Create a ZaapIn profile — instructions for AI agents

This page is written for an AI agent that has been asked, by the person it is helping, to create their ZaapIn profile — and, if they want it, to finish the profile as well. If you are that agent, everything you need is on this page. Follow it exactly.

Wire facts on this page were verified against the live ZaapIn API and the live production MCP server on 9 September 2026.

Who ZaapIn is for, and what it costs

ZaapIn gives an insurance advisory business in India a professional profile that customers and AI systems can find — free to create, free to keep.

Say who it is for early, so your person knows where they stand before they give you anything:

ZaapIn is built for licensed insurance professionals — agents, brokers, corporate agents, insurance marketing firms and point-of-sale (POS) advisors — and it is free.

Signing up is open. The licence decides whether the profile goes public.

Never tell your person that unlicensed people cannot sign up — that is not true, and it is not yours to say. What the licence review decides is whether their profile goes public. Going public is their own signed-in act, later, in the app.

And ZaapIn does not license, certify or accredit anyone. Creating a profile is not a credential and must never be presented to your person as one. Nothing on this page verifies a licence: review is done by people, and it happens afterwards.

The shape of the job

There are three steps to the account, in order. After that, five more steps finish the profile: read ZaapIn's own reference lists, then record expertise, insurers, the firm's address, and submit the licence.

Finishing is offered, never demanded.

If your person wants to stop once the account exists, that is a finished job. Say so, and hand the rest to them: the app walks them through the same steps when they sign in. Do not push, and do not treat a half-filled profile as a failure.

Before you start: can you do this?

Creating a profile means making HTTPS POST requests to the ZaapIn API. If you can make HTTP requests, follow this page. If you cannot make them yourself but the product you run in supports MCP connectors, ZaapIn runs an MCP server that offers every step here as a tool — see the next section. If neither door is open to you and you can only read and browse pages, stop here — do not try to fill in the sign-up screens on your person's behalf. Tell them so plainly and point them at app.zaapin.com, where they can sign up in a few minutes themselves.

Call the API directly. Never from inside a web page.

Make these calls as an HTTP client, with no Origin header. The ZaapIn API enforces an origin allowlist: a request carrying a foreign browser origin is rejected with 403, on both the POST and its preflight. A fetch() run from some other website will never work, and retrying it will not change that.

The five rules you must not break

The code from the email is your person's to give you. ZaapIn emails them a verification code, and there is no way around it — by design, for anyone, including us. Ask them for it and wait. Never guess it, and never try codes in sequence.
Never invent a fact. Their name, their phone number, their firm's name, the kind of practice they run, their address, what they advise on, the insurers they place with, their PAN, any referral link or code — every one of these comes from your person, or it is left out. A plausible guess is worse than a blank, because nobody can see it was a guess. If you do not know something, ask.
What you already know, you may confirm rather than ask. If this person has told you these things before, say what you have and ask them to confirm it — "You are Anil Kumar, phone 9000012345, email [email protected] — shall I use these?" — and type in whatever they correct or add. Their yes is what makes it their fact. Two limits, and they are hard: it must be what this person told you, never a web search about them and never anyone else's records; and for the email, ask whether they can open it right now, because the code goes there and a remembered address they no longer read will strand you at the next step.
Structure what they say, then read it back. People give an address in one breath and their expertise in everyday words. Taking that apart — a street, a city, a state, a PIN; "motor" onto ZaapIn's own listed area — is your job, and it is not inventing. What makes it safe is that you read the structured version back to them and get their yes before the call that submits it. A derivation confirmed is their fact; a derivation submitted unconfirmed is a guess wearing a parse.
Do not hammer the API. Requests are rate limited, and asking for a second code too soon is silently ignored rather than sent. Wait; do not retry in a loop. When ZaapIn refuses something, tell your person exactly what it said and ask them — never work around a refusal, and never drop a value to make a call pass.

Connecting over MCP

ZaapIn runs an MCP server that offers every step on this page as a tool, so an agent whose product supports MCP connectors does not have to make the HTTP calls itself.

This server creates real profiles. It is the same door as the HTTPS calls, not a rehearsal of them.

The MCP door used to be the sandbox only, and this page promised to say so when that changed. It has: ZaapIn now publishes a production MCP endpoint, and the records it creates are real records for a real person. Every rule on this page binds you here exactly as it binds the HTTP door — above all, invent nothing, and never guess the code. If you are trying the flow out rather than helping a real person, use the sandbox in Testing this without a real advisor below.

