Build bots for Coviqo

Profile of the bot plus its public key and the requested permissions / intents. Good first call to check a token.

Response

200 Profile – BotMe

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Response

200 Installations (paused ones included, enabled: false) – BotSpace[]

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Parameters

Response

200 Rooms by position – BotRoom[]

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED
• 404 SPACE_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Active members (standard intent MEMBERS: names, roles), ordered by member id. Space identities (per-space names) are applied. joinSource is always present (null without space.invite / space.manage_members or for joins before invite tracking); linkedAccounts only with LINKED_ACCOUNTS and the member’s consent.

Parameters

Response

200 One page – BotMemberPage

Errors

• 400 VALIDATION_FAILED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED, MISSING_PERMISSION
• 404 SPACE_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Parameters

Response

200 The member – BotMember

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED
• 404 SPACE_NOT_FOUND, MEMBER_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

All roles, highest first (position 0 = highest). assignable = the bot may assign / remove the role right now (ROLES_ASSIGN, allow-list, below the bot role; admin-level roles only with “allow roles with admin rights”).

Parameters

Response

200 Roles by position – BotRole[]

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED
• 404 SPACE_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

The active member who linked this Discord account AND released it for the bots of this space (consent "BOTS_LINKED_DISCORD", revocable). Unknown ids and members without consent both answer 404 MEMBER_NOT_FOUND.

Data access: LINKED_ACCOUNTS.

Parameters

Response

200 The member incl. linkedAccounts – BotMember

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED
• 404 SPACE_NOT_FOUND, MEMBER_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Active members with a linked account of provider who released it for the bots of this space, ordered by user id. Changes arrive as member.linked_account_updated.

Data access: LINKED_ACCOUNTS.

Parameters

Response

200 One page – LinkedAccountPage

Errors

• 400 VALIDATION_FAILED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED
• 404 SPACE_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Newest first, system messages left out. author=self (Since 1.6.0) returns only the bot's own messages and works without the MESSAGE_CONTENT intent (room.view + chat.view still needed); everything else needs MESSAGE_CONTENT. Since 1.7.0 every item carries components (buttons / select menus as stored, null without) – customId only on the bot's own messages, other bots' components come without it. Use it to find your own boards again (e.g. delete duplicates by custom id).

Permissions of the bot role: chat.view.

Data access: MESSAGE_CONTENT.

Parameters

Response

200 One page – HistoryMessagePage

Errors

• 400 VALIDATION_FAILED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT, BOT_INTENT_REQUIRED
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Posts as the bot (encrypted with the space key, mentions, realtime and activity as for people). Optional buttons / select menus.

Permissions of the bot role: chat.view, chat.send.

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body BotMessageRequest

{
  "content": "Build **#128** finished.",
  "components": [
    {
      "type": "row",
      "components": [
        {
          "type": "button",
          "style": "success",
          "label": "Deploy",
          "customId": "deploy:128"
        },
        {
          "type": "button",
          "style": "link",
          "label": "Log",
          "url": "https://ci.example.com/128"
        }
      ]
    }
  ]
}

Response

201 The new message – Message

Errors

• 400 VALIDATION_FAILED, MESSAGE_EMPTY, BOT_COMPONENTS_INVALID, ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Permissions of the bot role: chat.view.

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body BotEditMessageRequest

Response

200 The edited message – Message

Errors

• 400 VALIDATION_FAILED, BOT_COMPONENTS_INVALID, MESSAGE_EMPTY
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT, MESSAGE_NOT_AUTHOR
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND, MESSAGE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Own messages always; messages of others need chat.manage (moderation feed + audit with the bot as actor).

Permissions of the bot role: chat.manage (others’ messages).

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Response

204 Deleted

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND, MESSAGE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Permissions of the bot role: chat.view, chat.react.

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Response

200 Reactions of the message – ReactionList

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND, MESSAGE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Permissions of the bot role: chat.view.

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Response

200 Reactions of the message – ReactionList

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND, MESSAGE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Response

200 Commands – Command[]

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

The list becomes the complete command set of the bot (bulk overwrite). Spaces see the change at once.

Request body ReplaceCommandsRequest

{
  "commands": [
    {
      "name": "ping",
      "description": "Answers with Pong"
    },
    {
      "name": "remind",
      "description": "Set a reminder",
      "options": [
        {
          "name": "text",
          "description": "What about?",
          "type": "string",
          "required": true
        },
        {
          "name": "minutes",
          "description": "In minutes",
          "type": "integer",
          "choices": [
            {
              "name": "5",
              "value": 5
            },
            {
              "name": "60",
              "value": 60
            }
          ]
        }
      ]
    }
  ]
}

Response

200 The new command set – Command[]

Errors

• 400 VALIDATION_FAILED, BOT_COMMANDS_INVALID
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Another answer to an interaction (within 15 minutes). The first follow-up after DEFERRED_MESSAGE ends "<Bot> is thinking …" and becomes the original answer. Note: an empty message answers 502 BOT_INTERACTION_INVALID_RESPONSE and invalid components 502 BOT_COMPONENTS_INVALID on this endpoint (the same check as for interaction responses).

Permissions of the bot role: chat.view, chat.send (public answers).

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body BotFollowupRequest

{
  "content": "Done."
}

Response

201 Id of the new message – FollowupResult

Errors

• 400 VALIDATION_FAILED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION
• 404 BOT_INTERACTION_EXPIRED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 502 BOT_INTERACTION_INVALID_RESPONSE, BOT_COMPONENTS_INVALID
• 503 BOTS_DISABLED

Edits the first answer – for COMPONENT interactions without an own answer the message carrying the component. After DEFERRED_MESSAGE without an answer the edit becomes the answer.

