Chat Widget
All endpoints used by the embedded chat widget on customer websites.
The page “Chat Widget — API Reference” covers the function identified by this URL. The existing summary is expanded with the actual workflow, prerequisites and known limitations. Allowed domains are maintained by Zentor when the widget is created; the tenant dashboard has no settings interface for this. A non-approved origin can produce WIDGET_ORIGIN_DENIED. Widget creation itself is restricted to Master Admin, while the tenant receives the completed embed code.
`GET /api/public/widget/health` must be implemented as documented on this page. The client should follow the declared method, path, authentication model, required fields and error responses rather than copying only the example payload. Zentor has no general developer API-key system; a route is either public or uses the documented Widget token and origin validation.
For `/api/public/widget/health`, evaluate the HTTP status together with the JSON body. Validation failures, missing resources, rejected origins, expired one-time values and server errors require different handling. An accepted request confirms only this processing step; it does not automatically prove that an email was delivered, a payment completed or an identity provider finished an SSO flow.
Use anonymised test values for `GET /api/public/widget/health`. Public examples must not contain real customer data, production-like UUIDs, session JWTs, Widget tokens or concrete historical timestamps. The known platform-wide limit is 2,000 requests per 15 minutes. No separate limit for this individual endpoint is proven, so clients is best advised to still cap retries and avoid uncontrolled polling.
Idempotency matters when retrying this route. A non-idempotent POST must not be sent again automatically following an ambiguous network interruption, because the original request may already have created a side effect. Logs should record status, error code and a safe request reference, but never passwords, reset tokens or other credentials.
The source of truth for “Chat Widget — API Reference” is the API registry under `app/frontend/src/content/api-reference/` together with the corresponding backend route and tests. A negative test or a similarity to another code path is not a complete live verification. The current URL is required to state precisely whether a claim comes from schema, automated test or safely observed live behaviour.