​
Workspace API tokens

SendBot API v3.1 uses scoped workspace tokens for server-to-server integrations. Create tokens from the workspace administration area and grant only the capabilities required by the integration. Account-wide legacy tokens are disabled. A workspace token cannot access another workspace, account settings, administrative routes, or resources outside its declared scopes. Supported scope families include:
  • bots:read and bots:write
  • sessions:read and sessions:write
  • results:read and results:write
  • webhooks:read and webhooks:write
  • integrations:read and integrations:write
Tokens have an explicit expiration date. Rotate them before expiration, revoke unused tokens, and never expose a token in browser code, URLs, logs, or source control.

​
Authentication headers

Use one of the following headers over HTTPS.

​
Bearer token

​
API key header

​
Least privilege example

A reporting service that only reads results should receive results:read; it should not receive write, billing, integration, or workspace administration permissions.

​
Error behavior

  • 401 Unauthorized: token is missing, malformed, expired, revoked, or unknown.
  • 403 Forbidden: token is valid, but the requested route, operation, or resource is outside its workspace or scopes.
  • 410 Gone: the requested legacy account-token operation has been retired.