ONOXIAONOXIA API
Home Dashboard Integrations
MENU navbar-image

Introduction

RESTful API zur programmatischen Verwaltung Ihrer ONOXIA-Chatbots.

Welcome to the ONOXIA API

The ONOXIA API lets you programmatically manage your AI chatbots — create RAG knowledge sources, read conversations, chat with the bot, export leads, and more.

Authentication

All API requests require a Bearer Token. Create your token in the dashboard under Administration → API Tokens.

Each token is bound to one chatbot. You don't need a Site ID in the URL — the bot is determined by the token.

curl https://onoxia.nz/api/v1/bot/site \
  -H "Authorization: Bearer onx_YourTokenHere..."

One Token = One Bot

Rate Limits

Endpoint Type Limit
Standard 120 requests/minute
Bulk Sync 20 requests/minute
Chat / LLM 60 requests/minute

Error Codes

Code Meaning
401 Token missing or invalid
403 Permission denied (missing ability or wrong bot)
404 Resource not found
422 Validation error
429 Rate limit exceeded

Authenticating requests

To authenticate requests, include an Authorization header with the value "Bearer onx_{YOUR_TOKEN}".

All authenticated endpoints are marked with a requires authentication badge in the documentation below.

Create your API token at Administration → API Tokens.

Webhooks

List webhooks

requires authentication

Returns all registered webhooks (bot tools) for this chatbot. Webhooks enable the bot to call external systems during conversations — e.g. capturing leads to a CRM, creating support tickets, or triggering custom workflows. Each webhook has a name, URL, event triggers, and an optional HMAC secret for signature verification.

Requires: webhooks:read permission.

Example request:
curl --request GET \
    --get "https://onoxia.nz/api/v1/bot/webhooks" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"
const url = new URL(
    "https://onoxia.nz/api/v1/bot/webhooks"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};


fetch(url, {
    method: "GET",
    headers,
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/webhooks';
$response = $client->get(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Example response (401):

Show headers 
cache-control: no-cache, private
content-type: application/json
access-control-allow-origin: *
 

{
    "message": "Unauthenticated."
}

Request      

GET api/v1/bot/webhooks

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

Create a webhook

requires authentication

Registers a new webhook (bot tool). The bot will call this URL when the configured events or triggers match during a conversation. Payloads are signed with HMAC-SHA256 using the optional secret field.

The trigger_config object defines when the bot should use this tool — provide a tool_name and tool_description that the LLM uses to decide when to invoke it.

After creation, the bot is re-provisioned to include the new tool in its capabilities.

Requires: webhooks:write permission.

Example request:
curl --request POST \
    "https://onoxia.nz/api/v1/bot/webhooks" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    --data "{
    \"name\": \"b\",
    \"url\": \"http:\\/\\/bailey.com\\/\",
    \"secret\": \"m\",
    \"description\": \"Et fugiat sunt nihil accusantium.\",
    \"is_active\": true
}"

const url = new URL(
    "https://onoxia.nz/api/v1/bot/webhooks"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

let body = {
    "name": "b",
    "url": "http:\/\/bailey.com\/",
    "secret": "m",
    "description": "Et fugiat sunt nihil accusantium.",
    "is_active": true
};

fetch(url, {
    method: "POST",
    headers,
    body: JSON.stringify(body),
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/webhooks';
$response = $client->post(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
        'json' => [
            'name' => 'b',
            'url' => 'http://bailey.com/',
            'secret' => 'm',
            'description' => 'Et fugiat sunt nihil accusantium.',
            'is_active' => true,
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Request      

POST api/v1/bot/webhooks

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

Body Parameters

name   string     

:Attribute darf maximal 255 Zeichen haben. Example: b

url   string     

Must be a valid URL. :Attribute darf maximal 2000 Zeichen haben. Example: http://bailey.com/

secret   string  optional    

:Attribute darf maximal 64 Zeichen haben. Example: m

events   object  optional    
trigger_config   object  optional    
description   string  optional    

:Attribute darf maximal 1000 Zeichen haben. Example: Et fugiat sunt nihil accusantium.

is_active   boolean  optional    

Example: true

Update a webhook

requires authentication

Updates an existing webhook by ID. Only send the fields you want to change. The bot is re-provisioned after update to reflect changes in tool capabilities.

Requires: webhooks:write permission.

Example request:
curl --request PUT \
    "https://onoxia.nz/api/v1/bot/webhooks/architecto" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    --data "{
    \"name\": \"b\",
    \"url\": \"http:\\/\\/bailey.com\\/\",
    \"secret\": \"m\",
    \"description\": \"Et fugiat sunt nihil accusantium.\",
    \"is_active\": true
}"

const url = new URL(
    "https://onoxia.nz/api/v1/bot/webhooks/architecto"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

let body = {
    "name": "b",
    "url": "http:\/\/bailey.com\/",
    "secret": "m",
    "description": "Et fugiat sunt nihil accusantium.",
    "is_active": true
};

fetch(url, {
    method: "PUT",
    headers,
    body: JSON.stringify(body),
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/webhooks/architecto';
$response = $client->put(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
        'json' => [
            'name' => 'b',
            'url' => 'http://bailey.com/',
            'secret' => 'm',
            'description' => 'Et fugiat sunt nihil accusantium.',
            'is_active' => true,
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Request      

PUT api/v1/bot/webhooks/{id}

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

URL Parameters

id   string     

The ID of the webhook. Example: architecto

Body Parameters

name   string  optional    

:Attribute darf maximal 255 Zeichen haben. Example: b

url   string  optional    

Must be a valid URL. :Attribute darf maximal 2000 Zeichen haben. Example: http://bailey.com/

secret   string  optional    

:Attribute darf maximal 64 Zeichen haben. Example: m

events   object  optional    
trigger_config   object  optional    
description   string  optional    

:Attribute darf maximal 1000 Zeichen haben. Example: Et fugiat sunt nihil accusantium.

is_active   boolean  optional    

Example: true

Delete a webhook

requires authentication

Permanently removes a webhook. The bot will no longer have access to this tool. The bot is re-provisioned after deletion.

