Everything the dashboard does, on REST.
The public API mirrors the dashboard: conversations, channels, customers, products, orders, automations, and analytics. Authentication is OAuth 2.0 with refresh tokens; we publish an OpenAPI 3.1 spec and SDK quickstarts for Node, Python, and Go. Every endpoint that writes is rate-limited per workspace, every endpoint that reads is cache-friendly with ETag.
Authentication
POST /v1/oauth/token with client_id, client_secret, and grant_type=client_credentials returns a short-lived bearer (15 min) plus a refresh token. Refresh flows are identical to RFC 6749 §6. All write endpoints require the workspace scope claim; service accounts can be scoped to a subset of conversation channels.
Conversations and messages
GET /v1/conversations lists active conversations with cursor pagination. POST /v1/conversations/{id}/messages accepts text, image, audio, document, or template payloads and synchronously returns the persisted message id. Webhooks: conversation.started, message.received, message.delivered, message.read.
Catalog and orders
GET /v1/catalog/products mirrors Salla / Zid / Shopify SKUs into a single search index — useful for the chatbot tool layer. POST /v1/orders dispatches a draft order into the store platform rather than Muhadith (we don't bill). Webhooks: order.created, order.paid, order.fulfilled, order.cancelled.
Rate limits and retries
Default tier: 60 write req/min/workspace, 600 read req/min/workspace. 429 responses include Retry-After in seconds and an X-RateLimit-Reset epoch. We recommend exponential backoff with jitter; idempotency keys are honored on POST /v1/orders and POST /v1/conversations/{id}/messages.