Skip to main content
POST
Call this from the visitor’s browser. It takes the embed’s public widget key in X-ARUKZ-Widget-Key, and the browser’s Origin must be allowed by both the deployment’s allowed_origins and the platform-wide widget allowlist. See Website widget. You must also send the thread’s X-ARUKZ-Visitor-Token. Every check (key, origin, visitor token, one question at a time, input validation) runs before the stream opens, so a refusal is an ordinary HTTP error with a JSON body, never an event on a 200 stream. A missing token, another thread’s token and an unknown conversation all return the same 404; a question sent while another answer is being generated returns 409. The request body is the same as Send a widget message. Because the request is a POST with custom headers, read the stream with fetch rather than EventSource. Retrying with the same idempotency_key after a dropped connection replays the settled answer as a stream without calling the model again. A successful response is 200 with Content-Type: text/event-stream. Each event has an id (a sequence number that increases by one), an event name and a single-line JSON data payload. message.created and answer.started always come first; answer.delta, answer.sources and answer.replaced follow as the answer is written; exactly one terminal event comes last: Exactly one terminal event ends every stream. An abstention ends with answer.completed and abstained: true; it is a successful answer, not an error. See Streaming and How answers work. abstention_reason on this surface is coarser than the authenticated API’s, and has only two values: A widget visitor is anonymous — anyone who can load the page the widget is embedded in. Telling them apart which kind of gap they hit would let a stranger map a private knowledge base one question at a time, without ever being shown a passage. unavailable stays separable because it says nothing about the corpus and “try again” is different advice. It may also be null.
string
required
The conversation’s ID (UUID).
string
required
The deployment’s public widget key, arukz_wk_….
string
required
The visitor token returned when this thread was started.
string
required
Set by the browser. It must exactly match an origin allowed for this deployment. When you call from outside a browser, set it yourself.
string
required
The question. Up to 16,000 characters, and not empty after surrounding whitespace is trimmed.
string
Your own key for this question, up to 128 characters of A-Z, a-z, 0-9, _, ., : and -.
object
Your own string labels for the question. At most 20 entries; keys up to 64 characters, values up to 512.

Response

A text/event-stream body of the events above. Error responses before the stream opens are JSON, in the usual {"code": ..., "message": ...} shape. See Errors.
Last modified on September 26, 2026