BotStar
AI · AI
Bots, the CMS content behind them, and subscribers in the account they connected.
Connecting BotStar in practice
BotStar is two unrelated APIs behind one name — an Engine API at apis.botstar.com/v1 and a Livechat API documented somewhere else entirely — and everything in the Engine API is addressed by a bot id that the objects themselves do not tell you. The documentation ships separate help pages for finding a bot id, a CMS entity id and a language configuration, so an agent needs a lookup pass before it can make its first useful call.
Scopes that draw scrutiny
Bearer token (BearerAuth)One HTTP bearer token with no scopes. It reaches bots, bot attributes, end users, user attributes and the CMS alike, so there is no read-only form of it.POST /bots/{botId}/publishPublishing a bot to live is an ordinary endpoint rather than a console action, so the same token that reads a bot can push one into production.
Worth knowing
- Ids are not discoverable from the objects. BotStar publishes dedicated guides for locating a bot id, a user id, a CMS entity id and an entity item id, which is a sign the ids come from the UI rather than from a list call.
- User attributes and bot attributes are separate resources with separate endpoints, so "set a field" means knowing which of the two an integration is really writing.
- No rate limit is published on the Engine API reference, so the only safe assumption is that the ceiling is undocumented rather than absent.
Checked against BotStar Public API (Engine API) (2026-09-29), BotStar Livechat API (2026-09-29), BotStar getting started (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put BotStar behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.