> ## Documentation Index > Fetch the complete documentation index at: https://docs.tawked.com/llms.txt > Use this file to discover all available pages before exploring further. # Update the auto-attendant settings > For a connected app's key alone, with `chat:attendant` in its connection's grant: an application's own key, full access included, answers `403 insufficient_scope`, and builds its auto-attendant in the console. Changes any of `mode` and `language`, at least one; what is left out stays. Answers the attendant object. Recorded in the client's account record under the app's name. Guide: [Connected apps](/integrations/connected-apps) ## OpenAPI ````yaml https://tawked.com/openapi.json patch /v1/chat/attendant/settings openapi: 3.1.0 info: title: Tawked API version: 2026-09 summary: >- Tawked Verify: OTP verification for Saudi mobile numbers over SMS, in two calls. Tawked Notifications: WhatsApp template messages from the application's own number. Tawked Email: transactional e-mail from the application's own verified domain. Tawked Chat: the conversation menus a connected app adds beside the conversations of its connection's application, and the auto-attendant it sets up there. The Partner API for platforms that run Tawked Verify for their merchants. description: >- The public API of Tawked, a Saudi messaging platform: Tawked Verify (one-time codes), Tawked Notifications (WhatsApp templates from the application's own number), Tawked Email (transactional e-mail from the application's own domain) and the Partner API. Tawked Verify is an OTP verification API for Saudi numbers. One call sends a one-time code by SMS to a Saudi mobile number, and a second call checks it. SAR 0.09 per SMS code sent, prepaid; a send the network refuses is refunded. Authenticate with a Bearer API key from the dashboard (tk_live_ for production, tk_test_ for the sandbox, tk_partner_ for partners, tk_partner_test_ for the partner sandbox). Partners (tk_partner_) provision a Verify application per merchant under /v1/partner/applications and name it as application on every Verify call. Both /v1/... and /api/v1/... answer identically. Rate limit: 120 requests per minute per key. termsOfService: https://tawked.com/en/terms license: name: Proprietary (Tawked terms of service) url: https://tawked.com/en/terms contact: name: Tawked support email: support@tawked.com url: https://tawked.com/en/contact servers: - url: https://tawked.com description: Production (the sandbox is a tk_test_ key on the same host) - url: https://tawked.com/api description: The same API under /api/v1/..., kept for older integrations security: - bearerKey: [] - headerKey: [] tags: - name: Verify x-group: Verify description: Send and check one-time codes. - name: WhatsApp x-group: Notifications description: >- Tawked Notifications: send approved WhatsApp templates through the number connected to an application. An application in review or approved connects its own number from the dashboard. - name: Email x-group: Email description: >- Tawked Email: send one transactional message per call from an address on a verified domain of the application, and read its status. Live keys only. - name: Chat x-group: Chat description: >- Tawked Chat: the conversation menus a connected app adds beside the conversations of its connection's application, and reads, changes and removes, with `chat:menus`; and the application's auto-attendant, which a connected app sets up, publishes and switches on or off, with `chat:attendant`. A connected app's key only; a business adds its own menus and builds its auto-attendant in the console. - name: Partner x-group: Partner API description: >- For platforms that run Tawked Verify for their merchants: provision a Verify application per merchant, keep its brand and verify settings current, switch it off and on, and read usage and the code log. Partner keys (tk_partner_) only; every Verify operation then takes `application` with the partner's own id for the application. - name: Webhooks x-group: Webhooks description: >- The events Tawked sends to your endpoint: an application's verification outcomes and message statuses, and a partner account's lifecycle, balance and opt-in verification events. Every delivery is signed the same way and retried