Knowledge Base API
Ask a knowledge base a question and get back a grounded answer with citations — the same engine, the same access rules and the same citations the workspace itself uses. A token cannot widen what a question can reach.
What you can call
| Endpoint | What it does |
|---|---|
POST /kb-api/api/v1/kb/{kbId}/widget/query | Ask a question, get an answer with citations |
POST /kb-api/api/v1/kb/{kbId}/widget/query/stream | The same, streamed back token by token |
Both take the same request body. Append them to your base URL.
How a request is authenticated
You issue a scoped token from the knowledge base's Developers tab and send it on every call, in either header:
Authorization: Bearer <token>
X-Widget-Token: <token>
The token is bound to one knowledge base and to a list of allowed domains. A browser request must
come from one of those domains; a request from your own server sends no Origin header at all
and is accepted on that basis.
Two limits to plan around
- A token lasts 60 minutes by default. The cap is a platform setting, so trust the minutes shown on the token's row rather than this number. You may ask for less, never more than the cap.
- Issuing one needs a signed-in person with permission to update that knowledge base. There is no way for a server to renew its own token yet, so a backend integration has to be handed a fresh token each time.
Between them, these make the current surface right for a demo, a pilot page or an internal site, and awkward for an unattended production integration.
Next
- Developer access and widget tokens — issue and revoke one.
- Query endpoints — request and response fields.
- Embed the chat widget — the no-code option.
- Errors — status codes and the error envelope.