> ## Documentation Index > Fetch the complete documentation index at: https://docs.connectadesk.com/llms.txt > Use this file to discover all available pages before exploring further. # List session messages > To follow along without real time, call with `after` = `createdAt` of the last message received (polling). Internal notes never show up. ## OpenAPI ````yaml /api-reference/openapi.en.yaml get /webchat/{slug}/sessions/{sessionId}/messages openapi: 3.0.3 info: title: Connecta DESK Public API version: 1.0.0 description: >- Public API of Connecta DESK, available at `/api/v1`. Access uses a token generated in the tokens module. Each token has permissions per **module × method**, and every list read is paginated. ## Authentication ``` Authorization: Bearer sk_live_a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6 ``` The token belongs to a **company**, not to a user. The company used is always the token's company, so sending `companyId` in the body has no effect. A missing, invalid, revoked or expired token gets the same `401` response. ## Order of checks 1. **token** → `401` 2. **active company** → `403` 3. **API enabled on the plan** → `403 ERR_API_NOT_ENABLED` (does not apply to on-premise) 4. **company rate limit** → `429` 5. **token permission** → `403 ERR_API_FORBIDDEN_SCOPE` ## User ids Every user id in the API is the user's id **in this company**, the same one `GET /users` returns. This applies to what the API returns (`user.id`, `assignedTo.id`, `userCreated.id`) and to what it accepts (`userId`, `userIds`, `assignedToUserId` and the `{id}` in user routes). The same person can work in several companies, with a different name and profile in each one, and has a different id in each company. An id that does not belong to this company returns `404`, with the same message as an id that does not exist. ## Pagination Every list `GET` is paginated. The `meta` contains only `page`, `perPage` and `hasMore`, without the total number of records. To go through everything, keep advancing `page` while `hasMore` is `true`. ## Idempotency Optional on `POST`/`PUT`, through the `Idempotency-Key` header. If you repeat the call with the same key and the same body, you get the stored response (with `Idempotent-Replay: true`). With the same key and a different body, the response is `409`. servers: - url: https://api.connectadesk.com/api/v1 description: Production security: - apiToken: [] tags: - name: contacts description: Contact records, extra fields and marketing source. - name: tickets x-displayName: Tickets description: Opening, transferring, closing and wrap-up of tickets. - name: messages description: Asynchronous sending and reading of messages. - name: tags description: Tags and their link to tickets. - name: queues description: Service queues and their agents. - name: wrapups description: Wrap-up types. - name: users description: Agents and administrators. - name: schedules description: Scheduled messages. - name: quick-messages description: Quick replies. - name: campaigns description: Bulk sending. - name: crm description: Boards, stages, cards and metrics. - name: channels description: Channels (read only). - name: reports description: Reports and dashboards. - name: products description: Product catalog, categories and sales performance. - name: custom-fields description: Custom fields for contacts and cards, plus company-wide global variables. - name: profiles description: Company permission profiles (read only). - name: webchat description: >- Native webchat from your own system: open a visitor session, send and read messages. The token needs the `webchat` scope (GET and POST). paths: /webchat/{slug}/sessions/{sessionId}/messages: parameters: - name: slug in: path required: true schema: type: string example: site-institucional-3f9a - name: sessionId in: path required: true schema: type: string format: uuid example: 1b0f9a52-3c8e-4f0e-9d1c-6a1c0e7b2f44 get: tags: - webchat summary: List session messages description: >- To follow along without real time, call with `after` = `createdAt` of the last message received (polling). Internal notes never show up. parameters: - name: after in: query description: Only messages after this date (ascending order). schema: type: string format: date-time - name: before in: query description: Only messages before this date (previous page). schema: type: string format: date-time - name: limit in: query schema: type: integer minimum: 1 maximum: 100 default: 30 responses: '200': description: OK content: application/json: schema: type: object properties: data: type: array items: $ref: '#/components/schemas/WebchatMessage' meta: $ref: '#/components/schemas/PageMeta' '401': $ref: '#/components/responses/Unauthorized' '403': $ref: '#/components/responses/Forbidden' '404': $ref: '#/components/responses/NotFound' components: schemas: WebchatMessage: type: object properties: id: type: string example: 6f1d2c1e-8a8b-4f35-a1e6-1f2f3c4d5e6f body: type: string description: >- Message text. In an interactive message, only the body (header and footer come in `interactive`). example: Olá, gostaria de um orçamento fromVisitor: type: boolean example: true origin: type: string enum: - visitor - agent - bot - automation - api example: visitor