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body BotEditMessageRequest

Response

200 Id of the edited message – EditOriginalResult

Errors

• 400 VALIDATION_FAILED, BOT_COMPONENTS_INVALID
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, MESSAGE_NOT_AUTHOR
• 404 BOT_INTERACTION_EXPIRED, BOT_INTERACTION_NO_ORIGINAL
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

A public answer is deleted like DELETE /bot/messages/{messageId} (realtime message.deleted to the room). An ephemeral answer is removed live from the clients of the person (realtime bot.ephemeral_deleted).

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Response

204 Deleted

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED
• 404 BOT_INTERACTION_EXPIRED, BOT_INTERACTION_NO_ORIGINAL
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

For bots answering through the WebSocket gateway (every interaction arrives deferred) or after DEFERRED_MESSAGE / DEFERRED_UPDATE: opens the form for the person who used the command / component – like a MODAL response. Rules: not for MODAL_SUBMIT interactions (409 BOT_MODAL_NOT_ALLOWED), once per interaction, not after an answer was posted, and only within 60 s of the interaction (409 BOT_MODAL_TOO_LATE). The form replaces "<Bot> is thinking …"; the submission arrives as a new MODAL_SUBMIT interaction (interaction.created on the gateway, or the interaction URL).

Parameters

Request body Modal

{
  "customId": "report",
  "title": "Report a problem",
  "fields": [
    {
      "type": "text",
      "customId": "details",
      "label": "What happened?",
      "style": "paragraph",
      "required": true,
      "minLength": 10,
      "maxLength": 1000
    }
  ]
}

Response

200 The form was sent to the person – OpenModalResult

Errors

• 400 VALIDATION_FAILED, BOT_MODAL_INVALID
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_NO_ACCESS
• 404 BOT_INTERACTION_EXPIRED
• 409 BOT_MODAL_NOT_ALLOWED, BOT_MODAL_TOO_LATE
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

For bots without interaction URL that receive AUTOCOMPLETE interactions as interaction.created over the WebSocket gateway: send the suggestions for command.focused – once, within 3 s of the interaction (afterwards the person already got an empty list: 410 BOT_INTERACTION_EXPIRED; a second answer: 409 BOT_AUTOCOMPLETE_ANSWERED). At most 25 choices are passed on; entries with an invalid name or a value that does not match the option type / limits are dropped (listed in dropped). HTTP bots answer AUTOCOMPLETE_RESULT in the response instead. Since 1.4.0.

Parameters

Request body AutocompleteResultData

{
  "choices": [
    {
      "name": "Berlin",
      "value": "berlin"
    },
    {
      "name": "Bern",
      "value": "bern"
    }
  ]
}

Response

200 The suggestions were passed on to the person – AutocompleteAnswerResult

Errors

• 400 VALIDATION_FAILED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED
• 404 BOT_INTERACTION_EXPIRED
• 409 BOT_AUTOCOMPLETE_ANSWERED
• 410 BOT_INTERACTION_EXPIRED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

A fresh signed URL (valid 10 minutes, absolute, no bot token needed) for a file the person uploaded in a file upload field and submitted to THIS bot in THIS MODAL_SUBMIT interaction – the payload already carries one per file. No interaction token needed; available for 72 hours after the submit, then Coviqo deletes the files (keep your own copy). Every other file, another interaction, a paused or removed installation or a room the bot no longer sees: 404 BOT_FORM_FILE_NOT_FOUND. End-to-end encrypted files are never delivered (409 FILE_E2EE, defensive). Counts against the normal request limits; audited (BOT_FORM_FILES downloaded, file id – no name). Since 1.6.0.

Parameters

Response

200 Signed URL – FileDownload

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, FILE_INFECTED
• 404 BOT_FORM_FILE_NOT_FOUND
• 409 FILE_NOT_READY, FILE_E2EE
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Parameters

Response

200 Subscribed event types – BotSubscriptions

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED
• 404 SPACE_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Replaces the list (event webhook and gateway). Intents and room permissions are still checked for every event.

Parameters

Request body SubscriptionsRequest

{
  "events": [
    "message.created",
    "member.joined"
  ]
}

Response

200 Subscribed event types – BotSubscriptions

Errors

• 400 VALIDATION_FAILED, BOT_EVENTS_INVALID
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED
• 404 SPACE_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Opens (or reuses) the 1:1 conversation with the person who used the interaction and posts there – within the 15 minutes of the interaction token. Link buttons only. replyToId is ignored here.

Parameters

Request body BotMessageRequest

Response

201 Conversation and message – InteractionDmResult

Errors

• 400 VALIDATION_FAILED, BOT_COMPONENTS_INVALID, BOT_DM_COMPONENTS_LINK_ONLY, MESSAGE_EMPTY
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_DM_BLOCKED
• 404 BOT_INTERACTION_EXPIRED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

1:1 conversations with the bot, newest activity first.

Parameters

Response

200 One page – DmConversationPage

Errors

• 400 VALIDATION_FAILED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Always with text (people wrote to the bot directly) – no intent needed.

Parameters

Response

200 One page – MessagePage

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED
• 404 DM_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Only after the person wrote in this conversation – never unsolicited – and never while a block exists. Link buttons only.

