Skip to main content
Capabilities are UI/runtime flags for the embedded YoLead interface. The backend still validates access and state before allowing any action.
Capabilities control iframe UI features. They do not replace API key scope checks, plan feature checks, employee access checks, chat access checks, or ticket state validation.
Supported capabilities: Scope limits: If showChatPage is requested without showChatsList, chatId is required unless startOutboundChat is also requested. If a read key requests startOutboundChat, session creation fails with 403. Other write capabilities requested with a read key are silently removed from the effective session. The response capabilities field shows what was actually granted. If no view capability remains after filtering, session creation fails.

​
View capabilities

At least one view capability must be enabled:
  • showChatsList
  • showChatPage
Without a view capability, the iframe has no screen to render and session creation fails.

​
Single-chat restriction

When showChatPage is used without showChatsList or startOutboundChat, the session must be tied to a specific chatId. In that case, the response includes allowedChatId, and the iframe token is scoped to that chat.

​
Outbound chat

For a dedicated outbound composer, request showChatPage and startOutboundChat with a read-write API key and omit chatId. The returned iframe opens the outbound route. showChatPage satisfies the requirement that every session has at least one view capability. Starting a new conversation also requires outbound chat initiation to be available on the company’s current plan. The iframe can receive the startOutboundChat capability but the send action returns 403 with code 40352 if the plan does not include that feature. The outbound composer includes connected email company channels. For an email channel, recipients are selected by email identity and the composer can set a subject when starting a new chat. See Email channel for reply and content behavior. Connected Telegram Account channels are also available. Recipients can be identified by their Telegram user id, phone number, or username, subject to Telegram lookup and delivery restrictions.

​
Attachments

Sending attachments in an existing chat requires showSendInput. Sending the first message with attachments requires startOutboundChat; include showSendInput to let the employee continue the conversation after it opens. The same employee access, single-chat restriction, ticket state, and plan checks apply. Photos support up to 10 MiB per file; documents support up to 20 MiB per file by default. Email additionally limits the combined original attachment size to 18 MiB. Storage settings can lower these limits, and file availability and provider restrictions still apply. An attachment-only message does not require a caption or text. Attachment sending can be unavailable when YoLead’s file storage is unavailable. The iframe handles file selection and sending within the granted capabilities.