Zoopla Leads API

Zoopla Leads API

Standout includes a Zoopla Leads API integration for applicant and appraisal leads. Production use requires the shared OAuth client credentials/lead permissions supplied by Zoopla to ISSL/Standout.

Agency branch setup

Open Administration → Feeds/Portals → Inbound portal enquiries, create/edit the Zoopla connection and enter Zoopla's internal Branch ID for that branch.

This is Zoopla's own branch identifier. It is not the Standout Office ID.

Authentication model

The Leads integration uses OAuth2 machine-to-machine authentication. The normal production token request uses:

• grant type client_credentials;
• the shared Zoopla client ID and client secret;
• audience https://services.zoopla.co.uk.

Zoopla returns a bearer access token which Standout caches until shortly before expiry.

Standout also contains a diagnostic-only comparison for Zoopla's generic HTTP Basic / api/api_access OAuth form. That comparison is useful for troubleshooting, but normal live lead syncing does not silently switch to the generic token if the Leads authentication fails.

Endpoints

When enabled, Standout tests/polls:

GET /applicant-leads
GET /appraisal-leads

with a time window and the Zoopla internal Branch ID.

Applicant leads are normalised into appropriate viewing/sales/rental/general enquiries where the payload supports it. Appraisal leads are treated as valuation enquiries.

Tools diagnostic

Use Tools → Zoopla API (ISSL users) to test a real Zoopla branch before enabling a customer connection.

The diagnostic can report:

• token endpoint and Leads API host;
• token HTTP status/type/expiry;
• JWT audience/scopes where visible;
• whether expected lead permissions appear in the token;
• /applicant-leads result;
• /appraisal-leads result;
• safe error/response detail;
• optional generic-OAuth comparison.

The access token and client secret are not displayed.

If the token works but lead calls fail

Check the Zoopla branch ID and the permissions/scopes provisioned to the client. A valid OAuth token does not by itself prove that the client has permission to read Leads for the requested branch.

Credential provisioning

Zoopla uses a GPG-encrypted credential handover process for the shared client_secret. The public GPG key can be sent to Zoopla; the private key/passphrase must remain private to ISSL. Once Zoopla returns the client ID and encrypted secret, decrypt the secret securely and enter it under the shared Zoopla settings.

See Inbound Enquiries and Communications Centre.