Parameters

Request body BotMessageRequest

Response

201 The new message – Message

Errors

• 400 VALIDATION_FAILED, BOT_COMPONENTS_INVALID, BOT_DM_COMPONENTS_LINK_ONLY, MESSAGE_EMPTY
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_DM_NOT_ALLOWED, BOT_DM_BLOCKED, DM_USER_UNAVAILABLE
• 404 DM_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Permissions of the bot role: tasks.view.

Data access: CONTENT_READ.

Parameters

Response

200 Tasks – Task[]

Errors

• 400 VALIDATION_FAILED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT, BOT_INTENT_REQUIRED
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Same rules as for people (tasks.create).

Permissions of the bot role: tasks.create.

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body CreateTaskRequest

{
  "title": "Review release notes",
  "priority": "HIGH",
  "dueDate": "2026-10-09T12:00:00.000Z"
}

Response

201 The new task – Task

Errors

• 400 VALIDATION_FAILED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Permissions of the bot role: tasks.view.

Data access: CONTENT_READ.

Parameters

Response

200 The task – Task

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED, MISSING_PERMISSION
• 404 SPACE_NOT_FOUND, TASK_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Same rules as for people. Tasks the bot did not create need CONTENT_READ (the answer contains the task).

Data access: CONTENT_READ (for objects the bot did not create).

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body UpdateTaskRequest

Response

200 The task – Task

Errors

• 400 VALIDATION_FAILED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED, MISSING_PERMISSION
• 404 SPACE_NOT_FOUND, TASK_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Shortcut for PATCH { status: "DONE" }.

Data access: CONTENT_READ (for objects the bot did not create).

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Response

200 The task – Task

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED, MISSING_PERMISSION
• 404 SPACE_NOT_FOUND, TASK_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Permissions of the bot role: events.view.

Parameters

Response

200 Events – CalendarEvent[]

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION
• 404 SPACE_NOT_FOUND, ROOM_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Same rules as for people (events.create).

Permissions of the bot role: events.create.

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body CreateEventRequest

{
  "title": "Release review",
  "startAt": "2026-10-09T14:00:00.000Z",
  "endAt": "2026-10-09T15:00:00.000Z",
  "timezone": "Europe/Berlin"
}

Response

201 The new event – CalendarEvent

Errors

• 400 VALIDATION_FAILED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Own events, others’ with events.manage. Since 1.6.0 roomId moves the event to another room of the same space (move, not copy – the id stays): the bot needs events.manage in the old AND the new room (own events: events.create in the new room), must see the new room with events.view (else 404 ROOM_NOT_FOUND), the Events module must be on there and the room not archived; neither room end-to-end encrypted. Recurring series move as a whole. Calendar entries of online meetings move their meeting along (the new room needs "Meetings"). RSVPs, tickets and reminders stay; people who cannot see the new room keep their answer but no longer see the event. At most 10 moves per minute per bot and space (on top of the write limit; 429 RATE_LIMITED, scope botevmove). Audited as EVENT_MOVED with the bot as actor; event.updated carries previousRoomId.

Permissions of the bot role: events.manage (others’ events; for moves in the old and the new room).

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body UpdateEventRequest

{
  "roomId": "cm0room0000000000000000002"
}

Response

200 The event – CalendarEvent

Errors

• 400 VALIDATION_FAILED, ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT, E2EE_FEATURE_DISABLED, SPACE_MEETINGS_DISABLED, MEETING_NOT_ORGANIZER
• 404 SPACE_NOT_FOUND, EVENT_NOT_FOUND, ROOM_NOT_FOUND
• 409 EVENT_CANCELED, ROOM_ARCHIVED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Removes the event from all calendars – like DELETE for people this cancels the event (Coviqo never hard-deletes calendar events: RSVPs and tickets stay for the record). Same rules and errors as POST /bot/events/{eventId}/cancel; idempotent.

Permissions of the bot role: events.manage (others’ events).

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Response

204 Canceled

Errors

• 400 ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT, MEETING_NOT_ORGANIZER
• 404 SPACE_NOT_FOUND, EVENT_NOT_FOUND
• 409 ROOM_ARCHIVED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Same rules as for people: own events (created by the bot), others’ with events.manage. A recurring event is canceled as a whole series. The entry disappears from all calendars (external calendar copies are removed); the calendar entry of an online meeting also cancels the meeting (only meeting organizers / moderators – 403 MEETING_NOT_ORGANIZER). Idempotent – an already canceled event is returned unchanged. Sends event.canceled.

Permissions of the bot role: events.manage (others’ events).

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Response

200 The canceled event (canceledAt set) – CalendarEvent

Errors

• 400 ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT, MEETING_NOT_ORGANIZER
• 404 SPACE_NOT_FOUND, EVENT_NOT_FOUND
• 409 ROOM_ARCHIVED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Who accepted, declined or answered maybe – the same list people with events.view see on the event, never more: the bot must see the room (or hold events.view in the space for space-wide events), entries of online meetings only when the bot may see the meeting, no RSVPs from end-to-end encrypted rooms. Users with their space identity, no e-mail. Coviqo tracks answers, not actual attendance. Changes arrive as event.rsvp_updated.

Permissions of the bot role: events.view.

Data access: EVENT_RSVPS.

Parameters

Response

200 One page – EventRsvpPage

Errors

• 400 VALIDATION_FAILED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED, MISSING_PERMISSION
• 404 SPACE_NOT_FOUND, EVENT_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Since 1.4.0. Going / maybe / declined for a member – the answer shows "via <bot>" until the person answers themselves. The member is named by (1) interaction proof – interactionId plus the header X-Coviqo-Interaction-Token of an interaction of this bot in this space by exactly this person, no extra data access – or (2) the privileged data access EVENT_RSVP_ON_BEHALF (any active member). The bot must see the event (as for RSVP lists, no end-to-end encrypted rooms); the member must be an active member (no guests, bots, suspended accounts) who sees the event – then every rule of a personal answer applies (canceled events, capacity, tickets, webinar registration). Sends event.rsvp_updated. Extra limit of 10 per minute and space (scope botonbehalf); audited as BOT_MEMBER_ACTION event_rsvp.

