EXPLORE_CORPUS, RECOMMEND_PRODUCT, SUBMIT_FORM, BOOK_MEETING, COLLECT_PAYMENT, etc. — and orchestrates them on the caller’s behalf. There is no separate tools/list endpoint exposed to anonymous callers.
POST /chat/
widget capability.
Request body
| Field | Type | Required | Description |
|---|---|---|---|
message | string (≤ 15000) | Yes | The user (or agent) message |
sessionId | string (≤ 100) | Yes | Session handle. Reuse to keep multi-turn context |
segment | string | No | Segment slug, defaults to the tenant’s default segment |
stream | boolean | No | true → SSE. Defaults: true for human visitors, false when X-Agent-Model is present |
pageUrl | string | No | Optional page URL where the conversation happens |
pageContext | object | No | { title, url, ... } — optional page metadata |
visitorId | string | No | Persistent visitor handle (alternative to X-Visitor-Id header) |
visitorToken | string | No | JWT signed by tenant’s visitorSigningKey (Mode A auth) |
turnstileToken | string | No | Required if the tenant has Turnstile enabled |
locale | string (en, fr) | No | Locale hint (alternative to X-Animam-Locale header) |
Headers
| Header | Purpose |
|---|---|
X-Agent-Model | Declare the calling agent’s model (e.g. claude-opus-4-7). Triggers the agent envelope |
X-API-Key / X-LLM-Key | Optional BYOK passthrough — call the tenant’s chatbot with your own LLM key |
X-LLM-Provider, X-LLM-Model, X-LLM-Base-Url | BYOK provider config |
X-Visitor-Token, X-Visitor-Id | Visitor identity propagation |
X-Animam-Admin-Token | (WordPress) admin JWT for capability-scoped MCP tool access |
X-Animam-Locale | Locale hint (en, fr, …) |
Response — JSON envelope (default for agents)
WhenX-Agent-Model is present and stream is not explicitly set, the API returns a single JSON document.
| Field | Description |
|---|---|
message | Prose reply from the chatbot |
conversationId | DB conversation handle |
visitorType | "agent" if X-Agent-Model or [AGENT:] prefix detected, else "human" |
agentModel | Declarative echo of what the caller said. Truncated to 100 chars. Not cryptographically verified |
toolExecutions | Tools the chatbot invoked — sanitized: name, type, success flag, one-line summary, structured data, timestamp. Raw inputs intentionally omitted (PII risk) |
contactSubmitted | true if a SUBMIT_FORM tool succeeded — useful for lead attribution |
llmModel | Exact model that generated the reply (e.g. claude-haiku-4-5). Absent when llmSource: "webhook" |
status | "escalated" when the chatbot triggered ESCALATE_TO_HUMAN |
X-AI-Generated: true (AI Act Art. 50 transparency).
Response — SSE stream (default for browsers)
Whenstream: true (the default for human visitors), the API returns Server-Sent Events.
done event carries all the envelope fields shown in the JSON shape (including toolExecutions when the caller is an agent).
Errors
| HTTP | Code | Body |
|---|---|---|
| 400 | — | {"error": "message and sessionId are required"} |
| 400 | — | {"error": "Message too long (max 15000 chars)"} |
| 403 | — | {"error": "Origin not allowed"} |
| 403 | — | {"error": "Invalid or missing widget key"} |
| 403 | TURNSTILE_REQUIRED / TURNSTILE_FAILED | Turnstile gate |
| 402 | NOT_ACTIVATED | Plan does not include widget capability |
| 404 | — | {"error": "Tenant not found"} |
| 429 | LIMIT_REACHED | {"error": "...", "current", "limit", "nextResetAt"} |
Rate limits
Per-IP dual window: 20 messages / minute + 200 messages / hour. Exceeded calls return HTTP 429.Quick examples
Agent-to-agent (Python)
Streaming (JavaScript widget)
See also
Agent access guide
Full agent-to-agent walkthrough
Tools (concept)
The 13 tool types the chatbot can invoke