Authentication

You must authenticate yourself in order to access the REST API. To do this, you must generate a Bearer Token, which you insert into the request header.

Bearer Token

You can generate the bearer token in the ZEP interfaces module in your ZEP. Here you can see an example of how to insert the generated token into the request header using cURL:

Authentication with Bearer Token

curl --request GET \
     --url 'https://www.zep-online.de/zepinstanz/next/api/v1/customers' \
     --header 'Accept: application/json' \
     --header 'Authorization: Bearer {token}'

⚠️

Always keep your personal token safe and reset it if you suspect that it has been misused. Please do not send your ZEP password and token to GitHub or similar.

Rate Limiting

Every ZEP instance may send up to 1000 requests per 5 minutes. All tokens of an instance share this limit. Beyond it, the API answers with HTTP status code 429 until the 5-minute window ends.

The API also limits how many requests of one instance run at the same time and how fast they arrive in short bursts. A request beyond that also receives 429.

Every 429 response carries a Retry-After header: the number of seconds to wait before sending the request again. Please follow it rather than retrying at once.

Response when a limit is exceeded

HTTP/1.1 429 Too Many Requests
Retry-After: 1
Content-Type: application/json

For integrations that read a lot of data:

Send at most 10 requests at the same time.
Load each list once per sync run instead of again for every item, and run full syncs outside business hours.
Retry a 429 after the Retry-After seconds instead of treating it as an error.

Please contact your customer advisor if the specified limit is not sufficient and you require a higher number of requests.

Quickstart Pagination