Dành cho lập trình viên
Cho AI agent và hệ thống của bạn điều khiển Zalo Auto
MCP server (đăng nhập OAuth, chọn phạm vi), REST v2 và webhook có chữ ký. Hai cách dùng: điều khiển trực tiếp từng tài khoản theo từng việc, hoặc thiết lập chiến dịch/luật/hạn mức để hệ thống tự chạy. Mọi lệnh gửi tin đều đi qua cổng giao việc chung của từng tài khoản Zalo: quyền, thứ tự, chống gửi trùng và hạn mức/lịch/nhịp mà chủ tài khoản tự đặt (mặc định không giới hạn) — không có đường tắt riêng cho API.
Kết nối AI qua MCP
- Trong Claude, ChatGPT, Lovable hoặc ứng dụng AI hỗ trợ MCP, thêm connector với địa chỉ
https://zl.builera.app/mcp. - Trang “Cho phép kết nối” mở ra: đăng nhập Zalo Auto, chọn workspace, tài khoản Zalo, nhóm quyền và bộ công cụ hiển thị.
- AI gọi
me_getđể biết mình được làm gì,catalog_searchđể tìm thao tác bằng tiếng Việt hoặc tiếng Anh. - Lệnh có hệ quả cần
idempotencyKeyriêng cho mỗi ý định; gửi tin trả về ngay, dùngoperations_wait(tối đa 20 giây) để biết Zalo đã nhận. - Thao tác không hoàn tác trả
confirmation_requiredkèm tóm tắt; hỏi người dùng rồi gọi lại kèmconfirmTokentrong 5 phút.
Mỗi kết nối tối đa 300 lệnh đọc và 60 lệnh ghi mỗi phút. Chủ workspace có nút “Tạm dừng mọi lệnh từ ngoài” và thấy từng lệnh ở Cài đặt › Tích hợp › Hoạt động.
REST v2
Mỗi thao tác trong danh mục là một đường: POST /api/public/v2/ops/<mã thao tác> với thân JSON (thao tác chỉ đọc gọi được bằng GET với tham số trên URL). Xác thực bằng khoá v2 (Authorization: Bearer za_live_…, tạo ở Cài đặt › Tích hợp › Khoá API) hoặc mã truy cập OAuth của ứng dụng đã kết nối. Header Idempotency-Key cho lệnh có hệ quả, X-Confirm-Token cho bước xác nhận. Lỗi luôn là {"error":{"code","message","details"}}; quá giới hạn trả 429 kèm Retry-After.
curl -X POST https://zl.builera.app/api/public/v2/ops/inbox.message.send \
-H "Authorization: Bearer $ZALO_AUTO_KEY" -H "content-type: application/json" \
-H "Idempotency-Key: reply-lan-2026-10-20-1" \
-d '{"conversationId":"<id>","text":"Dạ em gửi anh báo giá ạ"}'
# → 202 {"status":"accepted","operationId":"…","messageId":"…","jobId":"…"}
curl -X POST https://zl.builera.app/api/public/v2/ops/operations.wait \
-H "Authorization: Bearer $ZALO_AUTO_KEY" -H "content-type: application/json" \
-d '{"operationId":"<operationId>","seconds":15}'
# → 200 {"data":{"status":"succeeded","messageStatus":"sent",…}}Danh mục thao tác
Cùng một danh mục cho MCP và REST v2. Bộ công cụ chỉ để AI dễ tìm; quyền của kết nối mới quyết định được làm gì.
Who is calling: user, workspace, role, granted Zalo accounts, permission groups, visible tool profiles and request limits. Call this first.
Workspace name, time zone, working hours, plan state, switches affecting work (maintenance, external commands paused) and setup counts (machines, proxies, accounts, contacts, campaigns).
Platform state that affects work right now: maintenance, the operator's switch for outside writes, the minimum and newest agent version, and the server clock.
Rename the workspace (admins).
Change the calling person's display name in Zalo Auto.
Search the operation catalog (Vietnamese or English, typos OK) among operations this connection may use, including ones in hidden tool profiles — tells you which profile to enable.
Search contacts, conversations, groups and campaigns by text in one call.
Dashboard KPIs for today/this week/this month: messages, replies, new contacts, campaign progress, unanswered.
