If you search for the following string on the forum you will find lots of posts showing how to authenticate via various methods (eg python, curl)
/ZAutomation/api/v1/login
I wrote my own Android app to control my system but I use Firefox's RESTClient extension to test commands. An authentication request would look like this in RESTClient:
POST
http://192.168.1.12:8083/ZAutomation/api/v1/login
with the body set to
{"form":true,"login":"admin","password":"mypasswordforuseradmin","keepme":false,"default_ui":1}
And the response would be something like:
{"data":{"id":1,"role":1,"login":"admin","name":"Administrator","lang":"en","color":"#dddddd","dashboard":[],"interval":2000,"rooms":[0],"expert_view":true,"hide_all_device_events":false,"hide_system_events":false,"hide_single_device_events":[],"email":"","sid":"6fabfc48-9295-b869-22a7-218cf57bba9d"},"code":200,"message":"200 OK","error":null}
the returned sid is then required for future requests, eg for devices
GET
http://192.168.1.12:8083/ZAutomation/api/v1/devices
with body
{"sid":"6fabfc48-9295-b869-22a7-218cf57bba9d"}
My system is quite old - I'm running firmware v2.2.3. Not sure which zway server software version. So things may have changed a bit.
I have a load of python scripts on github that may be of help
https://github.com/babsk/ZWay-API-Python-Access
start with login.py
I added quite a few custom commands to the zway server, so the other scripts may not make a lot of sense
Hope that helps