Requires: webhooks:write permission.

Example request:
curl --request DELETE \
    "https://onoxia.nz/api/v1/bot/webhooks/architecto" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"
const url = new URL(
    "https://onoxia.nz/api/v1/bot/webhooks/architecto"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};


fetch(url, {
    method: "DELETE",
    headers,
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/webhooks/architecto';
$response = $client->delete(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Request      

DELETE api/v1/bot/webhooks/{id}

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

URL Parameters

id   string     

The ID of the webhook. Example: architecto

Chat

Chat with the bot

requires authentication

Send a message to the bot and receive an AI-generated response. This endpoint uses the same flow as the chat widget: RAG knowledge retrieval, tool execution, token budget deduction.

Pass a conversation_id to continue an existing conversation, or omit it to start a new one. The response includes the conversation ID for subsequent messages.

The locale parameter hints the bot about the visitor's language. With auto-detection enabled, the bot will respond in whatever language the user writes in regardless of this parameter.

Token usage is deducted from your monthly budget. Returns 429 if budget is exhausted.

Requires: chat:write permission.

Example request:
curl --request POST \
    "https://onoxia.nz/api/v1/bot/chat" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    --data "{
    \"message\": \"b\",
    \"conversation_id\": \"a4855dc5-0acb-33c3-b921-f4291f719ca0\",
    \"visitor_id\": \"z\",
    \"locale\": \"en_CA\"
}"

const url = new URL(
    "https://onoxia.nz/api/v1/bot/chat"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

let body = {
    "message": "b",
    "conversation_id": "a4855dc5-0acb-33c3-b921-f4291f719ca0",
    "visitor_id": "z",
    "locale": "en_CA"
};

fetch(url, {
    method: "POST",
    headers,
    body: JSON.stringify(body),
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/chat';
$response = $client->post(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
        'json' => [
            'message' => 'b',
            'conversation_id' => 'a4855dc5-0acb-33c3-b921-f4291f719ca0',
            'visitor_id' => 'z',
            'locale' => 'en_CA',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Request      

POST api/v1/bot/chat

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

Body Parameters

message   string     

:Attribute darf maximal 2000 Zeichen haben. Example: b

conversation_id   string  optional    

:Attribute muss ein UUID sein. Example: a4855dc5-0acb-33c3-b921-f4291f719ca0

visitor_id   string  optional    

:Attribute darf maximal 64 Zeichen haben. Example: z

locale   string  optional    

:Attribute darf maximal 5 Zeichen haben. Example: en_CA

context   object  optional    

Leads

Export leads as CSV

requires authentication

Downloads all leads for this chatbot as a CSV file. Includes name, email, phone, company, source, and creation date. Useful for importing into CRM systems or spreadsheets.

Requires: leads:read permission.

Example request:
curl --request GET \
    --get "https://onoxia.nz/api/v1/bot/leads/export.csv" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"
const url = new URL(
    "https://onoxia.nz/api/v1/bot/leads/export.csv"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};


fetch(url, {
    method: "GET",
    headers,
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/leads/export.csv';
$response = $client->get(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Example response (401):

Show headers 
cache-control: no-cache, private
content-type: application/json
access-control-allow-origin: *
 

{
    "message": "Unauthenticated."
}

Request      

GET api/v1/bot/leads/export.csv

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

List leads

requires authentication

Returns a paginated list of captured leads. Leads are created when visitors provide their contact information through the pre-chat form or during bot conversations.

Filters: ?since=2026-01-01, ?source=prechat (or bot, manual). Pagination: ?per_page=50 (max 100).

Requires: leads:read permission.

Example request:
curl --request GET \
    --get "https://onoxia.nz/api/v1/bot/leads" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"
const url = new URL(
    "https://onoxia.nz/api/v1/bot/leads"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};


fetch(url, {
    method: "GET",
    headers,
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/leads';
$response = $client->get(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Example response (401):

Show headers 
cache-control: no-cache, private
content-type: application/json
access-control-allow-origin: *
 

{
    "message": "Unauthenticated."
}

Request      

GET api/v1/bot/leads

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

Analytics

Token usage analytics

requires authentication

Returns your current token budget (monthly limit, used, remaining) and daily usage breakdown for this chatbot. Filter by date range with ?from=2026-03-01&to=2026-03-31.

Each day shows input tokens, output tokens, and total. Use this to monitor consumption, detect usage spikes, and plan token package purchases.

Requires: analytics:read permission.

