Zonara integrates into your platform.
Zonara is a cloud-to-cloud, server-side integration. Nothing is installed on anyone's computer, and the direction of travel is one way: Zonara connects to the field-service and practice-management systems its customers already run.
There is no public Zonara API product.
We say this plainly because it saves everyone time: Zonara does not publish a developer API, an SDK, or a partner app store. Zonara is the side that connects out. It reads and writes through the documented APIs of the platforms our shared customers already run, using credentials those customers issue and can revoke.
If you build one of those platforms and want to talk about a deeper connection, or you run one of these systems and want to know exactly what Zonara touches before you hand over a key, both answers are on this page.
Poll for truth. Webhook for speed.
The poll is authoritative; the webhook only makes it faster. That ordering is what keeps a missed, duplicated, or forged delivery from ever corrupting state.
Incremental poll, every 15 minutes
Zonara runs an incremental sync every 15 minutes using the vendor’s own "modified since" cursor.
The webhook is a doorbell
A delivery tells Zonara to re-poll now. The payload is never parsed as data, so nothing a caller puts in a body can become a record.
Failure never silently drops work
A failed write goes to a durable retry queue drained by a cron; entries that keep failing escalate to a person rather than retrying forever.
The webhook receiver.
This is the endpoint a platform calls to tell Zonara that something changed. There is nothing to implement on your side beyond registering the URL Zonara gives you.
POST https://api.zonara.ai/webhooks/pms/<provider>?token=<shared secret>&location=<location_id>One receiver per platform. The provider segment is fixed — Zonara registers the exact URL with the vendor.
The shared secret is issued by Zonara when the connection is set up, and the location binds the delivery to a single tenant.
It fails closed: an absent, wrong, or development-grade secret is rejected outright. Vendor-native signature verification is layered in per platform once a live delivery confirms the exact semantics.
Zonara hashes the raw body only to absorb exact replays. It never parses the payload as data.
A delivery is a doorbell, not a delivery of facts. If a webhook is missed, dropped, or forged, the next scheduled poll still produces the correct state.
Zonara's calendar and messaging connections use their own receivers with the same posture: verify first, fail closed, and treat the notification as a signal rather than as a source of record.
Least privilege, stated exhaustively.
Zonara requests only the access its shipped features exercise. Broadly, that means reading customers, jobs and appointments — plus estimates and invoices where a platform exposes them — and writing four things back: create a customer, create a job, reschedule it, cancel it with a reason.
Never read: payroll, pricebook cost data, employee compensation, or accounting ledgers.
Technical questions go to a person.
Integration scoping, security review paperwork, sub-processor lists, or a question about exactly what Zonara touches in your system — write to us and a human answers.