REFERENCE

Capability API

Every inbound endpoint your app calls, authenticated with your PartnerAppApiKey. A small, fixed allowlist — there is no generic query endpoint.

Authentication

Every request
Authorization: Bearer pak.<id>.<secret>

An unapproved app's key only ever authenticates against the sandbox tenant — see Sandbox testing. Every request re-checks that your app is still enabled by the installing company, so a disable or uninstall is an immediate cutoff.

conversations.read

GET /partner-apps/capabilities/conversations/
{
  "success": true,
  "data": [
    { "id": 91, "employee_id": 12, "started_at": "2026-08-01T14:02:00Z", "message_count": 6 }
  ]
}

employees.read

GET /partner-apps/capabilities/employees/
{
  "success": true,
  "data": [
    { "id": 12, "full_name": "Jordan Lee", "department": "Support", "position": "Agent" }
  ]
}

usage.read

GET /partner-apps/capabilities/usage/
{
  "success": true,
  "data": [
    { "date": "2026-08-01", "tokens": 48210, "requests": 312 }
  ]
}

Rate limits

Inbound partner traffic has its own budget — 300 requests/hour per key — independent of the installing company's own human-traffic rate limit, so a busy integration never eats into their normal usage allowance.

Go liveGateway inference