Example request:
curl --request GET \
    --get "https://onoxia.nz/api/v1/bot/analytics/tokens" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"
const url = new URL(
    "https://onoxia.nz/api/v1/bot/analytics/tokens"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};


fetch(url, {
    method: "GET",
    headers,
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/analytics/tokens';
$response = $client->get(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Example response (401):

Show headers 
cache-control: no-cache, private
content-type: application/json
access-control-allow-origin: *
 

{
    "message": "Unauthenticated."
}

Request      

GET api/v1/bot/analytics/tokens

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

Conversation statistics

requires authentication

Returns aggregate statistics: total conversations, rated conversations, average CSAT rating, and a breakdown by channel (widget, email, api). Use this for dashboard widgets or reporting integrations.

Requires: analytics:read permission.

Example request:
curl --request GET \
    --get "https://onoxia.nz/api/v1/bot/analytics/conversations" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"
const url = new URL(
    "https://onoxia.nz/api/v1/bot/analytics/conversations"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};


fetch(url, {
    method: "GET",
    headers,
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/analytics/conversations';
$response = $client->get(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Example response (401):

Show headers 
cache-control: no-cache, private
content-type: application/json
access-control-allow-origin: *
 

{
    "message": "Unauthenticated."
}

Request      

GET api/v1/bot/analytics/conversations

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

Import

Import llms.txt

requires authentication

Imports a website's llms.txt file as RAG knowledge. This is a standardized format (llms-txt.org) that describes a website's content for AI consumption.

Provide either a url (the system fetches it) or raw content (inline import). The content is parsed, split into chunks, and embedded as RAG sources. Processing happens asynchronously — check back via the RAG list endpoint.

Requires: rag:write permission.

Example request:
curl --request POST \
    "https://onoxia.nz/api/v1/bot/ingest/llms-txt" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    --data "{
    \"url\": \"http:\\/\\/www.bailey.biz\\/quos-velit-et-fugiat-sunt-nihil-accusantium-harum.html\",
    \"content\": \"architecto\"
}"

const url = new URL(
    "https://onoxia.nz/api/v1/bot/ingest/llms-txt"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

let body = {
    "url": "http:\/\/www.bailey.biz\/quos-velit-et-fugiat-sunt-nihil-accusantium-harum.html",
    "content": "architecto"
};

fetch(url, {
    method: "POST",
    headers,
    body: JSON.stringify(body),
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/ingest/llms-txt';
$response = $client->post(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
        'json' => [
            'url' => 'http://www.bailey.biz/quos-velit-et-fugiat-sunt-nihil-accusantium-harum.html',
            'content' => 'architecto',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Request      

POST api/v1/bot/ingest/llms-txt

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

Body Parameters

url   string  optional    

This field is required when content is not present. Must be a valid URL. :Attribute darf maximal 2000 Zeichen haben. Example: http://www.bailey.biz/quos-velit-et-fugiat-sunt-nihil-accusantium-harum.html

content   string  optional    

This field is required when url is not present. Example: architecto

Import sitemap

requires authentication

Imports a website's XML sitemap and creates RAG sources from the linked pages. The system fetches each page, extracts text content, and creates knowledge entries.

Use max_pages to limit the number of pages processed (default: all, max: 500). Use exclude_patterns to skip certain URL patterns (e.g. ["/admin/*", "/tag/*"]).

Processing happens asynchronously. Monitor progress via the RAG list endpoint.

Requires: rag:write permission.

Example request:
curl --request POST \
    "https://onoxia.nz/api/v1/bot/ingest/sitemap" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    --data "{
    \"url\": \"http:\\/\\/www.bailey.biz\\/quos-velit-et-fugiat-sunt-nihil-accusantium-harum.html\",
    \"max_pages\": 5
}"

const url = new URL(
    "https://onoxia.nz/api/v1/bot/ingest/sitemap"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

let body = {
    "url": "http:\/\/www.bailey.biz\/quos-velit-et-fugiat-sunt-nihil-accusantium-harum.html",
    "max_pages": 5
};

fetch(url, {
    method: "POST",
    headers,
    body: JSON.stringify(body),
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/ingest/sitemap';
$response = $client->post(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
        'json' => [
            'url' => 'http://www.bailey.biz/quos-velit-et-fugiat-sunt-nihil-accusantium-harum.html',
            'max_pages' => 5,
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Request      

POST api/v1/bot/ingest/sitemap

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

Body Parameters

url   string     

Must be a valid URL. :Attribute darf maximal 2000 Zeichen haben. Example: http://www.bailey.biz/quos-velit-et-fugiat-sunt-nihil-accusantium-harum.html

max_pages   integer  optional    

:Attribute muss mindestens 1 sein. :Attribute darf maximal 500 sein. Example: 5

exclude_patterns   object  optional    

Import single URL

requires authentication

Fetches a single web page, extracts its text content, and creates a RAG source from it. Useful for importing specific pages (e.g. a pricing page, product page, or help article) without processing an entire sitemap.

Optional: Set a custom name, context_tags, or url_patterns for the created source.

Requires: rag:write permission.

