Reference

API reference

InstaChatbot exposes a JSON REST API. Base URL: https://api.instachatbot.online.

Authentication

Every request must include the shared internal secret and the authenticated user's id. The Next.js dashboard proxies these automatically — for direct integrations, sign your request with these two headers:

http

x-internal-secret: <API_INTERNAL_SECRET>
x-user-id: <NextAuth session.user.id>

Treat x-internal-secret like a database password. Never expose it to the browser; rotate immediately if compromised.

Endpoints

Method	Path	Description
GET	/api/shops	List all shops on your account.
POST	/api/shops	Create a new shop.
GET	/api/shops/:id	Get one shop.
PUT	/api/shops/:id	Update a shop.
DELETE	/api/shops/:id	Delete a shop (cascades to rules + logs).
GET	/api/shops/:id/rules	List all rules for a shop, ordered.
POST	/api/shops/:id/rules	Create a rule. Enforces plan caps.
PUT	/api/shops/:id/rules/reorder	Bulk update rule ordering.
PUT	/api/rules/:id	Update an individual rule.
DELETE	/api/rules/:id	Delete an individual rule.
GET	/api/shops/:id/messages	Paginated message log.
GET	/api/shops/:id/analytics	Today/week/month counters + top keywords.
POST	/api/billing/create-subscription	Create a Razorpay subscription.
POST	/api/billing/webhook	Razorpay webhook receiver (signed).

Create a rule (example)

bash

curl -X POST 'https://api.instachatbot.online/api/shops/shop_abc/rules' \
  -H 'x-internal-secret: $API_INTERNAL_SECRET' \
  -H 'x-user-id: usr_01HZX…' \
  -H 'Content-Type: application/json' \
  -d '{
    "keyword": "menu",
    "matchType": "contains",
    "replyType": "text",
    "replyText": "Here is our menu…",
    "isActive": true
  }'

json

{
  "rule": {
    "id": "rul_01HZX…",
    "shopId": "shop_abc",
    "keyword": "menu",
    "matchType": "contains",
    "replyType": "text",
    "replyText": "Here is our menu…",
    "isActive": true,
    "order": 4,
    "createdAt": "2026-05-12T18:00:00.000Z"
  }
}

Errors

InstaChatbot returns standard HTTP status codes with a JSON body:

json

{
  "error": "Plan limit reached: 5 rules allowed on the 'free' plan."
}

400 — Validation failed (Zod-flattened details included)
401 — Missing or invalid internal secret / user id
402 — Plan cap exceeded (rules or messages)
404 — Resource not found or not owned by you
500 — Unexpected server error