> ## Documentation Index > Fetch the complete documentation index at: https://docs.dappier.com/llms.txt > Use this file to discover all available pages before exploring further. # Real Time Search (ZeroClick) > Real-time search against a Dappier AI model, authenticated by verifying the `zc-signature` HMAC over the raw request bytes. The same orchestration as `POST /app/aimodel/{ai_model_id}` runs behind it. Only marketplace-enabled models are reachable — ZeroClick traffic carries no Dappier tenant, so a private model resolves to `404`. On success, usage is settled with ZeroClick and reported via the `zc-usage` response header. The request is not charged on the Dappier platform. ## OpenAPI ````yaml api-reference/endpoint/zeroclick.openapi.json POST /zeroclick/aimodel/{aimodel_external_id} openapi: 3.1.0 info: title: Dappier API — ZeroClick endpoints version: 1.0.0 description: > OpenAPI specification for the ZeroClick-authenticated Dappier endpoints (`/zeroclick/*`). ZeroClick sits in front of the Dappier API as the agent-payment layer. A buying agent calls ZeroClick's hosted pay URL; ZeroClick then proxies the request to these endpoints, signing the raw request bytes with an HMAC in the `zc-signature` header. From this API's perspective, a request is authenticated **only** by a valid `zc-signature` — there is no Dappier API key on these routes. These endpoints mirror the standard `/app/aimodel/{ai_model_id}` and `/app/v2/search` endpoints (same request/response bodies, same routing), differing only in: * **Authentication** — the `zc-signature` HMAC is verified over the raw request bytes instead of a Dappier API key. * **Authorization** — a ZeroClick allowance check runs before any billable work. It fails *open* on a transient ZeroClick outage (the signature has already verified), but never for a missing/invalid signature. * **Scope** — ZeroClick traffic has no Dappier tenant, so only marketplace-enabled models are reachable. Anything else returns `404`. * **Metering** — usage is reported back to ZeroClick via the `zc-usage` response header on success. Dappier platform charging is intentionally bypassed; ZeroClick is the sole biller. servers: - url: https://api.dappier.com description: Production security: [] tags: - name: ZeroClick description: ZeroClick agent-payment authenticated endpoints. paths: /zeroclick/aimodel/{aimodel_external_id}: post: tags: - ZeroClick summary: Query Real-Time Search (ZeroClick-authenticated) description: > Real-time search against a Dappier AI model, authenticated by verifying the `zc-signature` HMAC over the raw request bytes. The same orchestration as `POST /app/aimodel/{ai_model_id}` runs behind it. Only marketplace-enabled models are reachable — ZeroClick traffic carries no Dappier tenant, so a private model resolves to `404`. On success, usage is settled with ZeroClick and reported via the `zc-usage` response header. The request is not charged on the Dappier platform. operationId: zeroclickQueryAiModel parameters: - name: aimodel_external_id in: path required: true description: >- The ID of the AI model to query (e.g., am_01j06ytn18ejftedz6dyhz2b15). Must start with `am_`. Browse and find AI models in the [Dappier Marketplace](https://platform.dappier.com/marketplace). schema: type: string - $ref: '#/components/parameters/ZcRequestId' - $ref: '#/components/parameters/ZcAgentId' requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/QueryRequest' examples: basic: summary: Real-time search query value: query: What is the latest news on AI regulation? responses: '200': description: >- The AI model response. Includes the `zc-usage` header settling usage with ZeroClick. headers: zc-usage: $ref: '#/components/headers/ZcUsage' content: application/json: schema: $ref: '#/components/schemas/QueryResponse' '401': $ref: '#/components/responses/ZeroClickUnauthorized' '402': $ref: '#/components/responses/PaymentRequired' '404': $ref: '#/components/responses/NotFound' '422': $ref: '#/components/responses/UnprocessableEntity' '500': $ref: '#/components/responses/InternalError' security: - ZeroClickSignature: [] components: parameters: ZcRequestId: name: zc-request-id in: header required: true description: >- ZeroClick request id, set by ZeroClick when it proxies the request. It is part of the signed canonical string, so a request without it cannot verify. schema: type: string example: zcreq_1 ZcAgentId: name: zc-agent-id in: header required: false description: >- Identifier of the buying agent. Used to partition logs/analytics by agent; becomes the synthesized caller identity (`zeroclick:`). Treated as an empty string when absent, which the signer must match. schema: type: string example: agt_1 schemas: QueryRequest: type: object title: QueryRequest required: - query properties: query: type: string title: Query message description: The query text to be passed to the AI model. Cannot be empty. QueryResponse: type: object title: QueryResponse description: >- The AI model response. Models that return a structured payload rather than a message emit that payload directly in place of this envelope. required: - message properties: message: type: string title: Query message description: The response of the query sent, generated by the AI model. ZeroClickSignatureError: type: object required: - error description: >- Returned when the `zc-signature` is missing/invalid or ZeroClick is unconfigured. properties: error: type: string const: invalid_zeroclick_signature PaymentRequiredError: type: object required: - error - serviceSlug - usage description: ZeroClick `payment_required` denial body. properties: error: type: string const: payment_required serviceSlug: type: string description: >- The ZeroClick service slug the request was priced against. Resolved from the data model's MCP tool name, falling back to a slug derived from the model name, then the external id. usage: type: array items: type: object properties: meterSlug: type: string const: query quantity: type: integer example: 1 Error: type: object required: - message properties: message: type: string code: type: string headers: ZcUsage: description: > Usage report settled with ZeroClick, present on `200` responses. Dappier pricing is per request rather than token-based, so this is a flat quantity of `1` against the `query` meter for the request's ZeroClick service slug. schema: type: string example: '[{"serviceSlug":"real-time-search","meterSlug":"query","quantity":1}]' responses: ZeroClickUnauthorized: description: > The `zc-signature` was missing or invalid, or ZeroClick is not configured for this environment. Unsigned/unverifiable traffic is treated as unauthenticated. The body never says why verification failed. content: application/json: schema: $ref: '#/components/schemas/ZeroClickSignatureError' example: error: invalid_zeroclick_signature PaymentRequired: description: > The ZeroClick allowance check denied the request (e.g. service not found or usage exhausted). No plan slug is returned, so ZeroClick prices against the lowest pay-as-you-go plan. content: application/json: schema: $ref: '#/components/schemas/PaymentRequiredError' example: error: payment_required serviceSlug: real-time-search usage: - meterSlug: query quantity: 1 NotFound: description: | The model could not be resolved, or it is not marketplace-enabled and is therefore unreachable from ZeroClick traffic. UnprocessableEntity: description: >- The request body could not be read or decoded, `query` was empty, or the model id was not in the expected format. content: application/json: schema: $ref: '#/components/schemas/Error' examples: emptyQuery: value: message: query cannot be empty badModelId: value: message: aimodelExternalId is not in the correct format InternalError: description: >- Unexpected server error while resolving the model or dispatching the request. securitySchemes: ZeroClickSignature: type: apiKey in: header name: zc-signature description: > HMAC signature minted by ZeroClick over the raw request bytes, of the form `t=,kid=,v1=`. The canonical string signed is `t \n METHOD \n path+query \n sha256hex(body) \n zc-request-id \n zc-agent-id`, and `v1 = hex(HMAC_SHA256(secret, canonical))`. Verified against the seller's signing secret keyed by `kid`, with a ±300s timestamp skew bound. A missing or invalid signature is rejected with `401` `invalid_zeroclick_signature`; this is never failed open. ````