API reference

curl -X POST https://muro.chat/api/v1/webhooks \
  -H "Authorization: Bearer mr_live_xxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://hooks.example.com/muro",
    "events": ["message.created"],
    "website_id": "web_…",
    "headers": { "Authorization": "Bearer your-receiver-key" }
  }'

{
  "object": "webhook_endpoint",
  "id": "whe_…",
  "name": "hooks.example.com",
  "url": "https://hooks.example.com/muro",
  "events": ["message.created"],
  "enabled": true,
  "website_id": "web_…",
  "headers": { "Authorization": "****-key" },
  "created_at": "2026-11-10T10:00:00.000Z",
  "secret": "whsec_…"   // shown only here
}

curl -X PATCH https://muro.chat/api/v1/webhooks/whe_… \
  -H "Authorization: Bearer mr_live_xxxxxxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{ "headers": { "Authorization": "Bearer new-receiver-key" } }'

{
  "id": "evt_…",
  "type": "message.created",
  "organization_id": "org_…",
  "created_at": "2026-06-07T10:00:00.000Z",
  "data": { … }   // shape depends on "type", see below
}

content-type:       application/json
user-agent:         muro-webhooks/1.0
x-muro-event:       message.created
x-muro-event-id:    evt_…
x-muro-timestamp:   1733570400
x-muro-signature:   t=1733570400,v1=<hmac-sha256 hex>
authorization:      Bearer your-receiver-key   // your custom headers, if any

v1 = hex( HMAC_SHA256( key = secret (the full "whsec_…" string),
                       message = raw request body ) )

import crypto from 'node:crypto';

// rawBody = the exact bytes we POSTed: verify BEFORE JSON.parse,
// do not re-serialize (key order would change the digest).
const sig = req.headers['x-muro-signature'];          // "t=…,v1=…"
const v1  = sig.split(',').find(p => p.startsWith('v1=')).slice(3);
const expected = crypto
  .createHmac('sha256', process.env.MURO_WEBHOOK_SECRET)  // whsec_…
  .update(rawBody)
  .digest('hex');
const ok = crypto.timingSafeEqual(Buffer.from(v1), Buffer.from(expected));

// message.created: every visitor message, and agent replies
"data": {
  "message": {
    "id": "msg_…",
    "conversation_id": "cnv_…",
    "website_id": "web_…",      // the site the conversation belongs to
    "sender_type": "visitor",   // or "agent"
    "sender_id": "vis_…",       // visitor id, agent user id, or null
    "content": "Hi! Is the Pro plan…",
    "created_at": "2026-06-07T10:00:00.000Z"
  }
}

// conversation.opened: a brand-new thread
"data": {
  "conversation": {
    "id": "cnv_…",
    "website_id": "web_…",
    "visitor_id": "vis_…",
    "created_at": "2026-06-07T10:00:00.000Z"
  }
}

// conversation.closed: resolved by an agent or the API
"data": {
  "conversation": {
    "id": "cnv_…",
    "status": "closed",
    "tags": ["billing"],
    "unread_count": 0,
    "assigned_user_id": "usr_…",
    "last_message_at": "2026-06-07T10:00:00.000Z",
    "website_id": "web_…"
  }
}

// visitor.identified: a visitor handed over an email
"data": {
  "visitor": { "id": "vis_…", "email": "marie@acme.io", "name": "Marie" }
}

import Pusher from 'pusher-js';

// 1. fetch connection details
const rt = await fetch('https://muro.chat/api/v1/realtime', {
  headers: { Authorization: 'Bearer mr_live_…' },
}).then(r => r.json());

// 2. connect, authorizing private channels with your key
const pusher = new Pusher(rt.config.key, {
  wsHost: rt.config.host, wsPort: rt.config.port,
  forceTLS: rt.config.forceTLS, enabledTransports: ['ws', 'wss'],
  channelAuthorization: {
    endpoint: rt.auth_endpoint,
    headers: { Authorization: 'Bearer mr_live_…' },
  },
});

// 3. subscribe to the workspace channel
const ch = pusher.subscribe(rt.channels.workspace);  // private-org-…
ch.bind('message.new',         (m) => { /* agent + visitor msgs, and notes */ });
ch.bind('conversation.update', (c) => { /* status / unread / assignment */ });
ch.bind('agent.typing',        (t) => { /* show indicator */ });

# Connect Claude / any MCP client over the remote bridge
npx mcp-remote https://muro.chat/api/mcp \
  --header "Authorization: Bearer mr_live_…"

# Or call it directly, it's plain JSON-RPC over HTTP
curl https://muro.chat/api/mcp \
  -H "Authorization: Bearer mr_live_…" \
  -H "Content-Type: application/json" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/call",
       "params":{"name":"list_conversations",
                 "arguments":{"status":"open","limit":10}}}'

// boot, from the install snippet (Dashboard, Sites, your site)
muro('init', { widgetId: 'wgt_…' });

// identify a signed-in user: skips the pre-chat email form.
// Only send identities you trust (server-rendered session values).
muro('identify', {
  email: currentUser.email,   // ties the thread to the user
  name:  currentUser.name,    // optional
});

// open / close the panel programmatically
document.querySelector('#help-button')
  .addEventListener('click', () => muro('open'));
muro('close');