Example request:
curl --request POST \
    "https://onoxia.nz/api/v1/bot/ingest/url" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    --data "{
    \"url\": \"http:\\/\\/www.bailey.biz\\/quos-velit-et-fugiat-sunt-nihil-accusantium-harum.html\",
    \"name\": \"i\"
}"

const url = new URL(
    "https://onoxia.nz/api/v1/bot/ingest/url"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

let body = {
    "url": "http:\/\/www.bailey.biz\/quos-velit-et-fugiat-sunt-nihil-accusantium-harum.html",
    "name": "i"
};

fetch(url, {
    method: "POST",
    headers,
    body: JSON.stringify(body),
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/ingest/url';
$response = $client->post(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
        'json' => [
            'url' => 'http://www.bailey.biz/quos-velit-et-fugiat-sunt-nihil-accusantium-harum.html',
            'name' => 'i',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Request      

POST api/v1/bot/ingest/url

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

Body Parameters

url   string     

Must be a valid URL. :Attribute darf maximal 2000 Zeichen haben. Example: http://www.bailey.biz/quos-velit-et-fugiat-sunt-nihil-accusantium-harum.html

name   string  optional    

:Attribute darf maximal 255 Zeichen haben. Example: i

context_tags   object  optional    
url_patterns   object  optional    

Raw LLM

Raw LLM Proxy

requires authentication

Direct access to the underlying LLM without RAG, tools, or conversation context. Send your own message array and get a raw AI response. Tokens are deducted from your budget.

Optionally specify a model (e.g. mistral-medium, qwen-3.5-plus, gemini-2.5-flash). If omitted, the system auto-selects the best model for the bot's configured language.

Use cases: content generation, translation, summarization, classification — anything that needs AI but doesn't require your knowledge base.

Note: Different models have different token multipliers. Gemini Flash (0.5x) is the cheapest option, Mistral Medium (1.0x) is the default.

Requires: llm:write permission.

Example request:
curl --request POST \
    "https://onoxia.nz/api/v1/bot/llm/chat" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    --data "{
    \"messages\": [
        {
            \"role\": \"assistant\",
            \"content\": \"architecto\"
        }
    ],
    \"model\": \"b\",
    \"temperature\": 2,
    \"max_tokens\": 7
}"

const url = new URL(
    "https://onoxia.nz/api/v1/bot/llm/chat"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

let body = {
    "messages": [
        {
            "role": "assistant",
            "content": "architecto"
        }
    ],
    "model": "b",
    "temperature": 2,
    "max_tokens": 7
};

fetch(url, {
    method: "POST",
    headers,
    body: JSON.stringify(body),
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/llm/chat';
$response = $client->post(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
        'json' => [
            'messages' => [
                [
                    'role' => 'assistant',
                    'content' => 'architecto',
                ],
            ],
            'model' => 'b',
            'temperature' => 2,
            'max_tokens' => 7,
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Request      

POST api/v1/bot/llm/chat

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

Body Parameters

messages   object[]     

:Attribute muss mindestens 1 Elemente haben.
role   string     

Example: assistant

Must be one of:
  • system
  • user
  • assistant
content   string     

Example: architecto

model   string  optional    

:Attribute darf maximal 50 Zeichen haben. Example: b

temperature   number  optional    

:Attribute muss mindestens 0 sein. :Attribute darf maximal 2 sein. Example: 2

max_tokens   integer  optional    

:Attribute muss mindestens 1 sein. :Attribute darf maximal 4096 sein. Example: 7

Conversations

List conversations

requires authentication

Returns a paginated list of conversations for this chatbot. Each conversation includes metadata like visitor ID, channel (widget/email), status (bot/agent/closed), locale, message count, and CSAT rating.

Filters: ?status=bot, ?channel=widget, ?since=2026-01-01, ?rated=true. Pagination: ?per_page=50 (max 100).

Requires: conversations:read permission.

Example request:
curl --request GET \
    --get "https://onoxia.nz/api/v1/bot/conversations" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"
const url = new URL(
    "https://onoxia.nz/api/v1/bot/conversations"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};


fetch(url, {
    method: "GET",
    headers,
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/conversations';
$response = $client->get(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Example response (401):

Show headers 
cache-control: no-cache, private
content-type: application/json
access-control-allow-origin: *
 

{
    "message": "Unauthenticated."
}

Request      

GET api/v1/bot/conversations

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

Get conversation details

requires authentication

Returns a single conversation with its full message history. Messages are ordered chronologically and include role (user/assistant/agent), content, token count, and timestamp. Useful for auditing, analytics, or building custom conversation UIs.

Requires: conversations:read permission.

Example request:
curl --request GET \
    --get "https://onoxia.nz/api/v1/bot/conversations/6ff8f7f6-1eb3-3525-be4a-3932c805afed" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"
const url = new URL(
    "https://onoxia.nz/api/v1/bot/conversations/6ff8f7f6-1eb3-3525-be4a-3932c805afed"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};


fetch(url, {
    method: "GET",
    headers,
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/conversations/6ff8f7f6-1eb3-3525-be4a-3932c805afed';
$response = $client->get(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Example response (401):

Show headers 
cache-control: no-cache, private
content-type: application/json
access-control-allow-origin: *
 

{
    "message": "Unauthenticated."
}

Request      

GET api/v1/bot/conversations/{uuid}

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

URL Parameters

uuid   string     

Example: 6ff8f7f6-1eb3-3525-be4a-3932c805afed

RAG Sources

List RAG sources

requires authentication

Returns all knowledge sources (RAG) for this chatbot. Each source has a type (faq, text, document), a processing status, and optional context filters (tags, URL patterns). Filter by ?status=ready to see only processed sources, or ?status=pending for queued ones.

Requires: rag:read permission.