Report tab (overview, accounts, members, campaigns, pipeline) for a date range (max 1 year), optionally per account.
Every report tab (overview, accounts, members, campaigns, pipeline) for one date range in one answer — the same data the web puts in its Excel export.
List Zalo conversations visible to the caller, newest first, with unread/unanswered state and filters. Use to find who is waiting for a reply.
Get one conversation: account, contact or group, unread count, assignee, flags and send hold state.
Read stored messages of a conversation, newest first, with status (queued/sent/delivered/seen/failed/unverified), attachments, quotes and reactions. Page back with next_cursor.
Get one message with its current delivery status and job id.
List internal team notes of a conversation (never sent to Zalo).
Open (or create) the 1:1 conversation between a CRM contact and one Zalo account. May return a pending phone lookup job instead of a conversation.
Start a chat with a Vietnamese phone number from one Zalo account: looks the number up on Zalo (queued job) and opens the conversation.
Send a message on Zalo (text with mentions/styles, quote reply, images, files, video, voice file, sticker, contact card, bank card). Queued in conversation order through the account's own limits; returns operation/message/job ids immediately — call operations_wait for the Zalo result.
Get a signed upload URL for a file to attach to a message (images, files, video, voice). PUT the bytes to upload_url, then pass the returned attachment to inbox_message_send.
After PUT to upload_url: checks the file really arrived and returns the attachment (real size, kind) ready for inbox_message_send.
Search Zalo stickers by keyword through the conversation's account (max 30). Use the result in inbox_message_send kind=sticker.
Retry a failed outgoing message (never an unverified one — read the chat first). Keeps conversation order.
Unblock a conversation held by a failed message: skip it so later queued messages go out.
List scheduled sends (waiting, sending or failed) of one conversation or the whole workspace, soonest first.
Cancel a scheduled send that has not gone out yet (or dismiss a failed one).
React to a message with an emoji icon code.
Recall (undo) one of our sent messages for everyone. Zalo may refuse old messages.
Delete a message only on this account's side (others still see it). Different from recall.
Forward a stored message to up to 20 conversations of the same account; returns one result per target.
Mark a conversation read up to a message (also sends 'seen' on Zalo for the newest incoming message).
Ask the account to fetch older history from Zalo for a group conversation (1:1 history beyond what was synced may not exist).
Assign a conversation to a workspace member (or null to unassign).
Pin or hide a conversation inside Zalo Auto only (does not change the Zalo phone app).
Add an internal team note to a conversation, optionally mentioning members. Never sent to Zalo.
Read the workspace's automatic conversation assignment settings.
Change automatic conversation assignment (round robin / by load, members, accounts). Pass the `revision` from inbox_auto_assign_get as expectedRevision to avoid overwriting a newer change.
inbox.conversation.zalo_flags_setMCP: inbox_conversation_zalo_flags_setChange the conversation on the Zalo app itself: pin, mark unread, archive or mute.
Delete the whole conversation on this account's side on Zalo.
List stickers of a Zalo sticker category.
List the Zalo personal accounts the caller may use, with session state (ok/expired/…), Zalo restriction state, sync and listener health, machine and proxy summary (never secrets).
One Zalo account: session, restriction, sync stages, listener health, machine, proxy summary and policy version.
The account's saved action policy (limits, schedule, pacing, warm-up), what is in force now, today's usage per task and the machine's pacing support.
Recent events of an account (login, session changes, sync, restrictions, moves).
Create a Zalo account slot on a machine with a proxy (or direct IP when allowed). Then start a QR login with accounts_login_qr_start.
Start a QR login for an account. A human must scan the QR (from accounts_login_qr_status) with the Zalo phone app; the AI cannot approve it.
Current QR login state: waiting for scan (with QR image data URL), scanned, succeeded, expired or failed.
Cancel a pending QR login.
Pause an account: no new work is handed to its machine until resumed.
Resume a paused account.
Rename, relabel, set the default assignee or toggle friend auto-accept for an account.
Change part of an account's action policy (per-task day/hour limits: null = unlimited, 0 = take no more; schedule; pacing; warm-up; per-conversation auto-send cap). Send the version you read (accounts_usage_get); a newer version returns conflict.