Permissions of the bot role: events.view.

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body PutEventRsvpRequest

{
  "status": "GOING"
}

Response

200 The answer – EventRsvpResult

Errors

• 400 VALIDATION_FAILED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED, MISSING_PERMISSION, BOT_ON_BEHALF_INVALID, BOT_INTERACTION_MISMATCH
• 404 SPACE_NOT_FOUND, EVENT_NOT_FOUND, BOT_INTERACTION_EXPIRED
• 409 E2EE_FEATURE_DISABLED, EVENT_CANCELED, EVENT_FULL, EVENT_TICKET_REQUIRED, WEBINAR_USE_REGISTRATION
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Since 1.5.0. Removes the person’s answer entirely – back to “no answer” (meeting invitees stay invited). Same gate as PUT: (1) interaction proof – interactionId (query) plus the header X-Coviqo-Interaction-Token of an interaction of this bot in this space by exactly this person – or (2) EVENT_RSVP_ON_BEHALF: then the bot may remove the person’s answer whatever its origin (given by the person, this bot or another bot) – the website is the source of truth for the person’s choice. Answers tied to a ticket (paid or free, VALID / PENDING) are refused with 409 EVENT_RSVP_TICKET_HELD { ticketStatus, paid } – bots never cancel or refund tickets. Canceled events 409 EVENT_CANCELED, webinars with registration 409 WEBINAR_USE_REGISTRATION. Idempotent: without an answer nothing happens (204). Sends event.rsvp_updated with status: null, source: "bot". Shares the extra limit of 10 per minute and space with PUT (scope botonbehalf); audited as BOT_MEMBER_ACTION event_rsvp_removed (with the previous status and origin).

Permissions of the bot role: events.view.

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Response

204 Removed (or there was no answer)

Errors

• 400 VALIDATION_FAILED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED, MISSING_PERMISSION, BOT_ON_BEHALF_INVALID, BOT_INTERACTION_MISMATCH
• 404 SPACE_NOT_FOUND, EVENT_NOT_FOUND, BOT_INTERACTION_EXPIRED
• 409 E2EE_FEATURE_DISABLED, EVENT_CANCELED, EVENT_RSVP_TICKET_HELD, WEBINAR_USE_REGISTRATION
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Permissions of the bot role: files.view.

Data access: CONTENT_READ.

Parameters

Response

200 Folders and files – FileList

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT, BOT_INTENT_REQUIRED
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Step 1 of 3: announce the file. Step 2: PUT the raw bytes to uploadUrl with headers (no bot token). Step 3: POST /bot/files/{fileId}/complete – the malware scan starts. Upload size and storage quota as in the web app.

Permissions of the bot role: files.upload.

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body UploadFileRequest

{
  "name": "report.pdf",
  "mimeType": "application/pdf",
  "size": 48213
}

Response

201 Upload URL – FileUpload

Errors

• 400 VALIDATION_FAILED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 402 PLAN_LIMIT_STORAGE
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED, ROOM_ARCHIVED
• 413 FILE_TOO_LARGE
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Parameters

Response

200 The file (status SCANNING or READY) – File

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED
• 404 SPACE_NOT_FOUND, FILE_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Permissions of the bot role: files.view.

Data access: CONTENT_READ.

Parameters

Response

200 The file – File

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED, MISSING_PERMISSION
• 404 SPACE_NOT_FOUND, FILE_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Short-lived signed URL. Files in the malware scan (409 FILE_NOT_READY) or infected (403 FILE_INFECTED) cannot be downloaded.

Permissions of the bot role: files.view.

Data access: CONTENT_READ.

Parameters

Response

200 Signed URL – FileDownload

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED, MISSING_PERMISSION, FILE_INFECTED
• 404 SPACE_NOT_FOUND, FILE_NOT_FOUND
• 409 FILE_NOT_READY
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Permissions of the bot role: notes.view.

Data access: CONTENT_READ.

Parameters

Response

200 Notes (content: null) – Note[]

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT, BOT_INTENT_REQUIRED
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Same rules as for people (notes.edit).

Permissions of the bot role: notes.edit.

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body CreateNoteRequest

{
  "title": "Standup 2026-10-02",
  "content": "# Done\n- Release notes\n# Next\n- Review"
}

Response

201 The new note – Note

Errors

• 400 VALIDATION_FAILED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Permissions of the bot role: notes.view.

Data access: CONTENT_READ.

Parameters

Response

200 The note – Note

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED, MISSING_PERMISSION
• 404 SPACE_NOT_FOUND, NOTE_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Same rules as for people. Notes the bot did not create need CONTENT_READ. People editing live receive the new text as a change.

Data access: CONTENT_READ (for objects the bot did not create).

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body UpdateNoteRequest

Response

200 The note – Note

Errors

• 400 VALIDATION_FAILED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED, MISSING_PERMISSION
• 404 SPACE_NOT_FOUND, NOTE_NOT_FOUND
• 409 NOTE_VERSION_CONFLICT
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Permissions of the bot role: moderate.timeout.

