API basics

POST /api/chat takes your bot's public key, a visitor id, a message and the conversation so far, and streams the answer back as server-sent events. Each event carries a text delta; a final event carries the citations, the confidence score and the message id. It is the same endpoint the widget uses, and it needs no secret — the public key is safe in a browser because it can only ever reach your own bot.

POST /api/leads records a visitor's email against their open conversation and notifies you. The conversation is resolved from the visitor id on our side; there is no conversation id to pass, deliberately, so nobody can attach a lead to a conversation that is not theirs.

Twenty messages per visitor per five minutes, and a per-bot daily token budget. Both return a plain message rather than an error the visitor cannot act on. Going over your plan's included conversations never stops service — it is billed, not gated.

There is no authenticated management API for creating bots, reading conversations or editing answers from outside the dashboard, and no webhooks for outbound events. Both are planned, and no plan lists API access until they exist — we would rather say so here than let a pricing bullet imply something that does not exist today.