Apply policy patches to many accounts, each with its own expected version; returns a result per account (saved / conflict / forbidden).
Re-run the staged sync (profile, friends, groups, labels, requests, history) or only the failed stages.
Change the account's Zalo display name, bio and/or profile picture on Zalo (picture: upload with media_upload_create, then pass its storagePath as avatarStoragePath).
Attach a proxy to an account (one proxy per account), change it, or detach with proxyId=null.
Move an account to another machine (and proxy). The session is removed from the old machine; a new QR login may be needed.
Remove an account from the workspace (optionally its chat history). Cannot be undone.
Ask the machine to verify the account's Zalo session now.
List proxies with status, observed exit IP/country, expiry and the account using each (passwords are never returned).
One proxy with status, exit IP/country, expiry and the account using it (never the password).
Add one proxy (password is write-only) and optionally check it through a machine.
Import proxies from text (one per line, host:port:user:pass or URL form).
Change a proxy's endpoint, credentials (write-only) or labels.
Check a proxy through a machine: reachability, exit IP, country, latency.
Acknowledge that a proxy's exit IP changed (only a warning; never blocks the account).
Delete a proxy that no account uses.
List machines running the Zalo Auto agent: status, OS, version, update channel, CPU/RAM, accounts and capacity.
One machine with health metrics, update state, accounts on it and the latest diagnostics summary.
Newest stable agent version, to see which machines need an update.
Create a one-time install command (Windows, Linux or Docker) that pairs a new machine. Shown once; expires soon.
Restart the agent process on a machine (never reboots the host).
Ask the machine for a redacted recent log excerpt; read it with machines_get after a few seconds.
Put a machine on the stable or beta agent channel.
Roll a machine back to its previous agent version.
Revoke a machine's token: it stops receiving work immediately. Cannot be undone (pair again).
Delete a revoked/offline machine record.
Locations, server types and prices available with the workspace's Hetzner token.
Create a Hetzner server that installs the agent automatically. Costs money on the Hetzner account — confirmation required.
Refresh and read the provisioning progress of a Hetzner machine.
Delete the Hetzner server behind a machine. Cannot be undone.
List an account's Zalo friends (as CRM contacts with relation, alias, friend since, last in/out).
List incoming or outgoing friend requests of an account.
Send friend requests from one account to CRM contacts (ids or a filter) with a greeting (spintax supported). Each request is a queued job under the account's limits.
Accept incoming friend requests.
Reject incoming friend requests.
Withdraw friend requests this account sent.
Unfriend users (they must accept a new request to be friends again).
Block users on Zalo.
Unblock users on Zalo.
Set Zalo aliases for many friends from a template (variables like {name}).
Ask Zalo for friend suggestions of an account.
Save a suggested Zalo user as a CRM contact (does not send a friend request).
Export an account's friends as rows (name, phone, uid, alias, friend since).
Read the account's automatic friend-accept rule.
Change the account's automatic friend-accept rule (labels, greeting, stale request withdrawal).
List Zalo groups of the caller's accounts with member count, our role and invite link.
One group with settings, our role (owner/deputy/member), link and last sync.
List cached members of a group (sync first with groups_members_sync for fresh data).
Refresh a group's member list from Zalo.
Preview a Zalo group invite link (name, members, approval needed).
Join one or many groups by invite links (newline separated). Some groups need admin approval: the result says joined or pending.
Create a Zalo group with friends of the account.
Open (or create) the inbox conversation of a group.
Add friends of the account to a group (Zalo privacy may refuse some).
Import members of a group this account owns/administers into CRM (optional label). Not allowed for other people's groups.
Rename a group (needs owner/deputy on Zalo).
Change a group's avatar from an image URL (needs owner/deputy).
Change Zalo group settings (who may post, approve members, etc.).
Promote a member to deputy.
Demote a deputy.
Approve a pending join request.
Reject a pending join request.
Remove a member from the group.
Block a member from the group.
Enable the group's invite link.
Disable the group's invite link.
Leave a group with this account.
Disband a group the account owns. Type the group name as confirmName.
Create a poll in a group: multiple choice, expiry, and (agent 1.4.0) members adding options, results hidden until one votes, anonymous voters.
Create (and pin) a note in a group.