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body TimeoutRequest

{
  "minutes": 10,
  "reason": "Spam"
}

Response

200 The member – BotMember

Errors

• 400 VALIDATION_FAILED, MODERATION_SELF
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MODERATION_HIERARCHY
• 404 SPACE_NOT_FOUND, MEMBER_NOT_FOUND
• 409 BOT_MEMBER_MANAGED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Permissions of the bot role: moderate.timeout.

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Response

200 The member – BotMember

Errors

• 400 MODERATION_SELF
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MODERATION_HIERARCHY
• 404 SPACE_NOT_FOUND, MEMBER_NOT_FOUND
• 409 BOT_MEMBER_MANAGED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Permissions of the bot role: moderate.kick.

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body KickRequest (optional)

Response

204 Kicked

Errors

• 400 VALIDATION_FAILED, MODERATION_SELF
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MODERATION_HIERARCHY
• 404 SPACE_NOT_FOUND, MEMBER_NOT_FOUND
• 409 BOT_MEMBER_MANAGED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Permissions of the bot role: moderate.ban.

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body BanRequest (optional)

Response

204 Banned

Errors

• 400 VALIDATION_FAILED, MODERATION_SELF
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MODERATION_HIERARCHY
• 404 SPACE_NOT_FOUND
• 409 BOT_MEMBER_MANAGED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Permissions of the bot role: moderate.ban.

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Response

204 Ban lifted

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION
• 404 SPACE_NOT_FOUND, BAN_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Bans that have not expired, ordered by user id. Expired bans are lifted every minute (member.unbanned with expired: true).

Permissions of the bot role: moderate.ban.

Parameters

Response

200 One page – BanPage

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION
• 404 SPACE_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Warnings, kicks, bans, unbans and timeouts, newest first.

Permissions of the bot role: moderate.kick | moderate.ban | moderate.timeout | moderate.reports.

Parameters

Response

200 One page – ModerationActionPage

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION
• 404 SPACE_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Returns LiveKit credentials for the bot identity. The bot is a visible participant with the BOT badge; while it listens everybody in the room sees "Bot is listening". Never in meetings, direct messages or lobby rounds; rooms with external guests only with the room setting "Bots may join despite external guests".

Permissions of the bot role: room.join, voice.speak (publish).

Data access: VOICE_LISTEN.

Plan: voiceBots.

Parameters

Request body VoiceJoinRequest

{
  "listen": true,
  "publish": false
}

Response

200 LiveKit URL and token – VoiceJoinResult

Errors

• 400 VALIDATION_FAILED, ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 402 PLAN_LIMIT_VOICE_BOTS
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT, BOT_INTENT_REQUIRED, BOT_VOICE_NOT_ALLOWED, BOT_VOICE_GUESTS, BOT_VOICE_CANNOT_SPEAK
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED, ROOM_ARCHIVED, ROOM_FULL
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Parameters

Response

204 Left

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED
• 404 ROOM_NOT_FOUND
• 409 VOICE_NOT_CONNECTED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Parameters

Response

200 Participants the bot may see and its own session – VoiceRoom

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Meetings of the rooms a space admin released to the bot (transcript rooms), newest first.

Data access: TRANSCRIPTS.

Plan: botTranscriptAccess.

Parameters

Response

200 One page – MeetingList

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 402 PLAN_LIMIT_BOT_TRANSCRIPTS
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED, BOT_TRANSCRIPT_POLICY, BOT_TRANSCRIPT_ROOM_NOT_APPROVED, MISSING_PERMISSION
• 404 SPACE_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Every read is audited (BOT_TRANSCRIPT_ACCESSED). The summary is AI-generated (ai: true).

Data access: TRANSCRIPTS.

Plan: botTranscriptAccess.

Parameters

Response

200 Transcript – MeetingTranscript

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 402 PLAN_LIMIT_BOT_TRANSCRIPTS
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED, BOT_TRANSCRIPT_POLICY, BOT_TRANSCRIPT_ROOM_NOT_APPROVED, MISSING_PERMISSION
• 404 SPACE_NOT_FOUND, MEETING_NOT_FOUND
• 409 MEETING_STILL_LIVE
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Newest change first (updatedAt). tickets.view / handle / manage: every ticket of the room; tickets.create only: the tickets the bot opened itself. Sync: keep the newest updatedAt and pass it as updatedSince.

Permissions of the bot role: tickets.view | tickets.handle | tickets.manage | tickets.create (own tickets).

Data access: TICKETS_READ.

Parameters

Response

200 One page (body: null) – TicketPage

Errors

• 400 VALIDATION_FAILED, ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT, BOT_INTENT_REQUIRED, TICKETS_MEMBERS_ONLY
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

By default the bot becomes the creator (notifications to the team, SLA, history as for people); the answer is the bot’s own ticket – TICKETS_READ is not needed for it. On behalf of a member the member becomes the creator (reporter) and the ticket shows "created by <bot> on behalf of <member>": (1) interaction proof – interactionId plus the header X-Coviqo-Interaction-Token of an interaction of this bot in this space (the room may differ), no extra data access; (2) onBehalfOfUserId – any active member of the space, only with the privileged data access TICKETS_CREATE_ON_BEHALF (on top of TICKETS_WRITE), e.g. for ticket forms on an external website. The member must be able to open the ticket as a person (sees the room, tickets.create, not timed out) – never guests, bots or people who left; both given must name the same person. On-behalf tickets count against an extra limit of 10 per minute and space (scope botticket) and are audited with the member. Attachments: upload them first (POST /bot/rooms/{roomId}/tickets/attachments) and pass the ids in attachmentIds.

