List visitor conversation history

GET 
/api/widget/messages

PUBLIC endpoint (anonymous visitors, NO staff auth). Returns a page of the visitor's OWN conversation transcript, oldest first. The tenant is resolved from the widget_key and the conversation comes EXCLUSIVELY from the verified session token — a visitor can only ever read their own thread. Internal meta (AI model / tokens) and staff sender identity are never exposed.

Request

Responses

200

A page of the visitor's conversation messages.

403

Missing / invalid / cross-tenant session token.

404

Unknown or missing widget_key, or the conversation is gone.

429

Rate limit exceeded.

Response Headers

X-RateLimit-Limit

Request quota for the current window.

X-RateLimit-Remaining

Remaining requests in the current window.

Retry-After

Seconds to wait before retrying.