the same way. externalDocs: description: Developer docs, with code samples url: https://docs.tawked.com paths: /v1/chat/attendant/settings: patch: tags: - Chat summary: Update the auto-attendant settings description: >- For a connected app's key alone, with `chat:attendant` in its connection's grant: an application's own key, full access included, answers `403 insufficient_scope`, and builds its auto-attendant in the console. Changes any of `mode` and `language`, at least one; what is left out stays. Answers the attendant object. Recorded in the client's account record under the app's name. operationId: chat_attendant_settings parameters: - name: Idempotency-Key in: header required: false description: >- A 1 to 128 printable-ASCII-character key you generate, scoped to your API key. Replaying it with the same request answers the original 2xx unchanged, with the response header `Idempotent-Replayed: true`, and runs nothing again; the same key with another request answers `409 idempotency_key_reused`, and a request still in flight `409 idempotency_in_progress`. A refused request is never stored, so a corrected retry under the same key runs. Keys expire after 24 hours. schema: type: string requestBody: required: true content: application/json: schema: type: object properties: mode: type: string description: >- `menu_only`: outside the choices, the customer reaches the team. `menu_then_radeef`: after the menu, Radeef answers; it needs Radeef set up on the application. Refused: `invalid`. language: type: string description: >- `ar` or `en`: the language of the bot's own words, its «رجوع» and «القائمة» buttons (Back and Menu) and the default lines. Refused: `invalid`. responses: '200': description: The auto-attendant after the change content: application/json: schema: type: object properties: state: type: string lock: type: - string - 'null' enabled: type: boolean mode: type: string language: type: string draft: type: object properties: version: type: integer opening: type: string list_button: type: string away: type: - string - 'null' fallback: type: string choices: type: array items: type: object properties: id: type: string title: type: string description: type: - string - 'null' action: type: object properties: type: type: string text: type: string link: type: string draft_saved_at: type: string format: date-time problems: type: array items: type: - string - 'null' published: type: object properties: version: type: integer published_at: type: string format: date-time menu: type: object properties: version: type: integer opening: type: string list_button: type: string away: type: - string - 'null' fallback: type: string choices: type: array items: type: object properties: id: type: string title: type: string description: type: - string - 'null' action: type: object properties: type: type: string text: type: string link: type: string changed: type: boolean examples: the_auto_attendant_after_the_change: summary: The auto-attendant after the change value: state: live lock: null enabled: true mode: menu_then_radeef language: ar draft: version: 1 opening: >- ⚽ أهلًا وسهلًا بك في أكاديمية النجوم لكرة القدم 💙 يسعدنا تواصلك معنا، ونتطلع لمساعدة بطلنا في بدء رحلته الكروية 🌟 👇 اختر من القائمة التالية الخدمة التي تحتاجها. list_button: القائمة away: null fallback: >- 💙 يمكنك اختيار الخدمة من القائمة، أو كتابة استفسارك مباشرة ليتم تحويل محادثتك إلى إدارة الأكاديمية. choices: - id: c_prices title: 💰 أسعار الاشتراكات description: null action: type: reply text: |- 💰 أسعار الاشتراكات في أكاديمية النجوم: 🔹 شهر: 230 ريال 🔹 3 أشهر: 630 ريال 🔹 6 أشهر: 1,140 ريال 🔹 سنة كاملة: 1,920 ريال 📲 للتسجيل الإلكتروني: link: >- https://app.yourplatform.example/register?academy=ACADEMY_ID - id: c_programs title: ⚽ البرامج والمواعيد description: null action: type: reply text: >- ⚽ البرامج والمواعيد في أكاديمية النجوم: 👦 الفئات العمرية: من 5 إلى 18 سنة، في مجموعات حسب العمر. 📅 أيام التدريب: الأحد والثلاثاء والخميس. ⏰ وقت التدريب: من بعد صلاة العصر حتى صلاة العشاء. 📍 موقع الأكاديمية: link: https://maps.app.goo.gl/EXAMPLE - id: c_register title: 📝 تسجيل لاعب جديد description: null action: type: reply text: >- 📝 يسعدنا انضمام بطلنا إلى أكاديمية النجوم 🌟 سجّل اللاعب من الرابط، واختر الفئة العمرية ومدة الاشتراك، وسيتواصل معك فريق الأكاديمية لتأكيد التسجيل. 