Product HTTP API
Reference all 41 business HTTP operations registered by the current source.
Product HTTP provides basic integration and trusted-management operations. The complete OpenAPI contract matches all 41 current internal/access/api registrations.
OpenAPI: complete contract · narrow profiles: basic integration · message sending · Channel and Conversation
Trusted backends only
Product HTTP has no general business authentication. Restrict network reachability and provide authentication, authorization, limits, and audit at an API Gateway, service mesh, or product backend.
API directory
User Token
POST /user/token stores device-token metadata.
Route Discovery
GET /route returns client TCP and WebSocket ingress.
Message Sync
POST /channel/messagesync recovers committed messages.
Message Sending
POST /message/send submits ordinary persistent messages.
Channels
Manage Channels, subscribers, and allow or deny lists.
Conversations
List, retry, unread, hide, and activate Conversations.
Error Responses
HTTP status, error bodies, and retry guidance.
Basic integration contract
- POST /user/token
- GET /route
- POST /channel/messagesync
These calls belong only in the trusted localhost BFF; the browser must not call the Product HTTP API directly.
Download the OpenAPI 3.1 subsetThe snapshot above proves only the example scope of the three golden-path operations; it is not end-to-end acceptance for the complete contract. Realtime client send and receive still use the SDK and Gateway.