Chatbot API Integration: REST API and Signed Webhooks
When a native integration does not exist, the API does. matram.ai exposes a Bearer-authenticated REST API and signed outbound webhooks, so you can wire the chatbot into anything you run.
matram.ai ships native connectors for the common tools, but no product covers every stack. The API is the escape hatch. It is a normal REST API with API-key auth, so if your platform can make an HTTPS request, it can talk to matram.ai.
There are two directions. You call the REST API to read and create resources (chatbots, sources, conversations, leads) and to send messages. matram.ai calls your endpoint through a signed webhook when something happens (a lead is captured, a conversation starts), so you can push events into your own systems.
What the API gives you
The public API lives under /api/v1 and is authenticated with a Bearer API key. These endpoints are live:
- GET and POST /api/v1/chatbots list and create chatbots
- GET and POST /api/v1/chatbots/{id}/sources list and add training sources
- POST /api/v1/chatbots/{id}/chat sends a visitor message and returns the AI reply
- GET /api/v1/conversations lists conversations
- GET /api/v1/leads lists captured leads
Outbound, the webhook action sends a signed POST to a URL you choose whenever it fires, carrying the lead, the transcript, the event type and your workspace id. That is how you get matram.ai data into a CRM, a spreadsheet, or a queue without a native connector.
Before you start
Prerequisites
- A matram.ai account on the Standard or Pro plan (the public API is not on Basic)
- An API key generated in the dashboard
- An HTTPS endpoint of your own if you want to receive webhooks
- Anything that can send an HTTPS request (curl, a backend, a workflow tool)
How to use the matram.ai API
Generate a key, make an authenticated call, then wire up a webhook. Every sample below is real and runs against your workspace.
- 1
Get on a plan with API access
The public API requires Standard or Pro. Start the 7-day free trial at matram.ai/signup and pick Standard to unlock it.
- 2
Generate an API key
In the dashboard, open API keys and create one. Copy it once and store it as a secret. Treat it like a password, because it authorises calls against your whole workspace.
- 3
Make your first request
Authenticate with the Authorization header. List your chatbots to confirm the key works:
- 4
Send a message programmatically
Post a visitor message to a specific bot and read the AI reply. This is the endpoint behind a custom chat UI or a server-side automation:
- 5
Receive events with a signed webhook
Add a webhook with your URL and a secret. matram.ai POSTs the event JSON and signs it with HMAC-SHA256 in the x-signature header, so you can verify it is genuine before trusting it.
Connect the API on the free trial. No credit card required.
Book a demoAuthentication, limits and signatures
Authenticate every REST call with a Bearer key over HTTPS. Requests are rate limited to 120 per minute per key. Webhooks are signed so you can verify them. The essentials:
# 1) List chatbots (auth check)
curl https://api.matram.ai/api/v1/chatbots \
-H "Authorization: Bearer $MATRAM_API_KEY"
# 2) Send a message, get the AI reply
curl -X POST https://api.matram.ai/api/v1/chatbots/BOT_ID/chat \
-H "Authorization: Bearer $MATRAM_API_KEY" \
-H "content-type: application/json" \
-d '{"message":"What are your hours?","visitorId":"abc-123"}'
# 3) Verify a webhook signature (Node)
import { createHmac } from "node:crypto";
const expected =
"sha256=" + createHmac("sha256", SECRET).update(rawBody).digest("hex");
if (req.headers["x-signature"] !== expected) return res.status(401).end();matram.ai reads
- Chatbots, sources, conversations, leads (GET)
- AI replies to posted messages
matram.ai writes
- Create chatbots and add training sources (POST)
- Outbound webhook POSTs to your endpoint on events
- Each webhook signed with HMAC-SHA256 (x-signature)
Troubleshooting
401 Missing API key (Bearer)
Your Authorization header is absent or malformed. It must read exactly Authorization: Bearer followed by the key, with a single space.
403 The public API requires the Growth plan or higher
Your workspace is on Basic. The API is a Standard and Pro feature. Upgrade to enable it. The 403 text still uses the plan's old name.
429 API rate limit exceeded
You passed 120 requests per minute on one key. Back off and retry, or spread load across scheduled batches.
My webhook receiver rejects the payload
Verify the HMAC over the raw request body, not the parsed JSON. Any re-serialisation changes the bytes and breaks the signature. Compare against the x-signature header.
Cost
The API is included on Standard ($69/mo) and Pro ($199/mo). It is not available on Basic ($29/mo). All plans are flat with unlimited seats, and there is a 7-day free trial with no credit card.
There is no per-call fee on top of your plan. Usage counts against your plan's monthly message allowance in the same way the widget does, and per-key traffic is capped at 120 requests a minute.