Example request:
curl --request GET \
    --get "https://onoxia.nz/api/v1/bot/rag" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"
const url = new URL(
    "https://onoxia.nz/api/v1/bot/rag"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};


fetch(url, {
    method: "GET",
    headers,
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/rag';
$response = $client->get(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Example response (401):

Show headers 
cache-control: no-cache, private
content-type: application/json
access-control-allow-origin: *
 

{
    "message": "Unauthenticated."
}

Request      

GET api/v1/bot/rag

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

Create a RAG source

requires authentication

Creates a new knowledge source for the bot. Supported types: faq (question + answer pair) and text (free-form text/markdown). After creation, the source is automatically queued for processing — vector embeddings are generated and stored in Qdrant.

Optional: Add context_tags or url_patterns to restrict when this source is used. For example, a product FAQ with url_patterns: ["/products/*"] will only be searched when visitors are on product pages.

Requires: rag:write permission.

Example request:
curl --request POST \
    "https://onoxia.nz/api/v1/bot/rag" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    --data "{
    \"type\": \"text\",
    \"name\": \"b\",
    \"question\": \"architecto\",
    \"answer\": \"architecto\"
}"

const url = new URL(
    "https://onoxia.nz/api/v1/bot/rag"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

let body = {
    "type": "text",
    "name": "b",
    "question": "architecto",
    "answer": "architecto"
};

fetch(url, {
    method: "POST",
    headers,
    body: JSON.stringify(body),
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/rag';
$response = $client->post(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
        'json' => [
            'type' => 'text',
            'name' => 'b',
            'question' => 'architecto',
            'answer' => 'architecto',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Request      

POST api/v1/bot/rag

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

Body Parameters

type   string     

Example: text

Must be one of:
  • faq
  • text
name   string     

:Attribute darf maximal 255 Zeichen haben. Example: b

question   string  optional    

This field is required when type is faq. Example: architecto

answer   string     

Example: architecto

context_tags   object  optional    
url_patterns   object  optional    

Bulk sync RAG sources

requires authentication

Upsert + delete in a single request. Ideal for CMS plugins that sync page content automatically. Sources are matched by name — existing sources with the same name are updated, new names are created.

With delete_missing: true, any API-created sources (source: "api") whose names are NOT in the request body will be deleted. Manually created sources (via dashboard) are never deleted by sync.

Returns a summary: { created, updated, deleted, unchanged }.

Requires: rag:write permission.

Example request:
curl --request POST \
    "https://onoxia.nz/api/v1/bot/rag/sync" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    --data "{
    \"sources\": [
        {
            \"name\": \"b\",
            \"type\": \"text\",
            \"answer\": \"architecto\",
            \"question\": \"architecto\"
        }
    ],
    \"delete_missing\": true
}"

const url = new URL(
    "https://onoxia.nz/api/v1/bot/rag/sync"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

let body = {
    "sources": [
        {
            "name": "b",
            "type": "text",
            "answer": "architecto",
            "question": "architecto"
        }
    ],
    "delete_missing": true
};

fetch(url, {
    method: "POST",
    headers,
    body: JSON.stringify(body),
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/rag/sync';
$response = $client->post(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
        'json' => [
            'sources' => [
                [
                    'name' => 'b',
                    'type' => 'text',
                    'answer' => 'architecto',
                    'question' => 'architecto',
                ],
            ],
            'delete_missing' => true,
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Request      

POST api/v1/bot/rag/sync

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

Body Parameters

sources   object[]     

:Attribute muss mindestens 1 Elemente haben.
name   string     

:Attribute darf maximal 255 Zeichen haben. Example: b

type   string     

Example: text

Must be one of:
  • faq
  • text
answer   string     

Example: architecto

question   string  optional    

Example: architecto

context_tags   object  optional    
url_patterns   object  optional    
delete_missing   boolean  optional    

Example: true

Update a RAG source

requires authentication

Updates an existing knowledge source by ID. The source is automatically re-processed after update (new embeddings are generated). Only send the fields you want to change.

Note: Changing the answer or question triggers re-embedding, which may take a few seconds.

Requires: rag:write permission.

Example request:
curl --request PUT \
    "https://onoxia.nz/api/v1/bot/rag/architecto" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    --data "{
    \"name\": \"b\",
    \"question\": \"architecto\",
    \"answer\": \"architecto\"
}"

const url = new URL(
    "https://onoxia.nz/api/v1/bot/rag/architecto"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

let body = {
    "name": "b",
    "question": "architecto",
    "answer": "architecto"
};

fetch(url, {
    method: "PUT",
    headers,
    body: JSON.stringify(body),
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/rag/architecto';
$response = $client->put(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
        'json' => [
            'name' => 'b',
            'question' => 'architecto',
            'answer' => 'architecto',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Request      

PUT api/v1/bot/rag/{id}

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

URL Parameters

id   string     

The ID of the rag. Example: architecto

Body Parameters

name   string  optional    

:Attribute darf maximal 255 Zeichen haben. Example: b

question   string  optional    

Example: architecto

answer   string  optional    

Example: architecto

context_tags   object  optional    
url_patterns   object  optional    

Delete a RAG source

requires authentication

Permanently deletes a knowledge source and all its vector chunks. The bot will no longer reference this content. The Qdrant collection is automatically re-provisioned.

Requires: rag:write permission.

Example request:
curl --request DELETE \
    "https://onoxia.nz/api/v1/bot/rag/architecto" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"
const url = new URL(
    "https://onoxia.nz/api/v1/bot/rag/architecto"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};


fetch(url, {
    method: "DELETE",
    headers,
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/rag/architecto';
$response = $client->delete(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Request      

DELETE api/v1/bot/rag/{id}

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

URL Parameters

id   string     

The ID of the rag. Example: architecto

Schedules

List schedules

requires authentication

Returns all schedule rules for this chatbot. Schedules control when the bot is active, inactive, or displays a custom message. Use them to implement business hours, holiday messages, or time-based bot behavior.