Permissions of the bot role: tickets.create, tickets.handle (priority).

Data access: TICKETS_WRITE.

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body CreateTicketRequest

{
  "title": "Server not reachable",
  "body": "Monitoring reports `api-2` down since 09:12.",
  "categoryId": null,
  "fields": {}
}

Response

201 The new ticket – TicketDetail

Errors

• 400 VALIDATION_FAILED, TICKET_TITLE_INVALID, TICKET_CATEGORY_NOT_FOUND, TICKET_FIELDS_INVALID, TICKET_ATTACHMENT_INVALID, ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT, BOT_INTENT_REQUIRED, TICKETS_MEMBERS_ONLY, TICKET_REPORTER_INVALID, TICKET_REPORTER_NO_ACCESS, TICKET_INTERACTION_MISMATCH
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND, BOT_INTERACTION_EXPIRED
• 409 E2EE_FEATURE_DISABLED, TICKETS_E2EE_UNSUPPORTED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Step 1 of 3 – the same pipeline as people: upload size and storage quota of the plan, blocked file types, malware scan, encryption at rest. Step 2: PUT the raw bytes to uploadUrl with headers (no bot token). Step 3: POST /bot/files/{fileId}/complete. Then pass the file id in attachmentIds of a new ticket or a reply. Ticket files are private (only who may see the ticket); not in end-to-end encrypted rooms.

Permissions of the bot role: tickets.create | tickets.handle.

Data access: TICKETS_WRITE.

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body UploadTicketAttachmentRequest

{
  "name": "screenshot.png",
  "mimeType": "image/png",
  "size": 48213
}

Response

201 Upload URL – FileUpload

Errors

• 400 VALIDATION_FAILED, ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 402 PLAN_LIMIT_STORAGE
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT, BOT_INTENT_REQUIRED, TICKETS_MEMBERS_ONLY
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED, ROOM_ARCHIVED, TICKETS_E2EE_UNSUPPORTED
• 413 FILE_TOO_LARGE
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Permissions of the bot role: tickets.view | tickets.handle | tickets.manage | tickets.create.

Data access: TICKETS_READ.

Parameters

Response

200 Categories by position – TicketCategory[]

Errors

• 400 ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT, BOT_INTENT_REQUIRED, TICKETS_MEMBERS_ONLY
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Permissions of the bot role: tickets.view | tickets.handle | tickets.manage | tickets.create.

Data access: TICKETS_READ.

Parameters

Response

200 Fields by position – TicketField[]

Errors

• 400 ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT, BOT_INTENT_REQUIRED, TICKETS_MEMBERS_ONLY
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Permissions of the bot role: tickets.view | tickets.handle | tickets.manage.

Data access: TICKETS_READ.

Parameters

Response

200 Canned responses by position – TicketCannedResponse[]

Errors

• 400 ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT, BOT_INTENT_REQUIRED, TICKETS_MEMBERS_ONLY
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Permissions of the bot role: tickets.handle | tickets.manage.

Data access: TICKETS_READ.

Parameters

Response

200 Statistics of the room – TicketStats

Errors

• 400 ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT, BOT_INTENT_REQUIRED, TICKETS_MEMBERS_ONLY
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Stars and comments of the creators, newest first.

Permissions of the bot role: tickets.handle | tickets.manage.

Data access: TICKETS_READ.

Parameters

Response

200 One page – TicketRatingPage

Errors

• 400 ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, MISSING_PERMISSION, MEMBER_TIMED_OUT, BOT_INTENT_REQUIRED, TICKETS_MEMBERS_ONLY
• 404 ROOM_NOT_FOUND, SPACE_NOT_FOUND
• 409 E2EE_FEATURE_DISABLED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Public replies; internal notes only with tickets.handle. Tickets the bot may not see answer 404 (no existence leak).

Permissions of the bot role: tickets.view | tickets.handle | tickets.manage | tickets.create (own tickets).

Data access: TICKETS_READ.

Parameters

Response

200 The ticket – TicketDetail

Errors

• 400 ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED
• 404 SPACE_NOT_FOUND, TICKET_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Same workflow as for people: tickets.handle for everything; the bot’s own ticket may be closed (and reopened within the reopen window) without it. Tickets the bot did not open need TICKETS_READ too (the answer contains the ticket). body (description, since 1.6.0): tickets.handle, or the bot’s own ticket – opened as itself or on behalf of the creator (createdByBotId = this bot); same limits as on create, closed tickets only with tickets.handle (409 TICKET_CLOSED). The permission is checked before anything is written. The history gets a description change without the text, people with access get the realtime update, newly mentioned people a mention; ticket.updated carries { field: "description" }.

Permissions of the bot role: tickets.handle.

Data access: TICKETS_WRITE (+ TICKETS_READ for tickets the bot did not open).

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body UpdateTicketRequest

{
  "status": "IN_PROGRESS",
  "priority": "HIGH",
  "assigneeId": "cm1user0000000000000000"
}

Response

200 The ticket – TicketDetail

Errors

• 400 VALIDATION_FAILED, TICKET_TITLE_INVALID, TICKET_CATEGORY_NOT_FOUND, TICKET_FIELDS_INVALID, TICKET_ASSIGNEE_INVALID, ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED, MISSING_PERMISSION, MEMBER_TIMED_OUT
• 404 SPACE_NOT_FOUND, TICKET_NOT_FOUND
• 409 TICKET_TRANSITION_INVALID, TICKET_REOPEN_EXPIRED, TICKET_CLOSED, TICKETS_E2EE_UNSUPPORTED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Every attachment the bot may see: files of the ticket description (messageId null) and of the replies; files of internal notes only with tickets.handle. Deleted files are left out; files still in the malware scan or blocked as infected are listed with their status but cannot be downloaded. Tickets the bot may not see answer 404 (no existence leak). Since 1.4.0.

