# Overview

> How the Zactonz APIs are shaped, and a first request in under a minute.

Page: https://developers.zactonz.com/apis/overview/

All Zactonz APIs live under one host, `https://api.zactonz.com`, and share one shape: plain HTTP in, JSON out. There is nothing to install and nothing to configure beyond your API key. If you would rather not write HTTP calls, the [PHP SDK](https://developers.zactonz.com/tools/zactonz-php/) wraps every endpoint, and the [MCP server](https://developers.zactonz.com/tools/zactonz-mcp/) exposes them to AI assistants.

## Your first request

Send your API key as a Bearer token and call any endpoint. The QR Encoder is a good first test:

```bash
curl "https://api.zactonz.com/qr/enc/?content=https://zactonz.com&size=6" \
  -H "Authorization: Bearer YOUR_API_KEY"
```

```json
{
  "status": 200,
  "data": {
    "qr": "https://api.zactonz.com/qr/enc/i/qDB76_184XsQzKpYx4e.png",
    "size": 6,
    "accuracy": "M",
    "format": "png"
  }
}
```

## Requests

- **GET endpoints** take parameters in the query string.
- **POST endpoints** take parameters as `application/x-www-form-urlencoded` form fields, exactly as an HTML form would send them. JSON request bodies are not read.
- Every reference page shows the exact method and lists each parameter with its type, default and allowed values.

## Responses

Every reply is a JSON object with a `status` field that reports the outcome and, on success, a `data` payload. Some endpoints report the status as a number (`200`) and some as a string (`"200"`); each reference page says which. Compare loosely or cast before comparing.

Most endpoints answer with HTTP 200 even when the operation failed and carry the failure in `status` instead. Read [Errors & status codes](https://developers.zactonz.com/apis/errors/) before writing error handling.

## Keys

Every request carries an API key in the `Authorization: Bearer` header. Requests without one are rejected with status `401`. See [Authentication](https://developers.zactonz.com/apis/authentication/) for how keys are issued and scoped.

## Timeouts

Several endpoints do real work per call: rendering a web page, talking to a mail server, probing media streams. Give your HTTP client a timeout of at least 60 seconds for the Screenshot, Mail Verifier and Video endpoints.