BotStar
AI · AI
Bots, the CMS content behind them, and subscribers in the account they connected.
Acts as the person, not as itself
Each user connects their own account. Every call carries both identities — the agent and the person it is acting for — so the agent can never reach past what that individual can already do.
Credentials never touch the agent
Tokens live in the vault and attach server-side at call time. The agent holds a session, not a secret, and revoking access does not mean rotating a key.
Every call on the record
Who asked, which agent acted, which action ran, and the verdict that let it through — one audit trail across every integration, not one per vendor.
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
botstar_delete_bots_by_botid_attributes_by_attributeidWRITEPermanently delete one bot-level attribute. The conversation flow stops resolving it, so deleting an attribute a published bot reads will change how that bot behaves via DELETE /bots/{botId}/attributes/{attributeId}
botstar_delete_bots_by_botid_cms_entities_by_entityidWRITEPermanently delete a CMS entity and every item stored in it. Any part of the conversation flow that reads this entity stops working via DELETE /bots/{botId}/cms_entities/{entityId}
botstar_delete_bots_by_botid_cms_entities_by_entityid_fieldsWRITEDelete fields from a CMS entity, named by a comma-separated list of their `unique_name`s. The value every item held for those fields goes with them via DELETE /bots/{botId}/cms_entities/{entityId}/fields
botstar_delete_bots_by_botid_cms_entities_by_entityid_items_by_entityitemidWRITEPermanently delete one item from a CMS entity. To take an item out of the bot without losing it, update its status to `disabled` instead via DELETE /bots/{botId}/cms_entities/{entityId}/items/{entityItemId}
botstar_get_botsREADList every bot on the BotStar account the API token belongs to, each with its id, name and team name. The token is issued at ACCOUNT level, so this is the way to discover the botId every other tool needs via GET /bots
botstar_get_bots_by_botidREADFetch one bot's id, name and team name. Answers 404 "Cannot found bot for ID" for a bot id that is not on this account via GET /bots/{botId}
botstar_get_bots_by_botid_attributesREADList the bot's bot-level attributes -- account-wide values the conversation flow reads, each with its id, name, data type and value. These are the BOT's attributes, not a subscriber's via GET /bots/{botId}/attributes
botstar_get_bots_by_botid_cms_entitiesREADList the bot's CMS entities -- the content types behind its galleries and lists (Product, Category, Reviews) -- each with its id, name and field definitions via GET /bots/{botId}/cms_entities
botstar_get_bots_by_botid_cms_entities_by_entityidREADFetch one CMS entity with its full field list. This is where a field's `unique_name` comes from, which is the key every CMS item tool uses to carry that field's value via GET /bots/{botId}/cms_entities/{entityId}
botstar_get_bots_by_botid_cms_entities_by_entityid_itemsREADList the items stored in one CMS entity, page by page, optionally filtered by name or by enabled/disabled status. Each item carries `_id` plus one key per entity field, named by that field's `unique_name` via GET /bots/{botId}/cms_entities/{entityId}/items
botstar_get_bots_by_botid_cms_entities_by_entityid_items_by_entityitemidREADFetch one CMS item with the value it holds for every field of its entity via GET /bots/{botId}/cms_entities/{entityId}/items/{entityItemId}
botstar_get_bots_by_botid_users_by_useridREADFetch one subscriber of the bot -- a person who has talked to it on a connected channel -- with their profile fields and custom attributes. The id is BotStar's subscriber id, not a channel id; an unknown one answers 400 "Cannot found audience for ID" via GET /bots/{botId}/users/{userId}
botstar_patch_bots_by_botid_attributes_by_attributeidWRITEChange a bot-level attribute's value or description. The attribute's name and data type cannot be changed here -- delete and recreate it to change either via PATCH /bots/{botId}/attributes/{attributeId}
botstar_patch_bots_by_botid_cms_entities_by_entityidWRITERename a CMS entity. Only the entity's name is editable here -- use the field tools to change its fields via PATCH /bots/{botId}/cms_entities/{entityId}
botstar_patch_bots_by_botid_cms_entities_by_entityid_fieldsWRITERename fields of a CMS entity, or replace the predefined options of a select field. Each entry is addressed by its `unique_name`, which is not itself editable via PATCH /bots/{botId}/cms_entities/{entityId}/fields
botstar_patch_bots_by_botid_cms_entities_by_entityid_items_by_entityitemidWRITEUpdate an item's name, its status, or the value it holds for any field of its entity. Only the keys sent are changed via PATCH /bots/{botId}/cms_entities/{entityId}/items/{entityItemId}
botstar_patch_bots_by_botid_users_by_useridWRITEUpdate a subscriber's profile fields (first name, last name, email, gender, birthday) and any custom attributes defined on the bot. At least one field must be sent via PATCH /bots/{botId}/users/{userId}
botstar_post_botsWRITECreate a new bot on the account from a name and return its id. The bot is created empty -- it has no conversation flow until one is built in the BotStar editor via POST /bots
botstar_post_bots_by_botid_attributesWRITECreate a bot-level attribute from a name, a data type (string, number or date) and a value. The name must be unique within the bot via POST /bots/{botId}/attributes
botstar_post_bots_by_botid_cms_entitiesWRITECreate a CMS entity (a content type) from a name and a list of fields. BotStar adds a Name and a Status field of its own; the fields sent here are added after them via POST /bots/{botId}/cms_entities
botstar_post_bots_by_botid_cms_entities_by_entityid_fieldsWRITEAdd one or more fields to an existing CMS entity. Each field carries a name, a `unique_name` (the key items use for its value) and a data type; `single_option` and `multiple_options` fields also carry their predefined options via POST /bots/{botId}/cms_entities/{entityId}/fields
botstar_post_bots_by_botid_cms_entities_by_entityid_itemsWRITECreate an item in a CMS entity. `name` is required; every other value is keyed by the entity field's `unique_name`, and `status` decides whether the bot may show it via POST /bots/{botId}/cms_entities/{entityId}/items
botstar_post_bots_by_botid_publishWRITEPublish the bot's draft, promoting everything currently in the draft environment to live. This is what makes edits -- flows, CMS content and attributes -- visible to the people talking to the bot via POST /bots/{botId}/publish
botstar_post_bots_by_botid_users_attributesWRITEDefine a new custom attribute on the bot's subscribers, from a field name and a field type (string, number, date or boolean). Every subscriber can then carry a value for it via POST /bots/{botId}/users/attributes
botstar_post_messagesWRITESend a message from a bot to one of its subscribers, addressed by BotStar subscriber id. The message body follows BotStar's own JSON message format (docs.botstar.com/docs/en/message-api). Channels such as Facebook Messenger only allow a message outside the 24-hour window when `options.message_tag` names an approved tag via POST /messages
Often connected alongside
Put BotStar behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.