The response carries a publishable key and a ready-to-paste snippet:
GET returns {"configured": false} before the channel exists, rather than a
404 — on this API a 404 means “that tenant is not yours”, and reusing it for
“not set up yet” would make the two indistinguishable.
allowed_origins is required
The widget key is publishable — it ships to browsers and is visible in page
source. That is fine, and by design: it can only start a conversation. The
origin allowlist is what stops it being lifted off one merchant’s page and
embedded somewhere else on their credit.An empty list is rejected at provisioning time rather than silently meaning
“any site”.
www. if used.
Requests from anywhere else get a 403 with a named reason.
Nothing answers until the assistant is live
A configured widget on a merchant with no active assistant returns 503 with
reason: "no_agent". That is the activate call, not a
misconfiguration.
Other channels
WhatsApp, Instagram and phone exist on the platform but are not provisionable
through this API yet — WhatsApp requires a browser step Meta mandates, and the
others need number procurement. Talk to us if a merchant needs one. 