Create a reminder in a group (groupRowId) or in a conversation (conversationId: a group chat, or 1:1 with agent 1.4.0); start time in ms epoch, repeat none/daily/weekly/monthly.
Remove Zalo aliases of friends.
Check whether a friend request to a user is pending, accepted or none.
Look up one phone number on Zalo (counts toward the account's lookup limit).
Look up many phone numbers at once; one result per number.
Find a Zalo user by username.
Which friends are online now and when given users were last online (if Zalo shares it).
List pending join requests of a group.
List members blocked from a group.
Unblock a user from a group.
Transfer group ownership to a member. Type the group name as confirmName.
Read the group's current invite link and its settings.
List group invitations this account received.
Accept a received group invitation.
Decline a received group invitation (optionally block further invitations from that group).
Invite one user to several groups of the account.
List notes and polls on a group's board.
Read a poll's options and votes.
Add options to a poll.
Vote on a poll with this account.
Share a poll into the group chat.
Lock a poll so no more votes are accepted.
Edit a group note.
List reminders of a group or 1:1 conversation.
Read one reminder.
Who accepted or declined a reminder.
Edit a reminder's title, time or repeat.
Delete a reminder.
Search CRM contacts: text (name/phone), labels (any/all/exclude), stages, owners, lists, saved segment, Zalo account relation (friend/request/stranger), has phone/Zalo, do-not-contact, last interaction. Keyset paginated.
One contact with labels, stage, owner, custom fields, Zalo account links, notes, stage history and recent timeline.
Create a CRM contact (rejects a duplicate phone; returns the existing id).
Change contact fields: name, phone, gender, birthday, owner, deal value, custom fields.
Replace a contact's labels.
Add or remove one label on many contacts.
Move a contact to a pipeline stage (null = none). Recorded in stage history.
Set (or clear with null) the workspace member responsible for a contact.
Add a note to a contact.
Edit a contact note (null content deletes it).
Put a contact on (or off) the do-not-contact list; campaigns and automation skip them.
Add contacts to a static list.
Remove contacts from a static list.
Delete contacts and their CRM data. Cannot be undone.
Merge duplicate contacts into one (keeps keepId). Cannot be undone.
Which of these +84 phone numbers already exist as contacts (for de-duplicating an import).
Start an import (file name, row count, column mapping, options). Then send rows with contacts_import_chunk and close with contacts_import_finish.
Send up to 500 rows of an import; returns created/updated/duplicate/invalid counts for the chunk.
Close an import (or mark it failed).
Read an import's counts and errors.
Export contacts (ids or filter) as rows with all fields.
Look contacts' phone numbers up on Zalo through chosen accounts (queued, counts toward each account's lookup limit) to fill Zalo name/avatar/uid.
List contact labels (CRM labels; Zalo-native labels are marked).
Create or rename/recolor a label.
Xoá nhãn (cannot be undone).
List pipeline stages in order with won/lost flags.
Replace the ordered pipeline stages (ids keep existing ones).
Delete one pipeline stage that no contact is in (move them first); at least one stage stays.
Create or change a custom field (text, number, date, select).
Xoá trường tuỳ chỉnh (cannot be undone).
List static contact lists with sizes.
Create or rename a static contact list.
Xoá danh sách (cannot be undone).
List saved dynamic segments (filters).
How many contacts a saved segment (or a filter) selects now, with a sample of up to 10. No side effects.
Create or change a saved contact filter.
Xoá phân khúc (cannot be undone).
List tasks by status, assignee, contact or due date.
One task with status, due date, assignee and links.
Create a task (optionally linked to a contact, conversation or message) with due date and reminder.
Change a task's title, description, due date, assignee, reminder or status (open/done/cancelled).
Delete a task.
List message templates (workspace and the caller's private ones) with tags.
Create or change a message template (spintax {a|b} and variables like {name}; optional media).
Delete a template.
List quick replies (/shortcut) available to the caller.
Create or change a quick reply.
Delete a quick reply.
List saved media, contact cards and bank cards.
A short-lived download URL for a saved media file.
Get a signed upload URL for a library file; then call library_media_register.
Register an uploaded file in the library.
Save a contact card (Zalo user id) or bank card to reuse in messages.
Delete a library item.
Turn saved library media into attachments usable by inbox_message_send.
