Using Kore.ai APIs

The Kore.ai XO Platform allows you to develop Virtual Assistants using secured APIs. All key developer activities like creation, import and export, training, and publishing are available using these APIs. Key account management activities like managing XO Platform access, managing admin, and roles can also be performed via secured public APIs. For a complete list of APIs and usage instructions refer here.

Authentication of the API requests involves the following two steps:

1. Creating an App: As a part of creating the app, you need to select the API scopes for the App, which allows you to provide access to only the selected APIs to the app.
1. XO Platform API Scopes: Assistant developers can define specific API Scopes from the XO Platform.
2. Bot Admin Console API Scopes: Account administrators can define API Scopes to access any of the assistants built in their accounts from the Admin Console.
2. Associate API Scopes to an App: To allow a client application to access the XO Platform APIs, you need to associate the client app with the assistant.

Additionally, you can secure the connections with the Platform by the following methods:

1. Enforce JTI Claim – Once enabled, the Platform would accept the requests only from calls with the JTI Claim in the requests and those without JTI Claim would be rejected
2. Enforce JWE Encryption– Generating JWT token: To access the XO Platform’s public APIs, the application making the API request requires authentication. Kore.ai uses the JWT (JSON Web Token) mechanism to handle the authentication. For a quick overview of the JWT token, read Introduction to JWT tokens.
   Use the Client ID and Client Secret of the client app from above to generate a JWT token. This token needs to be passed as a part of each API request for authorization.

Creating & Managing Apps

XO Platform

The following steps let you create a Client App from the XO Platform:

1. Select Deploy tab from the top menu
2. From the left menu, click Integrations > Manage Apps
3. Click New App.
4. On the Create Client App page:
1. enter a name for the app,
2. enforce JTI and/or JWE as per your requirements
5. Click Next and Done.
   
   
6. You will be directed to the Manage Apps page, where all the apps associated with this assistant will be displayed.
7. Once you select an app, the Client ID and Client Secret sections appear. Here is where you will also find a list of places where this app is used, like web SDK, botkit SDK, etc.
8. You can also use this screen to delete apps by using the trash icon against the respective app.
   

   Note, Only the Bot Owner can delete an app.

Note: Before the release of ver 7.3 of the Platform, apps were associated with the user. The apps have been associated with an assistant since the release of ver 7.3 of the Platform. Developers, other than the bot owner, with Apps and Scopes permission, will have access to these apps. To ensure backward compatibility, if an app is being used by more than one assistant, then the app will be duplicated with the same credentials for each of these assistants.

Bots Admin Console

The following steps let you create a Client App from the Bot Admin Console:

1. On the side-navigation panel of the Bots Admin homepage, click Security & Control > API Scopes.
2. On the API Scopes page, click New.
3. To create a new app, click the Manage Apps link.
4. Click New App,
1. enter a name and
2. enforce JTI and/or JWE as per your requirements
5. Click Save.

Data Tables

The Data table option has been added to the Platform in v7.3 of the Platform (see here for more). Access control to these would be different from the XO Platform and Bot Admin Console access controls.

You can define apps to securely access the data from data tables and data views.

• You can create one or more apps and they would be owned by you, see here for how.
• These apps can be used for:
• Accessing the data tables and views over public APIs
• Accessing the data tables and views using Service Node
• Accessing the export and import API for the definition of data table and views
• You can grant this app read, write, and delete permissions to each table and view separately, see here for more.

Associating API Scopes

Once created a client app needs to be associated with API scopes.

XO Platform

The following steps let you associate API Scopes to a Client App from the XO Platform:

1. From your assistant, go to Deploy > Integrations > API Scopes and click Create API Scope / New.
2. On the New API Scope Mapping page, from the App drop-down list, select an existing client app for authentication.
3. Once you select an app, the Client ID and Client Secret sections appear. You can copy the values.
   
   
4. Under the Scopes section, select the APIs for which you want the client app to have access. The apps cannot access the APIs that aren’t selected here. The following are the list of scopes that can be selected:

Bots Admin Console

The following steps let you associate API Scopes to a Client App from the Bot Admin Console:

1. On the side-navigation panel of the Bots Admin homepage, click Security & Control > API Scopes.
2. On the API Scopes page, click New.
3. On the New API Scope Mapping page, from the App drop-down list, select an existing client app for authentication. To create a new app, click the Manage Apps link.
4. Once you select an app, the Client ID and Client Secret section appear. Copy the values.
5. You can also use this screen to delete apps by using the trash icon against the respective app.
6. Under the Scopes section, select the APIs for which you want the client app to have access.
   Refer here for the list of API scopes.

List of Available API Scopes

SCOPE	DESCRIPTION
Intent and Entity Detection	Assign this scope to allow intent and entity detection from an utterance using secured APIs.
User Engagement Trend	To retrieve the user engagement trend.
Batch Tests Execution	To execute Batch Test Suites and get results.
Batch Tests Management	To create, modify and delete Batch Test Suites and results.
Chat History	Assign this scope to retrieve chat transcripts of this assistant using secured APIs.
Debug Logs	Assign this scope to retrieve debug logs of this assistant using secured APIs.
Bot Export	Export definition of a selected assistant.
Import Variables	Assign this scope to import variables of this assistant using secured APIs.
Export Variables	Assign this scope to export variables of this assistant using secured APIs.
Proactive Messages	To proactively send messages to the end-users via the supported channels.
Train ML	To match a given utterance against the NL model to identify possible intents and entities present in the utterance.
Train Faq	To match a given faq against the faq model.
Utterances Import	To import utterances for a task.
Utterances Export	To export utterances for a task.
Logs History	To retrieve the change logs for the particular assistant.
Bot Sessions	Assign this scope to retrieve conversation sessions.
Billing Sessions	Assign this scope to retrieve billing sessions.
Custom Reports	To retrieve the data associated with custom widgets and reports.
RCS Message Events	Assign this scope for opting in users to RCS Business Messaging channel and sending broadcast messages.
Metrics	Assign this scope to retrieve Metrics information related to Intents Found, Intents not Found, Failed Tasks, Successful Tasks and Performance Logs.
Manage Knowledge Graph	To export the complete definition of the Knowledge Graph of this assistant.
NLP Configurations	Assign this scope to update the NLP thresholds and configurations.
Update FAQs	Assign this scope to update the FAQ Responses and FAQ Status.

Note: Once enabled, the API Scopes need to be Published. Follow the Publish procedure ensuring that the API Scopes are selected.

Generating the JWT Token

Once you have associated the API scopes to a client app, you need to generate the JWT token for API requests.

1. You can use the following link to generate the token. Click here.
2. In the Algorithm dropdown list, select HS256.
3. Scroll down to the Decoded section.
   Replace the contents in the Payload box with the Client ID of the app copied in the previous section.
   { 
 "appId": "your-client-id-here"
}
   

   Note: The XO Platform validates the token only when it is generated exactly as “appId”. The Platform doesn’t validate tokens generated with any other formats such as “App ID” “appid” or “app ID”.

4. In the Verify Signature box, for HS256 encoding, enter the Client Secret copied from the previous section in the box with the text your-256-bit-secret.
5. Copy the generated JWT token from the Encoded section on the top or use the Copy JWT button at the bottom.
6. This token can be used to access the required API and it needs to be passed as a part of each API request for authorization.
7. You can use the API Collection to test the APIs from your Postman setup. See here for more.