Send API

One endpoint: POST https://api.zapapush.com/send (GET works too, see below).

Your key

Send the key in the X-ZapaPush-Key header. That keeps it out of URLs, and so out of proxy and server logs.

For simple integrations that can't set headers, the key also works in the path:

https://api.zapapush.com/send/YOUR_KEY

A URL with the key in it is easier to leak than a header: it ends up in shell history, proxy logs and link previews. Keep such URLs out of chats and tickets.

The key in the query string (?key=YOUR_KEY) still works but is deprecated: answers to it carry a Deprecation header, and it may stop working. Use the header or the path instead.

Anyone with the key can send to your phone. If it leaks, open Settings in the app and tap Rotate your KEY: the old key stops working at once.

What to send

Pick whichever is easiest for your tool:

Format	Example	Subject / description
Plain text	`-d 'Disk full'`	first line / the rest
JSON	`{"subject": "Disk full", "description": "/var is 95% used"}`	`subject` / `description`
Form fields	`-d subject=Disk+full -d description=...`	`subject` / `description`
Query string	`?m=Disk+full`	`m` / `description`

title, message and m are accepted for the subject, and body for the description. The subject is cut at 200 characters, the description at 10,000; the push shows the first 150.

# JSON
curl -H 'X-ZapaPush-Key: YOUR_KEY' -H 'Content-Type: application/json' \
  -d '{"subject":"Disk full","description":"/var is 95% used on db-1"}' \
  https://api.zapapush.com/send

# GET, for tools that can only open a URL
curl 'https://api.zapapush.com/send/YOUR_KEY?m=Backup+failed'

Repeats

Alerts are matched by subject:

Open alert with the same subject: it's updated (the count goes up) and your phone is notified again.
Acked: it's updated silently.
Closed, or no alert yet: a new alert, with a push.

So a check that fires every minute gives you one alert with a counter, not a hundred.

Responses

Every accepted post answers 200 with JSON:

{"status": "created", "alert_id": 42, "notified": 1}

status is created, updated or silenced; notified is how many phones got the push.

Code	`error`	Meaning
404	`not_found`	Unknown or missing key.
422	`invalid_request`	No subject.
429	`too_soon`	Over 60 posts this minute. Wait for the `Retry-After` header (seconds).
403	`banned`	The key is blocked for a while, see below.

Using Prometheus Alertmanager or Grafana? Their webhooks have their own endpoint that also closes resolved alerts: see Integrations.

Limits

60 posts per minute per key. Posts over the limit are rejected and not saved.
60 rejected posts within 10 minutes block the key for 1 hour (24 hours if it was already blocked in the last day), and you get one push about it. Rotating the key unblocks it.
Your phone makes a sound at most once a minute; other pushes in that minute arrive silently.