Get started with ZeroDayAPI

Make your first chat-completions request and inspect the result in your console.

Check model availability. Requests require a published alias and enough available credit for the maximum reservation.

Prerequisites

Before you begin, you’ll need:

A ZeroDayAPI console account.
An API key from the API keys page.
A published model alias and available account credit.

Base URLhttps://app.zerodayapi.com/v1

Call the API

Choose your language, then follow the steps below.

1Set your API key

Create a key in API keys, then export it as ZERODAY_API_KEY. Copy the full key now—it is shown only once.

Terminal · macOS / Linux

export ZERODAY_API_KEY="your-api-key"
export ZERODAY_BASE_URL="https://app.zerodayapi.com/v1"

2Create an environment and install the SDK

Create a virtual environment and install the OpenAI Python SDK:

Terminal

python3 -m venv .venv
source .venv/bin/activate
pip install openai

3Send your first request

Save the following code as quickstart.py. Replace your-model-id with an available alias from the model catalog.

quickstart.py

import os
from openai import OpenAI

client = OpenAI(
    base_url=os.environ["ZERODAY_BASE_URL"],
    api_key=os.environ["ZERODAY_API_KEY"],
)

result = client.chat.completions.create(
    model="your-model-id",
    messages=[
        {"role": "user", "content": "Review this incident summary."}
    ],
)

print(result.choices[0].message.content)

Run your file from the same terminal:

Terminal

python quickstart.py

With a configured provider, the response contains an assistant message and usage metadata. Inspect request history

Authentication

Include your API key in the Authorization header on every chat-completions request. Use the Bearer authentication scheme:

Request header

Authorization: Bearer <your-api-key>

Keys use the zd_live_ prefix. Create separate keys for each application or environment, and revoke unused keys in the console.

Chat completions

POST/v1/chat/completions

Send a JSON request body containing a model and a messages array. The response contains the model’s assistant message and token usage.

Parameter	Type	Description
`model`Required	string	The exact identifier of a model listed below.
`messages`Required	array	A list of messages with `role` and string `content`.
`messages[].role`	string	Use `system`, `developer`, `user`, `assistant`, or `tool`.
`messages[].content`	string	The text you want to submit for analysis.
`max_tokens`	integer	Maximum output tokens. Alternatively use `max_completion_tokens`, never both.
`stream`	boolean	Receive incremental OpenAI-compatible SSE chunks. Set `stream_options.include_usage` to receive final usage when available.
`tools` / `tool_choice`	array / string or object	Function tools when the published alias advertises tool support.
`response_format`	object	JSON object or JSON schema when structured output is advertised.

Sampling options include temperature, top_p, and stop. Reasoning effort is accepted only when advertised. Unsupported fields, image input, provider overrides, and multiple choices are rejected explicitly.

Response format

The OpenAI-compatible format places the answer in choices[0].message.content and token counts in usage. This is a protocol example, not a live response.

Response shape

{
  "id": "chatcmpl-…",
  "object": "chat.completion",
  "created": 1793448000,
  "model": "your-model-id",
  "choices": [{
    "index": 0,
    "message": { "role": "assistant", "content": "…" },
    "finish_reason": "stop"
  }],
  "usage": {
    "prompt_tokens": 8,
    "completion_tokens": 64,
    "total_tokens": 72
  }
}

Inspect the recorded model, tokens, status, and latency in Requests. Aggregate activity appears in Usage.

Every response includes X-Request-ID. Completion IDs and model names are normalized by ZeroDayAPI. Missing authoritative usage is shown as pending reconciliation, not an invented zero-token result.

Model catalog

Use the exact model identifier published in the catalog. Model access is managed by ZeroDayAPI; aliases appear only after an approved provider is connected.

GET/v1/models

Authenticate with a key that has models:read permission. Check Models in the console for published IDs, context/output limits, capabilities and buyer prices. An empty catalog means no model alias is published for your key.

Rates are published in micro-USD per million tokens; 1 USD equals 1,000,000 micro-USD. Prices are pinned when a request is admitted. Exact-model fallback does not change your rate.

Errors & limits

Check the HTTP status before reading a completion. If every compatible route is unavailable or at capacity, the gateway returns a sanitized error:

503 Service Unavailable

{
  "error": {
    "message": "No compatible route is currently available.",
    "type": "server_error",
    "code": "no_eligible_route",
    "param": null,
    "request_id": "req_…"
  }
}

Status	Meaning	What to do
`400`	Malformed request	Check JSON syntax and the content-type header.
`401`	Authentication failed	Check the Bearer header and confirm the key has not been revoked.
`402`	Credit or spending limit	Check available credit and key/account spending limits. Reservations count toward limits.
`403 / 404`	Permission or alias unavailable	Check key scopes, allowed aliases, and the published model list.
`409`	Already admitted / idempotency conflict	Inspect request status; do not silently create a second generation.
`429`	Rate, concurrency or key-count limit	Respect Retry-After and the configured limits. Accounts allow 25 active keys.
`502 / 504`	Unconfirmed result or timeout	Inspect request status before retrying. The upstream may have performed work.
`503`	No eligible capacity	Respect Retry-After; contact support if availability does not recover.

Maximum request cost is reserved before dispatch, then settled from verified usage with unused credit released. Unknown usage remains reserved for reconciliation for up to 15 minutes; unresolved buyer holds are released afterward. Provider cost remains a separate operator record.

Work alongside your security tools

Use the API from your existing investigation workflow. Export a relevant request, finding, or code excerpt and include the text in a chat message.

Burp Suite & OWASP ZAP

Export the request or finding you want to examine. Run and verify any checks in your proxy. A native extension is not included.

Binary analysis tools

Use relevant disassembly or decompiled text as message content. Keep execution and validation in your analysis environment.

Data handling

The local gateway records request metadata: model ID, input and output token counts, HTTP status, latency, and timestamp. Its request log does not store prompt or response content.

Only the selected route receives the inference payload; an allowed same-model fallback may send it to the next provider. Buyers’ keys, identities, account data and routing history are not forwarded. Provider-side retention is separate from the gateway’s no-content-storage policy and must match the published alias contract.

Request metadata and financial records persist for operational and accounting review. Remove credentials and unrelated sensitive information from submitted excerpts. This build does not claim automatic metadata deletion or universal provider zero retention.

Keep building

Bring your first workflow to life.

Create a key, send a request, and inspect the result in your console.

Open your console