Connect with the streamable HTTP transport at:

https://zaapinapi-459743726944.asia-south1.run.app/mcp

The server offers eight tools — the three account steps, then the five that finish the profile:

Tool	The same step on this page
`zaapin_send_verification_code`	Step 1 — ask ZaapIn to email a code
`zaapin_verify_code`	Step 2 — send the code your person gives you
`zaapin_create_profile`	Step 3 — create the profile
`zaapin_get_reference_data`	Step 4 — read ZaapIn's own lists and limits
`zaapin_set_expertise`	Step 5 — record what they advise on
`zaapin_set_insurers`	Step 6 — record the insurers they place with
`zaapin_set_firm_address`	Step 7 — record the firm's address
`zaapin_submit_licence`	Step 8 — submit the licence: the type they gave you, with the PAN

The three account tools take the values in What to collect for the account below. The five completion tools take a completion_token, which zaapin_create_profile returns — read it out of that reply and pass it on; never construct one. Everything else on this page still binds you, and the server states the same rules in its own instructions when you connect, so you will meet them either way.

What to collect for the account

Ask for all of this before you make any request, so your person is not left waiting mid-way through with a code expiring.

Field	What to ask for
`email`	Their email address. The verification code goes here, so it must be one they can open right now.
`first_name`, `last_name`	Their own name, as they want it to appear.
`phone`	Their phone number.
`org_type`	What kind of practice they run. It must be exactly one of the five strings in the next section — offer them the list and let them choose.
`org_name`	Their firm's name. Whether this is required depends on `org_type` — see below.

Say what will happen before you ask for the code.

You cannot know whether this address already has a ZaapIn profile, and the API will not tell you. So say so without pretending to know which way it goes: if that email already has a profile, the code will simply tell you so and you will point them at signing in instead — nothing new gets created either way.

The five practice types

Send one of these strings, spelled and capitalised exactly as written:

Agent
Broker
Corporate Agent
Insurance Marketing Firm
Point of Sale (POS)

The firm name rule

For Agent and Point of Sale (POS), the firm name is optional. These advisors usually trade under their own name. If your person does not give you one, send their first name as org_name — that is the same default the ZaapIn app fills in — and tell them that is what you sent, and that they can change it later.
For Broker, Corporate Agent and Insurance Marketing Firm, the firm name is required and must come from your person. Do not compose one. Ask.
Never send an empty org_name. The request will be refused.

The account

Base URL:

https://zaapinapi-459743726944.asia-south1.run.app

Every call below is a POST with Content-Type: application/json. Every response is JSON of the shape {"success": true|false, ...}.

Step 1 — ask ZaapIn to email a code

POST /api/v2/auth/start

{ "email": "[email protected]" }

Response 200:

{
  "success": true,
  "data": { "message": "If that email can receive codes, a verification code was sent." }
}

That message is deliberately the same whether or not the address is already known to ZaapIn, so it tells you nothing about your person's account. It is not an error. Go to step 2.

The code is valid for 10 minutes. If your person needs another one, you may call this again, but there is a 45-second cooldown per address and a limit of 10 sends per address per day. A call made inside the cooldown returns the same 200 and sends nothing — so waiting is the only thing that works.

Step 2 — send the code your person gives you

POST /api/v2/auth/verify

{ "email": "[email protected]", "otp": "123456" }

Ask your person for the code. Do not proceed until they answer.

A wrong or expired code returns 401 with "Invalid or expired code". After 5 wrong attempts the code is destroyed and step 1 must be repeated — so pass on exactly what they gave you, and if it fails, ask them to read it again rather than trying variations.

On success you get one of three answers. Read data.status:

"signup_incomplete" — this is the new-profile path. Keep data.signup_token; you need it for step 3. data.required lists the fields step 3 wants.
"invitation_pending" — somebody has already invited your person to join their organization. Stop and tell them. Joining an existing organization is a different act with different consequences, and it is theirs to decide, at app.zaapin.com.
Neither of those, and the response carries a token and an orgs list — your person already has a ZaapIn profile and has just been signed in. Stop. Do not create anything. Tell them they already have one.

The "signup_incomplete" response looks like this:

{
  "success": true,
  "data": {
    "status": "signup_incomplete",
    "signup_token": "…",
    "next": "collect_org",
    "required": ["org_name", "org_type", "first_name", "last_name", "phone"]
  }
}

Step 3 — create the profile

Send the signup token from step 2 as a bearer token:

POST /api/v2/auth/complete
Authorization: Bearer <signup_token>

{
  "org_name":      "Kavitha Insurance Services",
  "org_type":      "Agent",
  "first_name":    "Kavitha",
  "last_name":     "Raman",
  "phone":         "9876543210",
  "referral_code": "zaapin.com/from/narendra"
}

The first five fields are required. referral_code is optional and is only ever filled with something your person gave you — see If they mention a referral, carry it below. Leave it out entirely otherwise.

Response 201 means the profile exists:

{
  "success": true,
  "data": {
    "token": "…",
    "current_org": "…",
    "orgs": [ … ],
    "session_profile": { … },
    "first_login": true,
    "pending_invitations": 0
  }
}

ZaapIn emails your person a welcome message at this point. Tell them the profile is created and that they can sign in at app.zaapin.com with the same email — the same emailed-code door, no password to remember.