Each schedule has an action (on, off, message), time range, optional weekday filter, date range, timezone, and priority (higher number = higher priority).

Requires: schedules:read permission.

Example request:
curl --request GET \
    --get "https://onoxia.nz/api/v1/bot/schedules" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"
const url = new URL(
    "https://onoxia.nz/api/v1/bot/schedules"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};


fetch(url, {
    method: "GET",
    headers,
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/schedules';
$response = $client->get(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Example response (401):

Show headers 
cache-control: no-cache, private
content-type: application/json
access-control-allow-origin: *
 

{
    "message": "Unauthenticated."
}

Request      

GET api/v1/bot/schedules

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

Create a schedule

requires authentication

Creates a new schedule rule. Actions: on (activate bot), off (deactivate bot), message (show custom text instead of bot response).

Weekdays are optional — empty array means the schedule applies every day. Use 0 for Sunday through 6 for Saturday.

The use_browser_timezone flag makes the schedule use the visitor's local time (detected from the browser). Otherwise, the timezone field is used.

Requires: schedules:write permission.

Example request:
curl --request POST \
    "https://onoxia.nz/api/v1/bot/schedules" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    --data "{
    \"name\": \"b\",
    \"action\": \"message\",
    \"message\": \"architecto\",
    \"time_from\": \"13:57\",
    \"time_to\": \"13:57\",
    \"date_from\": \"2026-07-28T13:57:36\",
    \"date_to\": \"2026-07-28T13:57:36\",
    \"timezone\": \"Asia\\/Ulaanbaatar\",
    \"use_browser_timezone\": false,
    \"priority\": 84,
    \"is_active\": false
}"

const url = new URL(
    "https://onoxia.nz/api/v1/bot/schedules"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

let body = {
    "name": "b",
    "action": "message",
    "message": "architecto",
    "time_from": "13:57",
    "time_to": "13:57",
    "date_from": "2026-07-28T13:57:36",
    "date_to": "2026-07-28T13:57:36",
    "timezone": "Asia\/Ulaanbaatar",
    "use_browser_timezone": false,
    "priority": 84,
    "is_active": false
};

fetch(url, {
    method: "POST",
    headers,
    body: JSON.stringify(body),
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/schedules';
$response = $client->post(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
        'json' => [
            'name' => 'b',
            'action' => 'message',
            'message' => 'architecto',
            'time_from' => '13:57',
            'time_to' => '13:57',
            'date_from' => '2026-07-28T13:57:36',
            'date_to' => '2026-07-28T13:57:36',
            'timezone' => 'Asia/Ulaanbaatar',
            'use_browser_timezone' => false,
            'priority' => 84,
            'is_active' => false,
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Request      

POST api/v1/bot/schedules

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

Body Parameters

name   string     

:Attribute darf maximal 255 Zeichen haben. Example: b

action   string     

Example: message

Must be one of:
  • on
  • off
  • message
message   string  optional    

This field is required when action is message. Example: architecto

weekdays   object  optional    
time_from   string     

Must be a valid date in the format H:i. Example: 13:57

time_to   string     

Must be a valid date in the format H:i. Example: 13:57

date_from   string  optional    

:Attribute muss ein gültiges Datum sein. Example: 2026-07-28T13:57:36

date_to   string  optional    

:Attribute muss ein gültiges Datum sein. Example: 2026-07-28T13:57:36

timezone   string  optional    

:Attribute darf maximal 64 Zeichen haben. Example: Asia/Ulaanbaatar

use_browser_timezone   boolean  optional    

Example: false

priority   integer  optional    

:Attribute muss mindestens 0 sein. Example: 84

is_active   boolean  optional    

Example: false

Update a schedule

requires authentication

Updates an existing schedule rule by ID. Only send the fields you want to change.

Requires: schedules:write permission.

Example request:
curl --request PUT \
    "https://onoxia.nz/api/v1/bot/schedules/architecto" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    --data "{
    \"name\": \"b\",
    \"action\": \"message\",
    \"message\": \"architecto\",
    \"time_from\": \"13:57\",
    \"time_to\": \"13:57\",
    \"date_from\": \"2026-07-28T13:57:36\",
    \"date_to\": \"2026-07-28T13:57:36\",
    \"timezone\": \"Asia\\/Ulaanbaatar\",
    \"use_browser_timezone\": true,
    \"priority\": 84,
    \"is_active\": false
}"

const url = new URL(
    "https://onoxia.nz/api/v1/bot/schedules/architecto"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

let body = {
    "name": "b",
    "action": "message",
    "message": "architecto",
    "time_from": "13:57",
    "time_to": "13:57",
    "date_from": "2026-07-28T13:57:36",
    "date_to": "2026-07-28T13:57:36",
    "timezone": "Asia\/Ulaanbaatar",
    "use_browser_timezone": true,
    "priority": 84,
    "is_active": false
};

fetch(url, {
    method: "PUT",
    headers,
    body: JSON.stringify(body),
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/schedules/architecto';
$response = $client->put(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
        'json' => [
            'name' => 'b',
            'action' => 'message',
            'message' => 'architecto',
            'time_from' => '13:57',
            'time_to' => '13:57',
            'date_from' => '2026-07-28T13:57:36',
            'date_to' => '2026-07-28T13:57:36',
            'timezone' => 'Asia/Ulaanbaatar',
            'use_browser_timezone' => true,
            'priority' => 84,
            'is_active' => false,
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Request      

