Skip to content
/Decision Engine

Public API Reference (2025-07-30)

The Zephr Public API provides common client-side actions tied to a session cookie. Unlike the Admin API, neither users nor other resources can be dereferenced; the only data that can be accessed is owned by the user who is currently signed-in. This design is used to protect other users from malicious attacks.

You can find the base URL for the Public API by navigating to your site domains. To do this, select Sites from the Delivery menu, select your site, and then click the Site Domains button. The base URL is the Live domain.

Zephr forms use the Public API by default, with relative URLs based on the base URL.

Download OpenAPI description
index.json
index.yaml
Languages
Servers
Mock server
https://developer.zuora.com/_mock/zephr-api-reference/zephr-public-api
https://{your-domain}

Authentication

Operations

Braintree Payments

Operations

Browser Feature Transformations

Operations

Decision Engine

Operations

Execute the Decision Engine

Request

The Blaize Decision Engine can be invoked via the Public API to calculate an HTTP Response based upon Request-Level Rules created in the Admin Console. This functionality is built into the Blaize Dynamic CDN but the API variant is useful for CMS or edge side integrations.

Security
CookieBlaizeSession or JwtQuery or JwtHeaderXBlaizeJwt or JwtHeaderXZephrJwt or JwtBearer or JwtCookie
Bodyapplication/json
pathstringrequired
Example: "/x.html"
http_methodstring
Example: "POST"
sessionstring
Example: "xxx-xxx-xxx"
foreign_keysobject

Foreign system and ID used to identify the user.

Example: {}
request_headersobject
Example: {"User-Agent":"<userAgent>"}
content_metadataobject
Example: {"publishedDate":"<contentAge>"}
jwtstring
Example: "xxx-xxx-xxx"
btrstring

MD5-hex-encoding of: path + "|" + trusted referrer secret

Example: "17e74b9e49e66282e55d4b7ec73de951"
curl -i -X POST \
  https://developer.zuora.com/_mock/zephr-api-reference/zephr-public-api/blaize/decision-engine \
  -H 'Content-Type: application/json' \
  -b blaize_session=YOUR_API_KEY_HERE \
  -d '{
    "path": "/x.html",
    "http_method": "POST",
    "session": "xxx-xxx-xxx",
    "foreign_keys": {},
    "request_headers": {
      "User-Agent": "<userAgent>"
    },
    "content_metadata": {
      "publishedDate": "<contentAge>"
    },
    "jwt": "xxx-xxx-xxx",
    "btr": "17e74b9e49e66282e55d4b7ec73de951"
  }'

Responses

OK

Bodyapplication/json
statusstring
Example: "301"
bodystring
Example: "Redirecting to login page..."
Locationstring
Example: "/login.html"
Response
application/json
{
  "status": "301",
  "body": "Redirecting to login page...",
  "headers": {
    "Location": "/login.html"
  }
}

Retrieve the Decision Engine

Request

For compatibility with CDN, any web headers (Referrer, User-Agent) will be accepted and passed onto the rule engine.

Security
CookieBlaizeSession or JwtQuery or JwtHeaderXBlaizeJwt or JwtHeaderXZephrJwt or JwtBearer or JwtCookie
Query
pathstringrequired

Uniquely identifies the content Zephr is making a decision about. Request rules can be configured to only execute when the request path matches a provided regular expression.

sessionstringrequired

Zephr Session ID - same as the blaize_session cookie used by the CDN and authentication endpoints.

foreign_id.xxxstringrequired

Foreign ID used to identify the user. The foreign system is parsed as the remainder of the parameter key name following 'foreign_id.'

content_idstringrequired

Passed as metadata.content_id to the Content API template, used to perform requests to a 3rd party API for additional content information used in making a decision.

jwtstringrequired

A JSON Web Token, may include identity or product holding claims.

btrstringrequired

A trusted referrer token. If Zephr generates a matching token using path, passed-in Referer header and a configured secret, all entitlements used in this decision will be temporarily granted for this request.

curl -i -X GET \
  'https://developer.zuora.com/_mock/zephr-api-reference/zephr-public-api/blaize/decision-engine?path=string&session=string&foreign_id.xxx=string&content_id=string&jwt=string&btr=string' \
  -b blaize_session=YOUR_API_KEY_HERE

Responses

Response status and body are determined by the executed rule. If there is an error executing the rule, a 200 will be returned.

Dynamic Offer Decision Engine

Operations

Dynamic Offer Promo Code Decision

Operations

OAuth Flow

Operations

Payments

Operations

Product Sharing

Operations

SDK Feature Decision Engine

Operations

Sessions

Operations

Stripe Payments

Operations

Third-Party Authentication

This section contains the API operations for the OAuth 2.0 Authorization Code Flow.

Operations

User

Operations

V4 Gifts

Create a Gift resource for V4. Gifts can be used to provide access to a particular URL for one session only by appending a gift token ID to the URL as the gift path parameter.

Operations

Web Analytics

Operations

Zephr Features

Operations

Component Library

Operations

Change the Stripe subscription price

Request

Generates a new preview of the price that Stripe will charge the customer if they create a new subscription for the specified plan. Note: This method does not create any entities in Stripe and does not result in any payments being made.

Security
CookieBlaizeSession or JwtQuery or JwtHeaderXBlaizeJwt or JwtHeaderXZephrJwt or JwtBearer or JwtCookie
Path
externalIdstringrequired
Bodyapplication/json
plan_idstring
curl -i -X POST \
  'https://developer.zuora.com/_mock/zephr-api-reference/zephr-public-api/zephr/payment/stripe/subscriptions/{externalId}/change-previews' \
  -H 'Content-Type: application/json' \
  -b blaize_session=YOUR_API_KEY_HERE \
  -d '{
    "plan_id": "string"
  }'

Responses

OK

Bodyapplication/json
totalnumber

The total amount the user will be initially charged for the subscription in the relevant currency's lowest denomination (e.g. pence), i.e. for a monthly subscription, the first month's cost.

Example: 5000
sub_totalnumber

The total amount minus tax for the initial charge in the relevant currency's lowest denomination (e.g. pence).

Example: 4500
Response
application/json
{
  "total": 5000,
  "sub_total": 4500
}

Oauth2 Access Token

Operations

Subscription

Operations