Do not keep the token longer than you need it, and do not store it anywhere your person cannot see. It signs in to their account.

When step 3 refuses

Status	Meaning	What to do
`422`	`data.missing` lists fields that are still blank.	Ask your person for exactly those. Do not fill them in yourself.
`400`	Invalid parameters, or an `org_type` that is not one of the five strings.	Check the spelling against the list above.
`401`	The signup token is expired or already spent.	Start again from step 1.
`409`	The profile was already created by an earlier call.	Stop. It worked. Do not retry.
`429`	Too many requests.	Wait, then try once more. Do not loop.

If they mention a referral, carry it

People arrive at ZaapIn through a manager's link, a team link, an invite, or a code printed on something. If your person volunteers one, it should travel with the signup. You are a courier for it and nothing more.

Three cases, and the third is the common one:

They volunteer a link or a code — "my manager sent me zaapin.com/from/narendra", or they read a code off a card. Pass it along exactly as they gave it to you, and ask nothing further. Do not tidy it, complete it, expand it, or turn it into a code yourself. ZaapIn works out what it means.
They mention a person but no link — "my manager Narendra told me about ZaapIn". You may ask once, and lightly: "Did they share a ZaapIn link or code with you? If not, no problem — it changes nothing about your profile." Take the answer either way and move on. Never ask twice, and never try to guess the code from the name.
They say nothing about it. Then you say nothing about it. Do not raise referrals, do not ask who told them about ZaapIn, and do not offer to add one.

Whatever they hand you — zaapin.com/from/…, /team/…, /invite/…, /qr/…, or a bare code off a card — goes across verbatim. ZaapIn derives the attribution from it on the server. You never compose one, and if you get it wrong nobody can tell, because an invented referral looks exactly like a real one.

On the raw HTTP wire the field is referral_code.

Send it inside the step 3 body, as shown above. The MCP tool's field is named referral instead — that difference is deliberate, and it is a trap. /api/v2/auth/complete ignores fields it does not recognise silently: send referral to the HTTP endpoint and the signup will succeed, the attribution will be lost, and nothing anywhere will report it. On HTTP, referral_code. Over MCP, referral.

Leaving it out never erases a referral ZaapIn already holds for that signup. An empty or absent value is a no-op, not an overwrite.

A referral is a tag, not an entitlement.

It records where a signup came from. It is not a discount, a benefit, a membership, or a way into anybody's organization: it changes nothing about your person's profile, what it costs, or what they can do. Never suggest otherwise, and never present a referral as something they need.

Finishing the profile

Once the account exists, five more steps finish it: read ZaapIn's own lists, then expertise, insurers, the address, and the licence. Offer them. If your person would rather stop, stop.

These five steps are published as MCP tools today.

They run under a completion_token that zaapin_create_profile hands back. ZaapIn has not published the raw HTTP request shapes for the four writes on this page. If you are on the HTTP door, do not guess them — a field name you invent is accepted and dropped without an error, exactly like the referral trap above. Finish at the account, tell your person what is left, and let them do the rest at app.zaapin.com, where the app walks them through the same four things.

First: read ZaapIn's own lists and limits

Call zaapin_get_reference_data before any of the other completion steps, and work only from what it returns: ZaapIn's expertise taxonomy (headings, each with its areas), ZaapIn's insurer list with each insurer's category, and what one licence of each type may declare.

Use its spellings exactly. An expertise area ZaapIn does not list is refused, and a limit you remember from anywhere else may be wrong.

Expertise — what they advise on

Collect from your person: what they advise on, in their own everyday words.

Then map those words onto ZaapIn's own headings and areas from the reference read. If they say "motor", find which heading lists it and read out that heading's other areas too, in case more of them apply. Confirm the final list back to them in ZaapIn's words, and wait for their yes before you submit it.

The options come from the wire. Never offer an area name that is not in the catalog, and never invent one to fit what they said.
This replaces whatever was recorded before, so send the whole list every time.
If they have told you before what they advise on, say what you remember and ask them to confirm rather than asking again. Anything they add now is an ordinary answer.

Insurers — who they place business with

Collect from your person: which insurance companies they place business with. Read the insurer names back to them and wait for their yes before you submit the codes.

The reply carries what their licence allows, in ZaapIn's own numbers and ZaapIn's own sentence. Quote those. Never quote a limit you remember from anywhere else — your own knowledge of who may declare what is a second vocabulary, and it will eventually be wrong.

If they have named fewer insurers than they are allowed, you may offer the difference — as an offer, not a push. The shape, using the server's numbers rather than yours:

Your licence lets you name one insurer each for health, life and general. I have Star Health from you — would you like to name the other two, or leave them for later?

