View source for Zoopla Leads API

__NOTOC__
= Zoopla Leads API =

Standout includes a Zoopla Leads API integration for applicant and appraisal leads. Production use requires the shared OAuth client credentials/lead permissions supplied by Zoopla to ISSL/Standout.

== Agency branch setup ==

Open '''Administration → Feeds/Portals → Inbound portal enquiries''', create/edit the Zoopla connection and enter Zoopla's '''internal Branch ID''' for that branch.

This is Zoopla's own branch identifier. It is not the Standout Office ID.

== Authentication model ==

The Leads integration uses OAuth2 machine-to-machine authentication. The normal production token request uses:

* grant type <code>client_credentials</code>;
* the shared Zoopla client ID and client secret;
* audience <code>https://services.zoopla.co.uk</code>.

Zoopla returns a bearer access token which Standout caches until shortly before expiry.

Standout also contains a diagnostic-only comparison for Zoopla's generic HTTP Basic / <code>api/api_access</code> OAuth form. That comparison is useful for troubleshooting, but normal live lead syncing does not silently switch to the generic token if the Leads authentication fails.

== Endpoints ==

When enabled, Standout tests/polls:

<pre>GET /applicant-leads
GET /appraisal-leads</pre>

with a time window and the Zoopla internal Branch ID.

Applicant leads are normalised into appropriate viewing/sales/rental/general enquiries where the payload supports it. Appraisal leads are treated as valuation enquiries.

== Tools diagnostic ==

Use '''Tools → Zoopla API''' (ISSL users) to test a real Zoopla branch before enabling a customer connection.

The diagnostic can report:

* token endpoint and Leads API host;
* token HTTP status/type/expiry;
* JWT audience/scopes where visible;
* whether expected lead permissions appear in the token;
* <code>/applicant-leads</code> result;
* <code>/appraisal-leads</code> result;
* safe error/response detail;
* optional generic-OAuth comparison.

The access token and client secret are not displayed.

== If the token works but lead calls fail ==

Check the Zoopla branch ID and the permissions/scopes provisioned to the client. A valid OAuth token does not by itself prove that the client has permission to read Leads for the requested branch.

== Credential provisioning ==

Zoopla uses a GPG-encrypted credential handover process for the shared <code>client_secret</code>. The public GPG key can be sent to Zoopla; the private key/passphrase must remain private to ISSL. Once Zoopla returns the client ID and encrypted secret, decrypt the secret securely and enter it under the shared Zoopla settings.

See [[Inbound Enquiries]] and [[Communications Centre]].

[[Category:Zoopla]]
[[Category:Inbound enquiries]]