📲 رابط التسجيل الإلكتروني: link: >- https://app.yourplatform.example/register?academy=ACADEMY_ID - id: c_location title: 📍 موقع الأكاديمية description: null action: type: reply text: |- 📍 موقع أكاديمية النجوم 💙 يسعدنا زيارتكم في أي وقت خلال أوقات التدريب. للوصول إلى الأكاديمية عبر خرائط Google 👇 link: https://maps.app.goo.gl/EXAMPLE - id: c_team title: 💬 التواصل مع الإدارة description: null action: type: team line: >- 💬 تم تحويل محادثتك إلى إدارة أكاديمية النجوم ✅ يرجى كتابة استفسارك، وسيقوم أحد أعضاء فريق الإدارة بالرد عليك في أقرب وقت ممكن. 💙 نسعد بخدمتك دائمًا. tag: التواصل_مع_الإدارة assign: mode: auto member_id: null draft_saved_at: '2026-10-15T09:00:00Z' problems: [] published: version: 1 published_at: '2026-10-15T09:01:00Z' menu: version: 1 opening: >- ⚽ أهلًا وسهلًا بك في أكاديمية النجوم لكرة القدم 💙 يسعدنا تواصلك معنا، ونتطلع لمساعدة بطلنا في بدء رحلته الكروية 🌟 👇 اختر من القائمة التالية الخدمة التي تحتاجها. list_button: القائمة away: null fallback: >- 💙 يمكنك اختيار الخدمة من القائمة، أو كتابة استفسارك مباشرة ليتم تحويل محادثتك إلى إدارة الأكاديمية. choices: - id: c_prices title: 💰 أسعار الاشتراكات description: null action: type: reply text: |- 💰 أسعار الاشتراكات في أكاديمية النجوم: 🔹 شهر: 230 ريال 🔹 3 أشهر: 630 ريال 🔹 6 أشهر: 1,140 ريال 🔹 سنة كاملة: 1,920 ريال 📲 للتسجيل الإلكتروني: link: >- https://app.yourplatform.example/register?academy=ACADEMY_ID - id: c_programs title: ⚽ البرامج والمواعيد description: null action: type: reply text: >- ⚽ البرامج والمواعيد في أكاديمية النجوم: 👦 الفئات العمرية: من 5 إلى 18 سنة، في مجموعات حسب العمر. 📅 أيام التدريب: الأحد والثلاثاء والخميس. ⏰ وقت التدريب: من بعد صلاة العصر حتى صلاة العشاء. 📍 موقع الأكاديمية: link: https://maps.app.goo.gl/EXAMPLE - id: c_register title: 📝 تسجيل لاعب جديد description: null action: type: reply text: >- 📝 يسعدنا انضمام بطلنا إلى أكاديمية النجوم 🌟 سجّل اللاعب من الرابط، واختر الفئة العمرية ومدة الاشتراك، وسيتواصل معك فريق الأكاديمية لتأكيد التسجيل. 📲 رابط التسجيل الإلكتروني: link: >- https://app.yourplatform.example/register?academy=ACADEMY_ID - id: c_location title: 📍 موقع الأكاديمية description: null action: type: reply text: |- 📍 موقع أكاديمية النجوم 💙 يسعدنا زيارتكم في أي وقت خلال أوقات التدريب. للوصول إلى الأكاديمية عبر خرائط Google 👇 link: https://maps.app.goo.gl/EXAMPLE - id: c_team title: 💬 التواصل مع الإدارة description: null action: type: team line: >- 💬 تم تحويل محادثتك إلى إدارة أكاديمية النجوم ✅ يرجى كتابة استفسارك، وسيقوم أحد أعضاء فريق الإدارة بالرد عليك في أقرب وقت ممكن. 💙 نسعد بخدمتك دائمًا. tag: التواصل_مع_الإدارة assign: mode: auto member_id: null changed: false '400': description: >- Refused fields / `invalid_request`: `fields` names every refused field and `errors` gives its codes. `menu`: `required`, `not_object`, `too_large` (over 64 KB, or 256 choices in all). `enabled`: `required` (missing or not a boolean). `mode`, `language`: `invalid`; a settings change with neither answers `mode` `required`. Also a malformed `Idempotency-Key`. A menu that is an object but breaks a rule is saved, with its `problems`.; `invalid_json`: The request body is not valid JSON. content: application/json: schema: allOf: - $ref: '#/components/schemas/Error' - properties: error: enum: - invalid_request - invalid_json examples: refused_fields: summary: Refused fields value: error: invalid_request fields: - mode errors: mode: - invalid '401': description: >- `unauthorized`: Missing, unknown, revoked, or mode-mismatched key; or an unknown/suspended partner.; `key_expired`: The key's `expires_at` has passed. Checked right after the key is recognised, before the IP allowlist or scope. content: application/json: schema: allOf: - $ref: '#/components/schemas/Error' - properties: error: enum: - unauthorized - key_expired '403': description: >- `live_key_required`: A test key. A connected app's key is live; use the key the exchange answered.; `account_not_active`: The application is not approved yet, the account is banned, or a partner disabled this application. All four causes share this one response.; `ip_not_allowed`: The caller's IP does not match the key's `ip_allowlist` (exact IPs and/or CIDR ranges, IPv4 and IPv6).; `insufficient_scope`: The key was not granted this call: a custom key without this product, or with a level