"Leave it for later" is always a valid answer. Take it and move on.

This list replaces whatever was recorded before, so send the whole list every time. If ZaapIn refuses the list, tell your person exactly what it said and ask them — do not drop an insurer to make the call pass.

The firm's address

Collect from your person: where their practice is. They will usually say it in one breath.

Take it apart into street, city, state and PIN, then read the whole thing back — PIN and state included — and wait for their yes before you submit.

Working out the PIN and the state from the address they gave you is fine. Putting in an address they did not give you is not.
If you are unsure of the PIN, ask them rather than picking one.
If they have told you their address before, say it back and ask whether it is still right.

The licence — the type they already gave you, then the PAN

Collect from your person: their PAN, and nothing else new. The kind of licence is the practice type they already gave you for the profile — you send it again here, with the PAN.

You already hold the type: it is the practice type they gave you for the profile — Agent, Broker, Corporate Agent, Insurance Marketing Firm, or Point of Sale (POS). Send that. Confirm it only if something they said since makes you doubt it, and take their answer over your assumption. Never work the type out from their firm's name, and never from anything you found elsewhere.

ZaapIn records the type because it says whose the licence is. If they ask why, tell them:

The kind of licence is what tells ZaapIn whose licence it is.

Then the PAN. Say why you are asking, before you ask:

Your PAN is how ZaapIn's team finds and checks your licence on the IRDAI register — profiles go live only after that review, so customers know everyone listed is licensed.

The type and the PAN are all ZaapIn needs. Do not ask for a licence number, an issuing agency, a date, or a document — and do not send one. ZaapIn's team records the rest from the IRDAI register when they check the licence. There is no document upload anywhere in this flow.

The type must be sent with the PAN. Leave it out and the submission is refused before it reaches ZaapIn — nothing is filed, and you are told to send it. Send the type they already gave you; never fill the gap with a guess.
Never say how long the review takes. Not "a day", not "shortly", not any number. You do not know, and neither does this page.
Read the PAN back character by character and wait for their yes before you submit — including when you are recalling it from something they told you earlier. A one-character error creates a wrong regulatory record.
Submit once. If ZaapIn refuses, tell your person what it said and stop. Do not send it again with the same PAN.
If the submission is accepted but comes back without a reference, report that and do not submit again.

Submitting the licence does not make the profile public, and it is not a verification. Going public stays your person's own signed-in act, later, in the app.

When things go wrong

A wrong or expired code

Refused with 401. Ask your person to read the code again and pass on exactly what they say — never variations, never a sequence. After 5 wrong attempts the code is destroyed and you start again from step 1. A fresh send has a 45-second cooldown per address and a ceiling of 10 sends per address per day.

A code that never arrives — the invisible failure

A mistyped but valid-looking email cannot be detected by the server. By design.

/api/v2/auth/start answers the same neutral success whether or not the address exists — that is the fence that stops anyone using ZaapIn to find out who has an account. It also means the server cannot tell you the address was mistyped. No code arrives, and nothing anywhere reports an error.

So if no code arrives within a couple of minutes: have your person check their spam folder, and then re-confirm the spelling of the address character by character. Their inbox is the only place the mistake can show. A corrected address simply starts again at step 1 — the old attempt expires on its own.

Do not sit and wait indefinitely, and do not burn the day's resend budget against an address that will never receive anything.

Invalid format, missing fields, too many requests

These are the wire's own refusals. Relay them to your person as they are — do not re-word them into something friendlier, because the wording is what tells them what to fix. Never retry a refusal in a loop, and never quietly drop a value to make a call pass.

They already have a profile, or an invitation is waiting

Both mean stop and tell them. Getting back into an existing profile, and joining somebody's organization, are their own acts at app.zaapin.com. The same applies if they ask you to fill in a profile they already have: this flow only reaches the account created with you in this conversation.

What this guide does not cover

Creating a second firm for someone who already has a ZaapIn profile. That is a signed-in act, done on screen, and it asks the person to type the new firm's name themselves as a deliberate confirmation. Do not attempt it; send your person to app.zaapin.com.
Their profile's public web address. Do not ask for a preferred URL or handle. Your person meets that in the app when the profile goes live, and it is decided there.
Making the profile public. That is their signed-in act, after the licence review.
Any claim about qualification. ZaapIn does not license, certify or accredit anyone. Creating a profile is not a credential, and nothing on this page should be presented to your person as one.

Testing this without a real advisor

If you are trying this out rather than helping a real person, use the ZaapIn sandbox instead. Same steps, same field names, same eight tools, records that are not real. The HTTP base:

https://sandboxzaapin-459743726944.asia-south1.run.app

And the same sandbox over MCP, if that is your door:

https://sandboxzaapin-459743726944.asia-south1.run.app/mcp

You will still need a real email address to receive the code.