We use the GetContactsRequest SOAP call.
The soap.txt document doesn't have a ton of details, but it should get you started.
I get more info from running the zmprov or zmmailbox commands on the server with the debug flag set. That is:
zmmailbox -z -d -m
username@domain.com gact
This will not only get you a list of contacts for the given user, but more specifics on what the SOAP request should look like.
Also, you can get SOAP details for just about any command running the Zimbra Collaboration Suite client and admin tools in debug mode. Just add ?dev=1 or ?debug=1 to your URL on the login screen, depending on which application you are running.