API reference

Programmatic access uses your business API key (starts with sk_) as a bearer token. Find it in your dashboard settings. Keep it secret — it is not the same as your public widget key.

Authorization: Bearer sk_your_api_key

Chat (public widget endpoint)

The widget posts visitor messages here. Uses your public key, not the API key.

POST /api/chat/{publicKey}/message
{ "visitor_id": "uuid", "message": "Where is my order?" }
→ server-sent events stream the reply

Knowledge base

GET    /api/kb/sources          list sources
POST   /api/kb/faq              add a question + answer
POST   /api/kb/url              crawl a page
DELETE /api/kb/sources/{id}     remove a source

Data export & erasure (GDPR / CCPA)

GET    /api/gdpr/visitors/{uid}   export a customer's data
DELETE /api/gdpr/visitors/{uid}   erase a customer's data

Webhooks

Subscribe your systems to Torbie events (conversation.created, handoff.requested, customer.identified, csat.received). Deliveries are HMAC-signed and retried on failure. Configure them in Dashboard → Settings → Webhooks.

More endpoints are added as features ship. This reference tracks what's live today.