---
name: discover-zoral-api
description: Orient an AI agent to Zoral's machine-readable surface - catalog API, MCP servers, markdown mirror, and the OAuth flow for the authenticated agent namespace.
---

# Discover the Zoral API

Zoral is a Singapore-based oral care brand selling a 316L medical-grade stainless
steel tongue scraper, founded by Adèle and Dvir. This skill maps its
machine-readable surface so an agent can pick the right entry point.

## When to use

- An agent needs to know what Zoral exposes before integrating.
- The user asks how to query Zoral programmatically.
- An agent needs Zoral's docs, policies, or content as structured data.

## Start here

- https://getzoral.com/llms.txt - catalog of every content page and product.
- https://getzoral.com/openapi.json - OpenAPI 3.1 for the zero-auth REST API.
- https://getzoral.com/api - the human-readable developer portal.

## Zero-auth REST

Reading the catalog needs no key at all:

```bash
curl -s "https://getzoral.com/api/store/products"
```

## MCP

Two Streamable HTTP servers, protocol `2025-06-18`, both zero-auth:

- `https://getzoral.com/mcp` - the store: `search_catalog`, `get_product`,
  `get_reviews`, `get_shop_policies`.
- `https://getzoral.com/mcp/docs` - the content: `search_articles`,
  `get_article`, `list_article_tags`, `search_faqs`.

```bash
curl -s -X POST "https://getzoral.com/mcp" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
```

The store surface deliberately exposes no `place_order`, `add_payment`, or
`set_customer` tool. That absence is the isolation guarantee.

## Markdown mirror

Every content page has a markdown twin. Either append `.md`:

```bash
curl -s "https://getzoral.com/blog/how-to-get-rid-of-white-tongue.md"
```

or negotiate:

```bash
curl -s -H "Accept: text/markdown" "https://getzoral.com/"
```

## Buying

Use the Agentic Commerce Protocol at `POST /checkout_sessions` with
`API-Version: 2026-07-16`. Payment is a human handoff - see the companion
`buy-from-zoral` skill.

## Authentication (optional)

Browsing and cart-building need no auth. An authenticated `/agent` namespace
exists for agents that want to act under their own client identity:

- Full walkthrough: https://getzoral.com/auth.md
- Registration is open and self-service (RFC 7591):
  `POST https://api.getzoral.com/oauth/register`
- Then `client_credentials` against `POST https://api.getzoral.com/oauth/token`.
- Scopes: `catalog:read`, `cart:write`.

Discover it from any 401:

```bash
curl -i "https://api.getzoral.com/agent/products"
# WWW-Authenticate: Bearer resource_metadata="https://api.getzoral.com/.well-known/oauth-protected-resource"
```

## Steps for an agent

1. Fetch `https://getzoral.com/llms.txt` to map the content.
2. Use `GET /api/store/products` or the `/mcp` server to read the catalog.
3. To buy, `POST /checkout_sessions` and hand the user the checkout URL.
4. Only if you need your own client identity, follow
   https://getzoral.com/auth.md.

## Notes

- Contact: hello@getzoral.com
- Source for these skills: https://github.com/getzoral/agent-resources