List campaigns with type, status, sender accounts and progress.
One campaign with its full step graph, audience, distribution, schedule and settings.
Create a draft campaign: sequence (multi-step care), broadcast (one message) or group_post (recurring group posts). Configure it with campaigns_update.
Change any part of a campaign: steps graph (messages with spintax/variables/media, waits, branches, actions), audience, exclusions, sender accounts and distribution, schedule, settings.
Step versions people are still running (editing steps of a campaign with people inside pins them to the old version), with how many are at each step.
The step graph of one campaign version: the current one, or an older version people are still running.
Move everyone on an old step version to the current steps with an explicit mapping old step id → new step id (null = stop them). Every step that has people must be mapped.
Dry run of starting the campaign now: who would join, who is left out and why (do-not-contact, excluded label, already in, in another running campaign), how people split across sender accounts (friends, phone lookups needed), accounts that would make work wait, and when the first step runs in the campaign's time zone. Also returns the validation warnings. No side effects, nothing is sent.
Check a campaign for problems (missing content, no senders, no rotation, invalid schedule). No side effects.
Count and sample who the audience filter selects and who is excluded (do-not-contact, already enrolled). No side effects.
Render a message template for one contact (variables and one spintax variant). No side effects.
Run the campaign once for one test contact from one account. This REALLY sends on Zalo.
Start a campaign: enrolls its audience and lets the scheduler run it under each account's limits, even when the AI is offline.
Pause a running campaign.
Resume a paused campaign.
Archive a campaign.
Bring an archived campaign back as paused (or draft if it never started). People it stopped stay stopped.
Duplicate a campaign as a new draft.
Delete a campaign and its enrollments. Cannot be undone.
Add contacts to a campaign (do-not-contact contacts are skipped); allowOverlap lets contacts already in another campaign join.
Stop one contact's journey in a campaign.
List enrollments: current step, state, wait reason, outcome.
Funnel per step, replies, friend accepts, A/B variants, goal conversions.
Scheduled group posts of a campaign, newest planned first: planned time, group, result (queued/posted/unverified/failed/missed) and whether it was a late catch-up.
List automation rules (When/If/Then) with enabled state and accounts.
One rule with trigger, conditions and ordered actions.
Built-in rule templates to start from.
Recent runs of a rule (or all rules) with outcome and actions done.
One rule run: outcome, each action done, notes, and the rule version it executed.
Saved versions of a rule, newest first, each with the full rule as saved.
Validate a rule definition without saving it.
Create an automation rule: trigger, conditions (labels, stage, hours, fields, group/@mention) and ordered actions.
Create and enable a rule from a built-in template for some accounts.
Delete a rule. Cannot be undone.
Read one command sent by this connection: status (accepted/queued/waiting+reason/running/succeeded/failed/cancelled/unverified), linked job/message and result.
Wait up to `seconds` (max 20) until a command finishes, then return its status. Use after inbox_message_send for the Zalo result.
This connection's recent commands, newest first, filterable by status or operation.
Cancel a command's queued job — or every unfinished item of a bulk command (a running one stops after the machine confirms; sent messages cannot be unsent).
List Zalo jobs of the caller's accounts by status with wait reasons (limits, schedule, pacing, Zalo restriction, machine offline…).
Cancel a queued job, or request a running one to stop.
Queue a failed, expired or cancelled Zalo job again as a new job with the same work (never an unverified one; a conversation send is retried with inbox_message_retry to keep its place in line). Returns the new job id.
Progress and per-item results of a bulk command (each item = one queued Zalo job: status, error). Filter by item status; page with next_cursor.
Queue again the failed / expired items of a bulk command as a new bulk command (never unverified ones; conversation sends are retried with inbox_message_retry). Returns the new operationId.
Everything that happened in the workspace since a cursor, in order, kept 7 days: messages (received, sent, status, reactions, recalls), command/job results, account/policy/Zalo-wait changes, friends and groups, customers, campaigns and journeys, rule runs, assignments, tasks, connections. Filter by types (e.g. message.received) or one account. Keep the returned cursor for the next call: events come in the order they were committed, as soon as they are committed, and a cursor never skips one (seq is the position, eventId the stable id to de-duplicate). Webhooks push the same events.