PUT api/v1/bot/schedules/{id}

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

URL Parameters

id   string     

The ID of the schedule. Example: architecto

Body Parameters

name   string  optional    

:Attribute darf maximal 255 Zeichen haben. Example: b

action   string  optional    

Example: message

Must be one of:
  • on
  • off
  • message
message   string  optional    

Example: architecto

weekdays   object  optional    
time_from   string  optional    

Must be a valid date in the format H:i. Example: 13:57

time_to   string  optional    

Must be a valid date in the format H:i. Example: 13:57

date_from   string  optional    

:Attribute muss ein gültiges Datum sein. Example: 2026-07-28T13:57:36

date_to   string  optional    

:Attribute muss ein gültiges Datum sein. Example: 2026-07-28T13:57:36

timezone   string  optional    

:Attribute darf maximal 64 Zeichen haben. Example: Asia/Ulaanbaatar

use_browser_timezone   boolean  optional    

Example: true

priority   integer  optional    

:Attribute muss mindestens 0 sein. Example: 84

is_active   boolean  optional    

Example: false

Delete a schedule

requires authentication

Permanently deletes a schedule rule by ID.

Requires: schedules:write permission.

Example request:
curl --request DELETE \
    "https://onoxia.nz/api/v1/bot/schedules/architecto" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"
const url = new URL(
    "https://onoxia.nz/api/v1/bot/schedules/architecto"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};


fetch(url, {
    method: "DELETE",
    headers,
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/schedules/architecto';
$response = $client->delete(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Request      

DELETE api/v1/bot/schedules/{id}

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

URL Parameters

id   string     

The ID of the schedule. Example: architecto

Site (Bot Config)

Read bot configuration

requires authentication

Returns the full configuration of the chatbot bound to this API token, including widget settings, system prompt, bot rules, languages, and usage counters (RAG sources, conversations, webhooks, leads). Use this to verify your token is working and to inspect the current bot setup.

Requires: site:read permission.

Example request:
curl --request GET \
    --get "https://onoxia.nz/api/v1/bot/site" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"
const url = new URL(
    "https://onoxia.nz/api/v1/bot/site"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};


fetch(url, {
    method: "GET",
    headers,
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/site';
$response = $client->get(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Example response (401):

Show headers 
cache-control: no-cache, private
content-type: application/json
access-control-allow-origin: *
 

{
    "message": "Unauthenticated."
}

Request      

GET api/v1/bot/site

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

Update bot settings

requires authentication

Partially updates the chatbot configuration. Only send the fields you want to change. JSON fields (widget_config, bot_rules, handover_config) are merged with existing values, not replaced — so you can update individual keys without losing others.

If you change the system_prompt or bot_rules, the bot is automatically re-provisioned (RAG embeddings are rebuilt). This may take a few seconds.

Requires: site:write permission.

Example request:
curl --request PATCH \
    "https://onoxia.nz/api/v1/bot/site" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    --data "{
    \"name\": \"b\",
    \"system_prompt\": \"n\",
    \"response_length\": \"medium\",
    \"is_active\": false,
    \"privacy_text\": \"architecto\",
    \"privacy_url\": \"http:\\/\\/bailey.com\\/\"
}"

const url = new URL(
    "https://onoxia.nz/api/v1/bot/site"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

let body = {
    "name": "b",
    "system_prompt": "n",
    "response_length": "medium",
    "is_active": false,
    "privacy_text": "architecto",
    "privacy_url": "http:\/\/bailey.com\/"
};

fetch(url, {
    method: "PATCH",
    headers,
    body: JSON.stringify(body),
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/site';
$response = $client->patch(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
        'json' => [
            'name' => 'b',
            'system_prompt' => 'n',
            'response_length' => 'medium',
            'is_active' => false,
            'privacy_text' => 'architecto',
            'privacy_url' => 'http://bailey.com/',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Request      

PATCH api/v1/bot/site

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

Body Parameters

name   string  optional    

:Attribute darf maximal 255 Zeichen haben. Example: b

system_prompt   string  optional    

:Attribute darf maximal 10000 Zeichen haben. Example: n

response_length   string  optional    

Example: medium

Must be one of:
  • short
  • medium
  • detailed
is_active   boolean  optional    

Example: false

allowed_domains   object  optional    
bot_languages   object  optional    
widget_config   object  optional    
bot_rules   object  optional    
handover_config   object  optional    
privacy_text   string  optional    

Example: architecto

privacy_url   string  optional    

Must be a valid URL. :Attribute darf maximal 500 Zeichen haben. Example: http://bailey.com/

Support Agents

List support agents

requires authentication

Returns all support agents for your account with their assigned sites and online status. Support agents are used for the Live Chat / Handover feature — they can take over bot conversations and chat directly with visitors.

Requires: agents:read permission.

Example request:
curl --request GET \
    --get "https://onoxia.nz/api/v1/bot/agents" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"
const url = new URL(
    "https://onoxia.nz/api/v1/bot/agents"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};


fetch(url, {
    method: "GET",
    headers,
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/agents';
$response = $client->get(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Example response (401):

Show headers 
cache-control: no-cache, private
content-type: application/json
access-control-allow-origin: *
 

{
    "message": "Unauthenticated."
}

Request      

GET api/v1/bot/agents

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

Create a support agent

requires authentication

Creates a new support agent who can log in at /support and handle live chat handovers. Agents must be assigned to at least one site via site_ids (array of site UUIDs). The agent receives their own login credentials (email + password) separate from the tenant account.

