


    # Versioning

    Agencyzoom API is backward compatible. Currently there is only one version.


    # Change Logs

    - ### 2023.11.07

    - POST v1/api/leads/list. Fixed bug in sort by `lastActivityDate`. Added 2 additional filters: lastActivityEarliestDate,lastActivityLatestDate

    - Increased rate limite for nightly API calls

    - POST v1/api/leads/{leadId}/quotes. Fixed bug of missing `Quote ID` response payload

    - ### 2023.11.21

    - Increased rate limite for daily API calls to 30 per minute

    - POST /v1/api/leads/{leadId}/notes. Fixed bug in processing line breaks

    - ### 2024.01.10

    - New API for contact management - Batch Create Contacts POST `v1/api/contact/batch-create`

    - Added the following new fields for PUT `v1/api/customers/{customerId}`

    `contactFirstname` `contactLastname` `contactMiddlename` `numberOfEmployees` `annualRevenue` `totalPayroll` `tagNamesbirthday` `csrId` `agentId` `customFields`

    - ### 2024.01.18

    - New API for Customer management - Get AMS policies for a specific customer `GET: v1/api/customers/{customerId}/ams-policies`

    - New API for Customer management - Get policies for a specific customer `GET: v1/api/customers/{customerId}/policies`

    - New API for Customer management - Update tags for a specific policy `POST: v1/api/policies/update-tags`


    - ### 2024.01.18

    - POST `/v1/api/leads/create`. Edit request params `pipelineId` `stageId` as required.

    - ### 2024.03.10

    - Added two new fields `licenseNumber` `stateLicensed` for POST `v1/api/opportunities/{opportunityId}/driver` GET `v1/api/opportunities/drivers/{driverId}` PUT `v1/api/opportunities/drivers/{driverId}`

    - ### 2026.08.7

    - Increased rate limite for daily API calls to 90 per minute

    - ### 2026.08.17

    - Increased rate limite for daily API calls to 120 per minute


    Happy coding!'
  termsOfService: https://agencyzoom.com/tos/
  contact:
    email: support@agencyzoom.com
  license:
    name: Propriety license
  version: 1.0.0
servers:
- url: https://api.agencyzoom.com
  description: Mobile test server
tags:
- name: Authentication
  description: These endpoints enable the integration to obtain and invalidtate JWT, which must be passed as an HTTP header in order to access the rest of functionalities.
paths:
  /v1/api/auth/login:
    post:
      tags:
      - Authentication
      summary: Log the user in
      operationId: Auth-Login
      requestBody:
        description: Dashboard data request
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LoginRequest'
      responses:
        '200':
          description: JWT Token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LoginResponse'
        '400':
          description: Invalid user name and/or password
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal processing error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /v1/api/auth/ssologin:
    post:
      tags:
      - Authentication
      summary: V4 SSO Log the user in
      operationId: Auth-Ssologin
      requestBody:
        description: Dashboard data request
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/LoginRequest'
      responses:
        '200':
          description: JWT Token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/LoginResponse'
        '400':
          description: Invalid user name and/or password
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal processing error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /v1/api/auth/logout:
    post:
      tags:
      - Authentication
      summary: Log the user out
      operationId: Auth-Logout
      responses:
        '200':
          description: A generic success message
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GenericSuccessResponse'
        '400':
          description: Invalid user name and/or password
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '500':
          description: Internal processing error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
  /v1/api/auth/refresh:
    post:
      tags:
      - Authentication
      summary: Refresh the access token using a refresh token
      operationId: Auth-Refresh
      requestBody:
        description: Refresh token payload
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/RefreshTokenRequest'
      responses:
        '200':
          description: New JWT and refresh token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RefreshTokenResponse'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
        '401':
          description: Invalid or expired refresh token
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ErrorResponse'
components:
  schemas:
    LoginResponse:
      description: Login response model. It returns the JWT token
      properties:
        jwt:
          description: The JWT token
          type: string
        ownerAgent:
          description: Is ownerAgent
          type: boolean
        refreshToken:
          description: The refresh token JWT
          type: string
        expiresIn:
          description: Seconds until the access token expires
          type: integer
        tokenType:
          description: Token type, always 'Bearer'
          type: string
      type: object
    ErrorResponse:
      description: Error response model.
      properties:
        error:
          description: The error message
          type: string
        fieldErrors:
          description: The field errors
          type: array
          items:
            $ref: '#/components/schemas/FieldError'
      type: object
    LoginRequest:
      description: Login request model
      required:
      - username
      - password
      properties:
        username:
          description: The user name, which is the user's email
          type: string
        password:
          description: The user's password
          type: string
        version:
          description: Login API version. Pass 2 to receive refreshToken, expiresIn, and tokenType in the response. Omit or use any other value for the legacy response (jwt + ownerAgent only).
          type: integer
          example: 2
      type: object
    GenericSuccessResponse:
      description: A generic succss response.
      properties:
        message:
          description: An optional confirmation message
          type: string
        id:
          description: A Model's id
          type: integer
        result:
          description: 'whether success, 1: true, 0: false'
          type: boolean
      type: object
    FieldError:
      description: Form field error model.
      properties:
        field:
          description: The field ID
          type: string
        error:
          description: The error message
          type: string
      type: object
    RefreshTokenRequest:
      description: Refresh token request model
      required:
      - refreshToken
      properties:
        refreshToken:
          description: The refresh token JWT obtained from login or a previous refresh
          type: string
      type: object
    RefreshTokenResponse:
      description: Refresh token response model. Returns a new access token JWT and a new refresh token JWT.
      properties:
        jwt:
          description: The new JWT access token
          type: string
        refreshToken:
          description: The new refresh token JWT
          type: string
        ownerAgent:
          description: Is ownerAgent
          type: boolean
        expiresIn:
          description: Seconds until the access token expires
          type: integer
        tokenType:
          description: Token type, always 'Bearer'
          type: string
      type: object
  securitySchemes:
    bearer:
      type: http
      bearerFormat: JWT
      scheme: bearer
x-provenance:
  method: harvested
  publisher: AgencyZoom
  source: https://app.agencyzoom.com/openapi/agencyzoom.yaml
  note: split by refine-openapis from the provider's own published document, verified by fetch (openapi/_original/*.fetch.json);
    stamped by stamp-openapi-provenance.py (roadmap#793)