List webhook endpoints with events, enabled state and failure counts.
One webhook endpoint (events, enabled, failures, last success/failure) — never its secret.
Create a signed webhook for chosen events. Returns the signing secret once.
Change a webhook's URL, events or enabled state.
Send again every recorded event of a time range (within the 7-day keep) that this webhook subscribes to, with the same event ids. dryRun=true only counts them.
Rotate a webhook's signing secret; the new secret is returned once.
Send a test event to a webhook.
Delete a webhook endpoint.
Recent deliveries with status, attempts and response code.
Re-send one delivery now.
API keys (name, prefix, version, permissions, last use) — never the secret. Keys are created/revoked only on the web.
AI connections of the workspace (app, user, scope, status, last use).
The calling user's notifications, newest first.
Mark some or all notifications read.
Which notification types reach which channels for the caller.
Change the caller's notification preferences.
Workspace members with role and assigned Zalo accounts.
Pending member invitations.
Invite a person by email with a role and the Zalo accounts they may use.
Revoke a pending invitation.
Make a member admin or member (the owner cannot be changed here).
Set which Zalo accounts a member may use.
Remove a member from the workspace (their AI connections are revoked).
Current plan, expiry, limits and usage (accounts, machines, contacts, sends).
Public plans and their limits (prices may show 'Liên hệ').
Invoices with status and VietQR payment info.
One invoice with status, amount and VietQR payment info.
Create an upgrade/renewal invoice (a person pays by bank transfer). Confirmation required.
Cancel a pending invoice.
Cửa cũ (khoá v1) — vẫn chạy như trước
Khoá v1: xác thực & giới hạn
Gửi khoá trong header Authorization: Bearer za_live_…. Mỗi khoá 60 yêu cầu/phút; vượt sẽ nhận 429 kèm Retry-After. Lỗi luôn có dạng {"error":{"code","message"}}.
read:accounts — Xem tài khoản Zalo và trạng tháiread:inbox — Đọc hội thoại và tin nhắnsend:message — Gửi tin nhắn (qua cổng giao việc và hạn mức)read:contacts — Xem khách hàngwrite:contacts — Tạo / sửa / nhập khách hàngwrite:campaigns — Đưa khách vào chiến dịchread:reports — Đọc số liệu báo cáocurl https://zl.builera.app/api/public/v1/conversations?unanswered=true \ -H "Authorization: Bearer za_live_xxxxxxxx_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
Endpoint (/api/public/v1)
| Phương thức | Đường dẫn | Quyền | Mô tả |
|---|---|---|---|
| GET | /accounts | read:accounts | Tài khoản Zalo và trạng thái phiên/an toàn |
| GET | /contacts?search=&phone=&stageId= | read:contacts | Tìm khách (phân trang limit/offset) |
| POST | /contacts | write:contacts | Tạo khách (trùng SĐT trả khách cũ) |
| GET / PATCH / DELETE | /contacts/{id} | read/write:contacts | Xem, sửa, xoá khách |
| POST | /contacts/import | write:contacts | Nhập tối đa 1.000 khách |
| GET | /conversations?unanswered=true | read:inbox | Hội thoại, lọc khách đang chờ |
| GET | /conversations/{id}/messages | read:inbox | Tin nhắn (mới nhất trước, ?before=ts) |
| POST | /messages | send:message | Gửi tin chữ — xếp hàng theo hạn mức (202) |
| POST | /campaigns/{id}/enroll | write:campaigns | Đưa khách vào chiến dịch đang chạy |
| GET | /reports/overview?from=&to= | read:reports | Số liệu tổng quan |
curl -X POST https://zl.builera.app/api/public/v1/messages \
-H "Authorization: Bearer $ZALO_AUTO_KEY" -H "content-type: application/json" \
-d '{"conversationId":"<id>","text":"Dạ em gửi anh báo giá ạ"}'
# → 202 {"data":{"messageId":"…","status":"queued"}}Webhook
Đăng ký URL https ở Cài đặt → Tích hợp. Phải trả 2xx trong 10 giây; nếu không, hệ thống thử lại sau 1 phút, 5 phút, 30 phút, 2 giờ, 6 giờ; lỗi 20 lần liên tiếp thì webhook tự tắt. Nhật ký giữ 7 ngày.
