Partner API · ZFlow Docs

Read your account data from scripts, bots and spreadsheets. Read-only: money is not moved through the API.

Key#

Open the “API” tab
In the panel, under “More”.
Click “Create key”
The key looks like zf_live_… and is shown only once. Copy it right away: only a fingerprint is stored in the database.
Keep it like a password
The key gives access to your statistics and balance. If it leaks — click “Reissue”: the old key stops working immediately. “Revoke” disables the API entirely.

The API tab: the access key and the “Copy the key now” block — The key is shown once — copy it right away. Demo data. Click to enlarge.

Do not put the key into site or frontend code — visitors will see it. Call the API only from a server or your own scripts.

Authorization and limits#

The base address is https://zflow.pro/api/v1. The key is passed in a header:

http

Authorization: Bearer zf_live_xxxxxxxxxxxxxxxxxxxxxxxx

Only the GET method, responses in JSON. The ok field is true or false.
All amounts are in rubles (fields with the _rub suffix).
The limit is 60 requests per minute per key. When exceeded, the response is 429 with a Retry-After header.
Data updates together with the panel sync, about once a minute — polling more often makes no sense.

GET /me#

GET/api/v1/me

The partner profile: current share, volume (turnover_rub) and balance.

json

{
  "ok": true,
  "username": "partner",
  "split_percent": 70,
  "base_split_percent": 70,
  "tier_reached": false,
  "turnover_rub": 12450.5,
  "balance_rub": {
    "share": 8715.35,
    "available": 5400.0,
    "hold": 3315.35,
    "pending": 0,
    "paid": 0,
    "bonus": 0
  }
}

Balance field	Meaning
`available`	Can be withdrawn now.
`hold`	The CS2 share waiting for the trade protection to end (8 days).
`pending`	A withdrawal is ordered and awaits processing.
`paid`	Already paid out.
`share` / `bonus`	Total accrued / manual accruals from the owner.

GET /domains#

GET/api/v1/domains

All your domains with totals for each.

json

{
  "ok": true,
  "domains": [
    {
      "domain": "skins-example.com",
      "status": "live",
      "created_at": "2026-10-06 00:46:12",
      "visits": 174,
      "orders": 1,
      "volume_rub": 5.9,
      "share_rub": 5.31
    }
  ]
}

volume_rub is the volume of completed deals in settlement value (60% of the market price), share_rub is your share accrued for the domain (from recorded accruals).

Status: pending — waiting for DNS, dns_ok — the domain is behind Cloudflare, live — working.

GET /stats#

GET/api/v1/stats?domain=skins-example.com

Statistics for all domains, or for one if domain is passed. Someone else’s or a non-existent domain gives a 404 error.

json

{
  "ok": true,
  "synced_at": "2026-10-18 08:14:02",
  "domains": ["skins-example.com"],
  "volume_rub": 5.9,
  "share_rub": 5.31,
  "orders": 1,
  "pending_orders": 0,
  "pending_value_rub": 0,
  "items_sold": 1,
  "avg_check_rub": 5.9,
  "metrics": { "online": 0, "visits": 175, "authClicks": 6, "authSuccess": 4 },
  "series": [{ "day": "2026-10-18", "orders": 0, "volume_rub": 0 }],
  "traffic": [{ "day": "2026-10-18", "visits": 3, "logins": 1 }]
}

series and traffic cover 31 days by date (UTC), the last element is today. If no domain is given, volume_rub and share_rub are everything accrued to you, including deleted domains. The meaning of the numbers is as in the Statistics section.

GET /requests#

GET/api/v1/requests?limit=20&status=COMPLETED

Parameter	Meaning
`limit`	How many requests to return: 1–100, 20 by default.
`status`	`COMPLETED`, `AWAITING_TRADE`, `HOLD` or `PENDING`. Without the parameter — any.
`domain`	Only requests of this domain.

json

{
  "ok": true,
  "requests": [
    {
      "id": "a1b2c3",
      "status": "COMPLETED",
      "created_at": "2026-10-06 00:46:12",
      "domain": "skins-example.com",
      "value_rub": 5.9,
      "seller": "Nickname",
      "items": [{ "name": "P250 | Sleet (Factory New)", "price_rub": 5.9 }]
    }
  ]
}

Sellers’ Steam account data (SteamID, avatar) is not returned through the API — only the nickname.

Errors#

Code	When
`401`	No header, the key is wrong or revoked, or the account is blocked.
`404`	Unknown method or the domain does not belong to you.
`400`	An invalid parameter value.
`429`	More than 60 requests per minute.

The error field is in English; error_ru carries the same message in Russian. For logic, rely on the HTTP code and ok: false, not on the text.

json

{
  "ok": false,
  "error": "Invalid or missing key. Send the header Authorization: Bearer <key>.",
  "error_ru": "Неверный или отсутствующий ключ. Передай заголовок Authorization: Bearer <ключ>."
}

python

import requests

r = requests.get(
    "https://zflow.pro/api/v1/stats",
    headers={"Authorization": "Bearer zf_live_..."},
    timeout=15,
)
print(r.json()["share_rub"])