Requires: agents:write permission.

Example request:
curl --request POST \
    "https://onoxia.nz/api/v1/bot/agents" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    --data "{
    \"name\": \"b\",
    \"email\": \"zbailey@example.net\",
    \"password\": \"-0pBNvYgxw\",
    \"locale\": \"de\"
}"

const url = new URL(
    "https://onoxia.nz/api/v1/bot/agents"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

let body = {
    "name": "b",
    "email": "zbailey@example.net",
    "password": "-0pBNvYgxw",
    "locale": "de"
};

fetch(url, {
    method: "POST",
    headers,
    body: JSON.stringify(body),
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/agents';
$response = $client->post(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
        'json' => [
            'name' => 'b',
            'email' => 'zbailey@example.net',
            'password' => '-0pBNvYgxw',
            'locale' => 'de',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Request      

POST api/v1/bot/agents

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

Body Parameters

name   string     

:Attribute darf maximal 255 Zeichen haben. Example: b

email   string     

:Attribute muss eine gültige E-Mail-Adresse sein. :Attribute darf maximal 255 Zeichen haben. Example: zbailey@example.net

password   string     

:Attribute muss mindestens 8 Zeichen lang sein. Example: -0pBNvYgxw

locale   string  optional    

Example: de

Must be one of:
  • de
  • en
site_ids   object  optional    

Update a support agent

requires authentication

Updates an existing support agent by UUID. You can change name, email, password, locale, active status, and site assignments. Only send the fields you want to change.

Requires: agents:write permission.

Example request:
curl --request PUT \
    "https://onoxia.nz/api/v1/bot/agents/6ff8f7f6-1eb3-3525-be4a-3932c805afed" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json" \
    --data "{
    \"name\": \"b\",
    \"email\": \"zbailey@example.net\",
    \"password\": \"-0pBNvYgxw\",
    \"locale\": \"en\",
    \"is_active\": true
}"

const url = new URL(
    "https://onoxia.nz/api/v1/bot/agents/6ff8f7f6-1eb3-3525-be4a-3932c805afed"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};

let body = {
    "name": "b",
    "email": "zbailey@example.net",
    "password": "-0pBNvYgxw",
    "locale": "en",
    "is_active": true
};

fetch(url, {
    method: "PUT",
    headers,
    body: JSON.stringify(body),
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/agents/6ff8f7f6-1eb3-3525-be4a-3932c805afed';
$response = $client->put(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
        'json' => [
            'name' => 'b',
            'email' => 'zbailey@example.net',
            'password' => '-0pBNvYgxw',
            'locale' => 'en',
            'is_active' => true,
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Request      

PUT api/v1/bot/agents/{uuid}

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

URL Parameters

uuid   string     

Example: 6ff8f7f6-1eb3-3525-be4a-3932c805afed

Body Parameters

name   string  optional    

:Attribute darf maximal 255 Zeichen haben. Example: b

email   string  optional    

:Attribute muss eine gültige E-Mail-Adresse sein. :Attribute darf maximal 255 Zeichen haben. Example: zbailey@example.net

password   string  optional    

:Attribute muss mindestens 8 Zeichen lang sein. Example: -0pBNvYgxw

locale   string  optional    

Example: en

Must be one of:
  • de
  • en
is_active   boolean  optional    

Example: true

site_ids   object  optional    

Delete a support agent

requires authentication

Permanently deletes a support agent. The agent will no longer be able to log in or handle conversations. Active conversations assigned to this agent are returned to the bot.

Requires: agents:write permission.

Example request:
curl --request DELETE \
    "https://onoxia.nz/api/v1/bot/agents/6ff8f7f6-1eb3-3525-be4a-3932c805afed" \
    --header "Authorization: Bearer onx_{YOUR_TOKEN}" \
    --header "Content-Type: application/json" \
    --header "Accept: application/json"
const url = new URL(
    "https://onoxia.nz/api/v1/bot/agents/6ff8f7f6-1eb3-3525-be4a-3932c805afed"
);

const headers = {
    "Authorization": "Bearer onx_{YOUR_TOKEN}",
    "Content-Type": "application/json",
    "Accept": "application/json",
};


fetch(url, {
    method: "DELETE",
    headers,
}).then(response => response.json());
$client = new \GuzzleHttp\Client();
$url = 'https://onoxia.nz/api/v1/bot/agents/6ff8f7f6-1eb3-3525-be4a-3932c805afed';
$response = $client->delete(
    $url,
    [
        'headers' => [
            'Authorization' => 'Bearer onx_{YOUR_TOKEN}',
            'Content-Type' => 'application/json',
            'Accept' => 'application/json',
        ],
    ]
);
$body = $response->getBody();
print_r(json_decode((string) $body));

Request      

DELETE api/v1/bot/agents/{uuid}

Headers

Authorization        

Example: Bearer onx_{YOUR_TOKEN}

Content-Type        

Example: application/json

Accept        

Example: application/json

URL Parameters

uuid   string     

Example: 6ff8f7f6-1eb3-3525-be4a-3932c805afed

© 2026 OCENOX LTD, New Zealand PrivacyImprintTerms