Permissions of the bot role: tickets.view | tickets.handle | tickets.manage | tickets.create (own tickets).

Data access: TICKETS_READ.

Parameters

Response

200 Attachments, oldest first – TicketAttachmentList

Errors

• 400 ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED
• 404 SPACE_NOT_FOUND, TICKET_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Short-lived signed URL (like GET /bot/files/{fileId}/download) – fetch it without the bot token; the bytes are streamed (HTTP Range supported), the size is bounded by the upload limit of the plan. The file must be an attachment of this ticket that the bot may see (internal notes: tickets.handle) – otherwise 404 TICKET_ATTACHMENT_NOT_FOUND. Files in the malware scan (409 FILE_NOT_READY) or infected (403 FILE_INFECTED) cannot be downloaded; end-to-end encrypted files are refused (409 FILE_E2EE – the server cannot decrypt them). The download policy of the organisation applies. Counts against the normal request limits; audited (BOT_TICKET_ACTION attachment_downloaded, no file name). Since 1.4.0; since 1.6.0 url is always absolute (built from the public base URL of the instance).

Permissions of the bot role: tickets.view | tickets.handle | tickets.manage | tickets.create (own tickets).

Data access: TICKETS_READ.

Parameters

Response

200 Signed URL – FileDownload

Errors

• 400 ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED, FILE_INFECTED
• 404 SPACE_NOT_FOUND, TICKET_NOT_FOUND, TICKET_ATTACHMENT_NOT_FOUND
• 409 FILE_NOT_READY, FILE_E2EE
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

For tickets the bot opened as itself (creatorId = the bot), e.g. before it knew who the person was: the member becomes the reporter and the ticket is then exactly a ticket opened on behalf (createdByBotId = this bot, shown as "created by <bot> on behalf of <member>"). Same gates as POST /bot/rooms/{roomId}/tickets on behalf: interaction proof (interactionId + header X-Coviqo-Interaction-Token, no extra data access) or onBehalfOfUserId with the privileged data access TICKETS_CREATE_ON_BEHALF – neither → 400 BOT_ON_BEHALF_REQUIRED. The member must be able to open the ticket as a person (sees the room, tickets.create, not timed out) – never guests, bots or people who left. Tickets already handed over by this bot → 409 TICKET_REPORTER_ALREADY_SET (details.sameReporter true when the same member was named – safe to treat a retry as done); tickets of other reporters → 409 TICKET_REPORTER_NOT_BOT. Write limits plus the on-behalf ticket limit (10 per minute and space, scope botticket – shared with tickets opened on behalf). History reporter change, realtime update to the member, ticket.updated; audited (BOT_TICKET_ACTION reporter_reassigned). The answer contains the ticket once – afterwards the bot sees it only with tickets.view / handle / manage. Since 1.6.0.

Permissions of the bot role: tickets.create (own tickets).

Data access: TICKETS_WRITE (+ TICKETS_READ for tickets the bot did not open).

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body ReassignTicketReporterRequest

{
  "onBehalfOfUserId": "cm1user0000000000000000"
}

Response

200 The ticket (now with the member as creator) – TicketDetail

Errors

• 400 VALIDATION_FAILED, BOT_ON_BEHALF_REQUIRED, ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED, TICKET_REPORTER_INVALID, TICKET_REPORTER_NO_ACCESS, TICKET_INTERACTION_MISMATCH, MEMBER_TIMED_OUT
• 404 SPACE_NOT_FOUND, TICKET_NOT_FOUND, BOT_INTERACTION_EXPIRED
• 409 TICKET_REPORTER_ALREADY_SET, TICKET_REPORTER_NOT_BOT, TICKETS_E2EE_UNSUPPORTED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

PUBLIC: reply the creator sees (tickets.handle, or the bot’s own ticket) – the first team reply sets the first response time. INTERNAL: note only the team sees (tickets.handle). Closed tickets take internal notes only. Attachments: attachmentIds of ticket uploads (POST /bot/rooms/{roomId}/tickets/attachments). Messages (here, in GET /bot/tickets/{ticketId} and in ticket.message.created) carry author { id, displayName, isBot } – the display name inside the space (since 1.6.0). On behalf of a member (since 1.7.0) the reply becomes the member’s own reply, marked “via <bot>” (viaBotId): (1) interaction proof – interactionId plus the header X-Coviqo-Interaction-Token of an interaction of this bot in this space by exactly this person, no extra data access; (2) onBehalfOfUserId – only with the privileged data access TICKETS_REPLY_ON_BEHALF (on top of TICKETS_WRITE), e.g. to relay e-mail or chat replies. The member must be the reporter or a participant of the ticket, an active member (no guests, bots, people who left) who still sees the room and is not timed out (403 TICKET_REPLIER_INVALID { reason }); public replies only. Everything else runs as the member (status rules – a reply can reopen a resolved ticket within the reopen window –, notifications, mentions). The bot must see the ticket (TICKETS_READ unless it is its own ticket). Replies on behalf count against an extra limit of 30 per minute and space (scope botticketreply) and are audited with the member (BOT_TICKET_ACTION replied_on_behalf).

Permissions of the bot role: tickets.handle (internal notes, others’ tickets).

Data access: TICKETS_WRITE (+ TICKETS_READ for tickets the bot did not open).

