iDevMeet

FOR DEVELOPERS

Room Bot API

Add a bot to one specific room. A bot gets its own token, scoped to that room alone — it can post and read messages there, and nothing else. It can never act as a real user account, read other rooms, or touch anything a moderator can.

1. Get a token

Only the room’s owner or a moderator can create a bot token, from inside that session (browser cookie or x-auth-token header — same auth every other endpoint on this site uses).

→

POST /api/rooms/{roomId}/bots with a JSON body of { name }.

curl -X POST https://idevmeet.com/api/rooms/<roomId>/bots \
  -H "Content-Type: application/json" \
  -H "Cookie: idevmeet-session=<your session cookie>" \
  -d '{ "name": "Arena Bot" }'

# -> { "ok": true, "bot": { "id": "...", "name": "Arena Bot", "token": "..." } }
The token is only ever shown once, in this response. Save it now — only its hash is kept from this point on, and there is no way to recover it later. If it’s ever lost or leaked, revoke it (below) and create a new one.

List a room’s current bots with GET /api/rooms/{roomId}/bots, or revoke one with DELETE /api/rooms/{roomId}/bots/{botId}— both need the same owner-or-moderator session. Revoking stops the token working immediately; it does not delete anything the bot already posted.

2. Send a message

Everything after this point uses the bot’s own token, not a user session:

curl -X POST https://idevmeet.com/api/bots/<botId>/messages \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{ "text": "Hello from Arena Bot!" }'

# -> { "ok": true, "message": { "id": "...", "name": "Arena Bot", "text": "...", "ts": 1234567890, "bot": true } }

Messages are capped at 4,000 characters and pass through the same profanity filter as everyone else’s messages. A bot is limited to 20 messages per minute — plenty for replying to activity, not enough to flood the room.

3. Read new messages

There is no push/webhook delivery yet — poll for what’s new, the same way the website and phone app themselves keep a room’s messages live:

curl "https://idevmeet.com/api/bots/<botId>/inbox?sinceTs=<lastTs>" \
  -H "Authorization: Bearer <token>"

# -> {
#   "ok": true,
#   "messages": [
#     { "id": "...", "name": "Ben", "uid": "...", "text": "hey @Arena Bot are you there?", "ts": 1234567891, "bot": false, "mentionsBot": true }
#   ],
#   "latestTs": 1234567891
# }

Start with sinceTs=0, then pass back the latestTs from each response as the next call’s sinceTs, so you only ever get messages you haven’t seen. The bot’s own messages never come back in its own inbox.

mentionsBot is true when a human message contains the bot’s name (with or without an @) as a whole word — useful for replying only when spoken to, instead of reacting to every line in the room.

Reference

Method & pathWhat it does
POST /api/rooms/{roomId}/botsCreate a bot for this room (owner/moderator session)
GET /api/rooms/{roomId}/botsList this room’s bots (owner/moderator session)
DELETE /api/rooms/{roomId}/bots/{botId}Revoke a bot’s token (owner/moderator session)
POST /api/bots/{botId}/messagesPost a message as the bot (bearer token)
GET /api/bots/{botId}/inbox?sinceTs=Read messages posted after sinceTs (bearer token)

Security

A bot token is a completely separate credential from any user account — it is never a session, password, or login of any kind. It can only ever do two things: post a message into the one room it was created for, and read that room’s messages. It cannot delete or edit anything, ban or moderate anyone, join a game, or act in any other room. If a token leaks, the damage is limited to that one room, and revoking it takes effect immediately.