Zip package v1.0.0

A Zip API credential, held in the client's own secret manager. The actual authentication scheme, issuance and renewal process, stored format, expiry, revocation path and available permission granularity are NOT established: Zip's API reference is gated behind an authenticated session, and the only official source available to this review is the ziphq.com integration-ecosystem marketing page, which describes per-API-key and per-OAuth-connection options with resource-, action- and user-role-level permissions but documents none of the underlying mechanics — do not read that page as establishing any of them.

The exact header format is likewise NOT verifiable from the official documentation available to this review (third-party integrator documentation describes an API key sent as Basic auth) — the stored material must be the complete Authorization header value (scheme included), and the scheme must be confirmed against the gated API reference before enabling. If the credential proves to be OAuth-based, an external token process must mint and refresh tokens and the client secret stays with that process; expiry and revocation behaviour is NOT established and must be confirmed against the gated reference — an expired or revoked value must fail closed.

Least privilege: grant the credential read permissions only, and only for the request, vendor and approval resources this pack registers — the ecosystem page's claim of resource- and action-level permissioning per key is unconfirmed against the reference, so a key that may write or approve anything this pack does not register is a finding.

Executor hygiene: the credential must live only in executor memory for the lifetime of a call, must never be written to logs, traces or diagnostics, and must never appear in crash reports; the executor's memory, log and crash handling are otherwise the deployment's review.

Draft package: verify the provider contract before enabling. Zip's help center states that its API reference requires an authenticated Zip session and offers no public OpenAPI specification, Postman collection, or PDF export. On 2026-09-21 the reference returned 401 to unauthenticated requests and developers.ziphq.com was an empty template.

Official marketing material describes a REST API for reading, creating, and updating vendors, requests, invoices, and purchase orders, with API-key or OAuth connections and resource-, action-, and user-role permissions. It does not establish an authentication scheme, issuance, expiry, permission granularity, or operation contract.

The live api.ziphq.com host returned 401 even for nonexistent paths; those responses do not verify routes. The registered /requests, /vendors, and /approvals paths appear only in third-party integrator documentation. Their methods, parameters, and response shapes remain unverified.

A reviewer with Zip access must open the question-mark menu's API Documentation and verify every path, method, and payload. Replace zip-api-docs-gated.invalid and any incorrect paths in every endpoint, resource locator, and network allowlist together. The allowlists match exactly. The reserved .invalid host cannot resolve and does not identify a reviewed deployment destination.

All registrations are collection reads at R0. Every create, update, delete, and request-approval action is excluded; no approval endpoint has been verified. Also excluded: users, purchase orders, invoices, payments, agreements, audit logs, the Zip MCP server, and webhook subscriptions.

The package remains draft until gated-reference verification is complete. It has not been certified by Zip. The dated help-center source https://docs.ziphq.com/api/v2/help_center/en-us/articles/49398321531675.json (retrieved 2026-09-21) supports the documentation-access restriction and lack of public exports only.

Re-review on 2026-10-29: the readable HTML help article https://docs.ziphq.com/hc/en-us/articles/49398321531675-How-to-Access-API-Documentation still requires an authenticated Zip session and says there is no public OpenAPI specification, full Postman collection or PDF export. The JSON article URL, developer hub and candidate API specification were inaccessible through the web reader. The ZipHQ GitHub organization lists a developer-quality tool, not an API contract. All three operation contracts and the credential mechanics remain unverified; keep this draft disabled.