API Reference

RocketFlow offers two programmatic surfaces today:

1. The MCP server — the recommended way to manage chatbots, read analytics, sessions, leads, and tickets from code or AI assistants. Authenticated with API keys. See the MCP Server docs.
2. Public widget endpoints — the unauthenticated endpoints the chat widget itself uses. They are stable and documented below for advanced integrations (custom chat UIs, health monitoring).

A full standalone REST API with per-endpoint API-key auth is on the roadmap but not available yet.

Authentication

• Public endpoints (below) require no API key. When your chatbot has allowed domains, the widget page (/embed/{chatbotId}) is served with a Content-Security-Policy: frame-ancestors header, so browsers refuse to embed it on any other site (with Strict domain off, subdomains of each domain are allowed too). This restricts where the widget can be embedded; it does not authenticate direct calls to the chat endpoint, which is protected by the per-chatbot rate limit (see the chat endpoint below) instead.
• MCP server requests require an API key passed as a Bearer token. Generate keys in Dashboard → Settings → API Keys — they are prefixed rkt_, stored as SHA-256 hashes, and shown in full only once at creation.

Public Endpoints

Base host: https://app.getrocketflow.io

Chat endpoint

POST /api/public/chat accepts a JSON body in the AI SDK UI message format:

{
  "chatbotId": "your-chatbot-id",
  "sessionId": "unique-session-id",
  "messages": [
    {
      "id": "m1",
      "role": "user",
      "parts": [{ "type": "text", "text": "Hello!" }]
    }
  ]
}

The response is a UI message stream (server-sent events) rather than a single JSON object — the same protocol the AI SDK's useChat consumes. If you are building a custom chat UI, use the AI SDK client libraries to consume it rather than parsing the stream by hand.

curl -N -X POST https://app.getrocketflow.io/api/public/chat \
  -H "Content-Type: application/json" \
  -d '{
    "chatbotId": "your-chatbot-id",
    "sessionId": "test-session",
    "messages": [
      { "id": "m1", "role": "user",
        "parts": [{ "type": "text", "text": "Hello" }] }
    ]
  }'

Sessions are rate-limited per chatbot (default: 20 messages per 240 seconds, configurable under Settings → Security). When exceeded, the chat endpoint returns 429 with your configured message and a Retry-After header.

When a conversation has been handed to a person (queued or human), the chat endpoint does not run the AI: it returns 409 with { "handoff": true, "handoffStatus", "agentName", "message" }. See Human Handoff.

Managing Chatbots Programmatically

Use the MCP server: it exposes 13 tools covering chatbot creation and updates, knowledge sources, sessions and messages, analytics, insights, knowledge-gap detection, leads, tickets, and FAQs. It works from Claude, Cursor, and any MCP-compatible client — or from your own code via an MCP client library.

Webhooks

Subscribe to events from Dashboard → Settings → Webhooks. RocketFlow sends a POST request to your URL for each subscribed event:

Other event names appear in the dashboard code but are not fired yet; see Webhooks for the current list.

Payload shape:

{
  "event": "message.received",
  "chatbotId": "your-chatbot-id",
  "timestamp": "2026-09-14T12:00:00.000Z",
  "data": { }
}

A signing secret (prefixed whsec_) is generated for each webhook when you create it — use it to verify request authenticity. See Webhooks for details.

SDKs

There are no published SDKs yet. The embed widget needs only the script tag, and the MCP server works with any MCP client.

Support

• Status page: status.getrocketflow.io
• Email: support@getrocketflow.io