Developers/API tooling

API tooling

Credentials, machine-readable specs, and the mobile API.

Chatasist exposes a public REST API v1 plus tooling to integrate with it. Start from the API introduction for the endpoint reference.

Credentials#

OAuth2 clients

The public API uses OAuth 2.0 (client_credentials). Access tokens are scoped to one workspace and last 12 hours. See Authentication.

Company API keys

Workspace-level credentials with selectable expiry, regenerate, and revoke. Expired keys are cleaned up hourly.

Personal access tokens

Per-user tokens with read / write abilities and an optional expiry (1–365 days). Stored SHA-256 hashed and shown once.

unlimited, 30 days, 90 days, 1 month, 3 months, or 12 months. Regenerating a key rotates the secret and revokes existing tokens.

From Settings → API integration (Administrator only), Chatasist serves:

Format	Path
OpenAPI 3.1 JSON	`/settings/api-integration/openapi.json`
Postman collection v2.1	`/settings/api-integration/postman.json`
Swagger UI	`/settings/api-integration/swagger`

The API Reference tab in these docs is generated from the same OpenAPI 3.1 spec, so it always matches the live contract.

The Flutter agent app uses a separate mobile API:

POST /login, then POST /tenant-login and GET /companies to choose a workspace.
GET /me, GET /chats, GET /chats/{id}, POST /chats/read-all.
GET/PATCH /account/profile, PUT /account/password, two-factor endpoints, POST /locale, POST /logout.

Authenticate and call the public REST API.