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body CreateTicketMessageRequest

{
  "body": "Thanks – we are on it.",
  "kind": "PUBLIC"
}

Response

201 The new message – TicketMessage

Errors

• 400 VALIDATION_FAILED, TICKET_ATTACHMENT_INVALID, ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED, MISSING_PERMISSION, MEMBER_TIMED_OUT, TICKET_REPLIER_INVALID, TICKET_INTERACTION_MISMATCH
• 404 SPACE_NOT_FOUND, TICKET_NOT_FOUND, BOT_INTERACTION_EXPIRED
• 409 TICKET_CLOSED, TICKET_REOPEN_EXPIRED, TICKETS_E2EE_UNSUPPORTED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Since 1.7.0. Messages the bot wrote itself or posted on behalf of a member (viaBotId = this bot) – others: 403 TICKET_MESSAGE_NOT_AUTHOR. Same limits as a new message; public replies of closed tickets only with tickets.handle (409 TICKET_CLOSED). Sets editedAt (no history entry), sends ticket.message.updated, notifies people mentioned for the first time. Same text: nothing happens. Audited (BOT_TICKET_ACTION message_edited, no content).

Permissions of the bot role: the bot sees the ticket.

Data access: TICKETS_WRITE (+ TICKETS_READ for tickets the bot did not open).

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body UpdateTicketMessageRequest

{
  "body": "Thanks – fixed in 2.4.1."
}

Response

200 The message after the edit – TicketMessage

Errors

• 400 VALIDATION_FAILED, ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED, TICKET_MESSAGE_NOT_AUTHOR, MEMBER_TIMED_OUT
• 404 SPACE_NOT_FOUND, TICKET_NOT_FOUND, TICKET_MESSAGE_NOT_FOUND
• 409 TICKET_CLOSED, TICKETS_E2EE_UNSUPPORTED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Since 1.7.0. Messages the bot wrote itself or posted on behalf of a member; with tickets.manage also messages of others (moderation). Public replies of closed tickets only with tickets.handle. Attachments of the message are deleted with it. Sends ticket.message.deleted (ids + kind). Audited (BOT_TICKET_ACTION message_deleted, no content).

Permissions of the bot role: tickets.manage (messages of others).

Data access: TICKETS_WRITE (+ TICKETS_READ for tickets the bot did not open).

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Response

204 Deleted

Errors

• 400 ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED, MISSING_PERMISSION, MEMBER_TIMED_OUT
• 404 SPACE_NOT_FOUND, TICKET_NOT_FOUND, TICKET_MESSAGE_NOT_FOUND
• 409 TICKET_CLOSED, TICKETS_E2EE_UNSUPPORTED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

A member who can see the room (no guests, no bots). Idempotent.

Permissions of the bot role: tickets.handle (others’ tickets).

Data access: TICKETS_WRITE (+ TICKETS_READ for tickets the bot did not open).

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Response

200 The ticket – TicketDetail

Errors

• 400 TICKET_PARTICIPANT_INVALID, ROOM_MODULE_DISABLED
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED, MISSING_PERMISSION, MEMBER_TIMED_OUT
• 404 SPACE_NOT_FOUND, TICKET_NOT_FOUND
• 409 TICKET_PARTICIPANTS_LIMIT, TICKETS_E2EE_UNSUPPORTED
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Space teams plus the organisation teams usable in the space (read-only for bots), ordered by position.

Data access: MEMBERS.

Parameters

Response

200 The teams – TeamList

Errors

• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED
• 404 SPACE_NOT_FOUND
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED

Since 1.4.0. Name, join mode (OPEN / APPLICATION / INVITE_ONLY / PASSWORD since 1.6.0) and the application question of a space team – with the rules for people (teams.manage of the bot role; bots are never team leads). The team tree, IdP group, position and room grants stay with people. Switching to OPEN is refused with 409 TEAM_GRANTS_ABOVE_BOT { permissions } while the team or a parent team grants room / category permissions the bot does not hold itself. Audited as TEAM_UPDATED with the bot. Since 1.6.0: joinPolicy PASSWORD with password (write-only, stored hashed, never returned – the team only shows hasJoinPassword). Switching to PASSWORD needs a password (400 TEAM_JOIN_PASSWORD_REQUIRED); password alone changes it. Setting a password gets the same 409 TEAM_GRANTS_ABOVE_BOT check as OPEN (the bot knows the password, so it controls who joins) – unless the team is OPEN already. The audit names the change joinPassword, never the password.

Permissions of the bot role: teams.manage.

Data access: TEAMS_MANAGE.

Counts against the write limits (30 / min per bot and space, 120 / min per space).

Parameters

Request body UpdateTeamRequest

{
  "joinPolicy": "APPLICATION",
  "applicationPrompt": "Which games do you play?"
}

Response

200 The changed team – Team

Errors

• 400 VALIDATION_FAILED, TEAM_SPACE_ONLY, TEAM_APPLICATION_SPACE_ONLY, TEAM_JOIN_PASSWORD_REQUIRED, TEAM_JOIN_PASSWORD_NOT_APPLICABLE
• 401 BOT_AUTH_REQUIRED, BOT_TOKEN_INVALID
• 403 BOT_DISABLED, BOT_PAUSED, BOT_INTENT_REQUIRED, FORBIDDEN, MISSING_PERMISSION
• 404 SPACE_NOT_FOUND, TEAM_NOT_FOUND
• 409 TEAM_GRANTS_ABOVE_BOT
• 429 RATE_LIMITED, TOO_MANY_REQUESTS
• 503 BOTS_DISABLED