Ana içeriğe geç

Start or resume a visitor chat session

POST 
/api/widget/session

PUBLIC endpoint (anonymous website visitors, NO staff auth). The tenant is resolved from the PUBLIC widget_key (sent via the X-Widget-Key header or in the body); the raw tenant id is never accepted.

A returning visitor presents their previously issued session token via the Authorization: Bearer <token> header (or X-Widget-Session) to RESUME their existing conversation. A new visitor presents none, and a fresh visitor contact + chat conversation are created. An invalid, expired, tampered or foreign-tenant token is silently treated as "no token" → a new session.

The response returns a freshly issued signed session token, the PUBLIC widget configuration, the visitor's own conversation, and its recent message history. The token is a self-contained credential scoping the visitor to exactly this {tenant, contact, conversation}; it grants no other access. No staff identity, AI metadata, or other-tenant data is ever returned.

Request​

Responses​

An existing visitor session was resumed.