agentName: type: string nullable: true example: null ack: type: integer description: 1 sent, 3 delivered to the widget, 4 read. example: 1 mediaUrl: type: string nullable: true example: null mediaType: type: string nullable: true description: >- `image`, `video`, `audio`, `application` or `locationMessage` (location). example: null fileName: type: string nullable: true example: null options: type: array description: >- Reply options of the interactive message (buttons, list rows and card buttons). To reply, use `interactiveReply` with the option `id`. items: type: object properties: id: type: string title: type: string example: [] interactive: $ref: '#/components/schemas/WebchatInteractive' location: $ref: '#/components/schemas/WebchatLocation' quoted: $ref: '#/components/schemas/WebchatQuoted' isDeleted: type: boolean example: false isEdited: type: boolean example: false createdAt: type: string format: date-time example: '2026-10-01T13:45:00.000Z' PageMeta: type: object required: - page - perPage - hasMore properties: page: type: integer example: 1 perPage: type: integer example: 20 hasMore: type: boolean description: Whether there are more records beyond this page. example: true example: page: 1 perPage: 20 hasMore: true WebchatInteractive: type: object nullable: true description: >- Interactive message sent by the company, ready to render (the widget renders it as WhatsApp does). `null` on regular messages and on the visitor's. | `type` | Action | | --- | --- | | `button` | `buttons`: reply buttons | | `list` | `list.button` opens the list; `list.sections[].rows[]` are the options | | `cta_url` | `link`: button that opens `link.url` | | `location_request` | location request: reply with `location` | | `carousel` | `cards[]`: media, text and reply or link buttons | properties: type: type: string enum: - button - list - cta_url - location_request - carousel example: button header: type: object nullable: true description: >- Header: `{ type: text, text }`, `{ type: image|video, url }` or `{ type: document, url, fileName }`. properties: type: type: string enum: - text - image - video - document text: type: string url: type: string fileName: type: string nullable: true body: type: string example: Como prefere pagar? footer: type: string nullable: true example: null buttons: type: array items: type: object properties: id: type: string title: type: string example: - id: pix title: Pix - id: cartao title: Cartão list: type: object properties: button: type: string example: Ver opções sections: type: array items: type: object properties: title: type: string nullable: true rows: type: array items: type: object properties: id: type: string title: type: string description: type: string nullable: true link: type: object properties: text: type: string example: Rastrear pedido url: type: string example: https://loja.com.br/pedidos/1234 cards: type: array items: type: object properties: header: type: object nullable: true properties: type: type: string enum: - image - video url: type: string body: type: string buttons: type: array items: type: object properties: id: type: string title: type: string link: type: object nullable: true properties: text: type: string url: type: string example: type: button header: null body: Como prefere pagar? footer: null buttons: - id: pix title: Pix - id: cartao title: Cartão WebchatLocation: type: object nullable: true description: >- Location (message with `mediaType: locationMessage`). `null` on the others. properties: latitude: type: number example: -23.561399 longitude: type: number example: -46.656571 url: type: string description: Map link. example: https://maps.google.com/maps?q=-23.561399%2C-46.656571&z=17 example: null WebchatQuoted: type: object nullable: true description: >- Replied (quoted) message. Absent when the quote was not loaded; `null` when there is none or the visitor cannot see it. properties: id: type: string body: type: string fromVisitor: type: boolean mediaType: type: string nullable: true fileName: type: string nullable: true isDeleted: type: boolean example: null Error: type: object required: - error properties: error: type: object required: - code - message properties: code: type: string description: Fixed error code, so your system can handle each case. example: ERR_API_FORBIDDEN_SCOPE message: type: string details: {} responses: Unauthorized: description: Token missing, invalid, revoked or expired. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: ERR_API_UNAUTHORIZED message: Token de API ausente ou inválido. Forbidden: description: >- Inactive company, API not enabled on the plan, or insufficient permission. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: ERR_API_FORBIDDEN_SCOPE message: >- O token não tem permissão para este método neste módulo. A mensagem real nomeia os dois. NotFound: description: >- The resource does not exist or belongs to another company. For security, the response is the same in both cases. content: application/json: schema: $ref: '#/components/schemas/Error' example: error: code: ERR_API_NOT_FOUND message: Registro não encontrado. securitySchemes: apiToken: type: http scheme: bearer description: API token in the `sk_live_…` format. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.