message.received — Có tin nhắn đếnmessage.sent — Tin nhắn đã gửi đimessage.status_changed — Tin gửi đi đổi trạng thái (đã gửi / đã nhận / đã xem / lỗi / chưa xác minh)message.reaction — Có người thả cảm xúcmessage.recalled — Tin bị thu hồioperation.completed — Lệnh từ AI/API đã xong (trạng thái cuối)job.failed — Việc lỗijob.cancelled — Việc bị huỷjob.unverified — Việc chưa xác minh được (có thể đã tới Zalo)bulk.completed — Lệnh hàng loạt đã xong mọi mụcaccount.session_changed — Tài khoản Zalo đổi trạng thái phiênaccount.policy_changed — Đổi hạn mức & nhịpaccount.wait_state_changed — Zalo tạm chặn / hết tạm chặnaccount.sync_completed — Đồng bộ xongfriend.accepted — Lời mời kết bạn được chấp nhậnfriend.request_received — Có lời mời kết bạnfriend.removed — Bị huỷ kết bạn / chặngroup.joined — Tài khoản vào nhómgroup.left — Tài khoản rời / bị mời ra khỏi nhómgroup.member_joined — Có thành viên vào nhómgroup.member_left — Có thành viên rời nhómgroup.pending_request — Có người xin vào nhómcontact.created — Có khách hàng mớicontact.stage_changed — Khách đổi giai đoạncontact.updated — Sửa thông tin kháchcontact.dnc_changed — Đổi danh sách không liên hệcontact.deleted — Xoá kháchcampaign.started — Chiến dịch bắt đầucampaign.paused — Chiến dịch tạm dừngcampaign.resumed — Chiến dịch chạy tiếpcampaign.completed — Chiến dịch hoàn tấtcampaign.enrollment_step — Khách sang bước mớicampaign.enrollment_completed — Khách đi hết chiến dịchcampaign.enrollment_stopped — Khách dừng giữa chừngcampaign.occurrence — Lần đăng theo lịch (đã đăng, chạy bù, bỏ lỡ, lỗi)rule.run_completed — Luật chạy xongrule.run_failed — Luật chạy lỗiconversation.assigned — Giao hội thoạiconversation.unanswered — Hội thoại chờ trả lời quá lâutask.due — Nhiệm vụ đến hạntask.completed — Nhiệm vụ xongconnection.paused — Kết nối AI bị tạm dừngconnection.revoked — Kết nối AI bị thu hồiexternal.emergency_stop_changed — Bật / tắt dừng khẩn cấp lệnh từ ngoàiimport crypto from "node:crypto";
// header: X-ZaloAuto-Signature: t=1760000000,v1=<hex>
function verify(rawBody, header, secret) {
const [, t, v1] = /^t=(\d+),v1=([0-9a-f]{64})$/.exec(header) ?? [];
if (!t || Math.abs(Date.now() / 1000 - Number(t)) > 300) return false;
const expected = crypto.createHmac("sha256", secret).update(`${t}.${rawBody}`).digest("hex");
return crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(v1));
}MCP cũ (khoá v1)
Địa chỉ https://zl.builera.app/api/public/mcp (Streamable HTTP). Công cụ: list_accounts, list_conversations, read_messages, send_message, search_contacts, add_contact, enroll_campaign — chỉ hiện công cụ mà khoá có quyền.
{
"mcpServers": {
"zalo-auto": {
"type": "http",
"url": "https://zl.builera.app/api/public/mcp",
"headers": { "Authorization": "Bearer za_live_xxxxxxxx_xxxxxxxx…" }
}
}
}n8n, Make, Zapier
- Tạo node/scenario nhận Webhook, sao chép URL của nó và thêm vào Cài đặt → Tích hợp → Webhook, chọn sự kiện (ví dụ message.received).
- Bấm “Gửi thử” để có dữ liệu mẫu, rồi nối các bước tiếp (ghi Google Sheets, tạo deal CRM…).
- Để trả lời khách, thêm node HTTP Request: POST https://zl.builera.app/api/public/v2/ops/inbox.message.send với header Authorization: Bearer <khoá v2>, Idempotency-Key: {{$execution.id}} và body {"conversationId":"{{data.conversationId}}","text":"…"}.