Skip to main content
Capabilities are UI/runtime flags for the embedded YoLead interface. The backend still validates access and state before allowing any action.
Capabilities control iframe UI features. They do not replace API key scope checks, plan feature checks, employee access checks, chat access checks, or ticket state validation.
Supported capabilities: Scope limits: If showChatPage is requested without showChatsList, chatId is required unless startOutboundChat is also requested. If a read key requests startOutboundChat, session creation fails with 403. Other write capabilities requested with a read key are silently removed from the effective session. The response capabilities field shows what was actually granted. If no view capability remains after filtering, session creation fails.

​
View capabilities

At least one view capability must be enabled:
  • showChatsList
  • showChatPage
Without a view capability, the iframe has no screen to render and session creation fails.

​
Single-chat restriction

When showChatPage is used without showChatsList or startOutboundChat, the session must be tied to a specific chatId. In that case, the response includes allowedChatId, and the iframe token is scoped to that chat.

​
Outbound chat

For a dedicated outbound composer, request showChatPage and startOutboundChat with a read-write API key and omit chatId. The returned iframe opens the outbound route. showChatPage satisfies the requirement that every session has at least one view capability. Starting a new conversation also requires outbound chat initiation to be available on the company’s current plan. The iframe can receive the startOutboundChat capability but the send action returns 403 with code 40352 if the plan does not include that feature. The outbound composer includes connected email company channels. For an email channel, recipients are selected by email identity and the composer can set a subject when starting a new chat. See Email channel for reply and content behavior.