below the call, such as a key that checks where the call sends. The response header `WWW-Authenticate` names the scope the call needs. Judged right after the key is recognised, before `account_not_active` and the request's shape. This operation needs `chat:attendant`. An application's own key answers this, full access included: only a connected app's key holds that scope. content: application/json: schema: allOf: - $ref: '#/components/schemas/Error' - properties: error: enum: - live_key_required - account_not_active - ip_not_allowed - insufficient_scope headers: WWW-Authenticate: description: >- Sent with `insufficient_scope` only: the scope this operation needs, which the key was not granted. schema: type: string example: Bearer error="insufficient_scope", scope="chat:attendant" '409': description: >- `idempotency_in_progress`: A request with this `Idempotency-Key` is still running. Wait for its answer, or retry in a moment.; `idempotency_key_reused`: This `Idempotency-Key` was already used for a different request. Use one key per change. content: application/json: schema: allOf: - $ref: '#/components/schemas/Error' - properties: error: enum: - idempotency_in_progress - idempotency_key_reused '429': description: >- `too_many_requests`: Per-key rate limit exceeded (default 120 requests/minute, fixed 60s window). Checked before authentication. content: application/json: schema: allOf: - $ref: '#/components/schemas/Error' - properties: error: enum: - too_many_requests '500': description: >- `internal_error`: An unhandled server error. Quote the X-Request-Id header if you report it. content: application/json: schema: allOf: - $ref: '#/components/schemas/Error' - properties: error: enum: - internal_error x-codeSamples: - lang: bash label: cURL source: |- curl -X PATCH https://tawked.com/v1/chat/attendant/settings \ -H "Authorization: Bearer tk_live_xxxxxxxxxxxxxxxxxxxx" \ -H "Content-Type: application/json" \ -d '{ "mode": "menu_then_radeef" }' - lang: javascript label: Node.js source: >- const res = await fetch("https://tawked.com/v1/chat/attendant/settings", { method: "PATCH", headers: { Authorization: "Bearer tk_live_xxxxxxxxxxxxxxxxxxxx", "Content-Type": "application/json", }, body: JSON.stringify({ "mode": "menu_then_radeef" }), }); const data = await res.json(); - lang: python label: Python source: |- import requests res = requests.patch( "https://tawked.com/v1/chat/attendant/settings", headers={"Authorization": "Bearer tk_live_xxxxxxxxxxxxxxxxxxxx"}, json={ "mode": "menu_then_radeef" }, ) data = res.json() components: schemas: Error: type: object required: - error properties: error: type: string description: A stable machine-readable code; the docs list every one. additionalProperties: true securitySchemes: bearerKey: type: http scheme: bearer description: >- Authorization: Bearer . An application key (tk_live_, tk_test_) has full access, which covers every product and any product added later, or custom access, chosen when the key is created: one or more of the scopes `verify:check`, `verify:send` (includes `verify:check`), `notifications:read`, `notifications:send` (includes `notifications:read`), `email:read`, `email:send` (includes `email:read`), `notifications:templates` (includes `notifications:read`), `chat:menus`, `chat:attendant`. No key made on the API keys page holds `notifications:templates`, full access included: the three template writes answer such a key 403 `insufficient_scope`. A connected app's key holds it. Nor `chat:menus`: the five conversation menu operations answer such a key 403 `insufficient_scope`, and a connected app's key holds it once the client approved it. Nor `chat:attendant`: the five auto-attendant operations answer such a key 403 `insufficient_scope` too, and a connected app's key holds it once the client approved it. A call outside the key's access answers 403 `insufficient_scope` and names the scope it needs in the `WWW-Authenticate` response header. A partner key (tk_partner_) always has full access. Whatever its access, a key is a server-side secret. headerKey: type: apiKey in: header name: x-api-key description: >- The same API key, with the same access, as a header, for clients that cannot set Authorization. ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.