Instagram DM, Messenger, WhatsApp, SMS and Telegram behind one integration: 133 REST endpoints, 31 signed webhook events, an MCP server for AI assistants, and a relay mode that hands the conversation to your own backend.
External Reply Mode is on. ChatGenius AI stays quiet.
Your serverWebhook
Event received
message.receivedSigned with X-SumGenius-Signature (HMAC-SHA256)
ChannelInstagram
Messagedo you have the black hoodie in M?
ContactName, tags, stage and custom fields
Your backendREST
Your system checks stock, then replies
POST /v1/messagesSame call for Instagram, Messenger, WhatsApp, SMS and Telegram
ConversationRouted by conversation_id
Idempotency keyA retry can't send it twiceSet
M
maya.rdz
Instagram
do you have the black hoodie in M?
Yes! 3 left in medium. Want me to hold one for you until tonight?
Sent by your backend through ChatGenius
A customer messages you.
Here External Reply Mode is on for this conversation, so ChatGenius's own AI stays quiet and your system decides what to say.
Your server gets a signed event.
message.received lands on your webhook with the channel, the message and the contact's tags, stage and custom fields, signed so you know it came from us.
Your backend replies through the API.
One send call for every channel. Your system checks stock, then answers. An idempotency key means a retry never sends twice.
The customer gets your answer.
In the same Instagram thread, sent through ChatGenius. You own the logic, we handle Meta, Twilio and Telegram.
What you build on.
One integration for five channels, with the same auth, envelope and signing everywhere.
Five channels
Instagram DM, Messenger, WhatsApp, SMS and Telegram share one auth, one envelope and one send endpoint.
REST API v1
Every portal section: contacts, conversations, appointments, flows, comment triggers, approval queue, posts, knowledge base, team and AI settings. OpenAPI 3.1 spec included.
133 endpoints
Webhook events
Messages, comments, leads, appointments, escalations, contact changes, posts and flows, in eight groups.
31 events
MCP server
Use ChatGenius from Claude, ChatGPT, Cursor or any MCP client, hosted or as an npm package.
105 tools
Flows as code
A flow is JSON: trigger, nodes, edges. Validate it, get every error back, then publish.
Custom fields
Typed fields on every contact, with contact.field_changed the moment a value moves.
Built to be relied on.
Signed payloads
HMAC-SHA256 with each endpoint's own secret, verified with the X-SumGenius-Signature header. Secrets rotate with no downtime.
Retries and dead-letter queue
Failed deliveries retry for about 18 hours, then wait in a queue you can replay from the dashboard.
~18 hours
Delivery logs
Every attempt with its response code, timing and endpoint.
Idempotency keys
A retry after a timeout can't produce a second message or a second booking.
Named keys, three endpoints
Revoke one key or pause one endpoint without touching the rest.
Up to 3
Published rate limits
200 requests a minute per account with a 20 a second burst, and RateLimit headers on every response.
200/min
What you can build with it.
Run your own model
Turn on External Reply Mode, answer with your own AI, and keep our Meta, Twilio and Telegram plumbing.
Two-way CRM sync
Every message, comment and lead reaches your webhook with tags, stage and custom fields. Write back over REST.
Order notifications
Your fulfillment system sends a WhatsApp template or an SMS with the tracking link. Nobody types it.
Your inbox in your AI assistant
Ask Claude who asked about pricing this week and never got a reply. It asks before it sends anything.
Five channels through one integration: Instagram DM, Facebook Messenger, WhatsApp Business (via Meta Cloud API), SMS (via Twilio), and Telegram. Same authentication, same idempotency, same HMAC-SHA256 signing secret, and the same response envelope across all five. Inbound events carry a platform identifier, and outbound messages route on conversation_id, platform_user_id, or to_phone.
What can the REST API do?
REST API v1 covers 133 endpoints, every section of the portal. Contacts with upsert, tags and custom fields. Conversations, messages and assignment. Appointments: availability, book, reschedule, cancel. Flows: node catalogue, validate, create, publish, activate, pause, analytics and sessions. Comment triggers with a simulator, and the AI Comment Manager approval queue. Content Studio posts with media, scheduling and publishing. Knowledge base FAQs, services and documents, plus detected knowledge gaps. Team seats and invitations, the AI configuration, blocked users, opt-outs, your webhook endpoints and API keys, and an account endpoint for plan and usage. Cursor pagination and one envelope throughout, and an OpenAPI 3.1 spec at /api/v1/openapi.json. Full reference at /docs/rest-api.
What events are forwarded via webhooks?
Thirty-one event types in eight groups. Messages: message.received, reel and post shares, postbacks, and the per-channel sms, whatsapp and telegram inbound events. Comments: comment.received, comment.trigger_fired, comment.handled. Leads: email and phone captured. Appointments: booked, cancelled, rescheduled. Conversations: escalated, resolved, assigned. Contacts: tag added or removed, stage changed, updated, field changed. Posts: scheduled, published, failed. Flows: published, activated, paused, session completed. And message.send_failed. Every event carries the same envelope with conversation context, contact metadata including tags, stage and custom fields, and the platform identifier. Payloads at /docs/webhook-events.
Can I use more than one API key and more than one endpoint?
Yes to both. Create multiple named API keys and rotate or revoke any one of them independently, so a contractor or a staging integration can be cut off without disturbing production. You can also register up to three webhook endpoints, each with its own signing secret, its own event selection, and its own pause or go-live switch. Delivery is gated per endpoint, so you can bring a new consumer online without touching the one already running.
How is webhook authentication handled?
Every webhook payload is signed with HMAC-SHA256 using that endpoint's signing secret. The signature is sent in the X-SumGenius-Signature header. Your server verifies it by computing HMAC-SHA256 of the raw request body with your secret and comparing the result. Secrets rotate per endpoint without downtime.
What happens if my webhook endpoint is down?
Failed deliveries retry with growing delays over about 18 hours: 5 seconds, 5 minutes, 30 minutes, 2 hours, 5 hours, 10 hours. After the last failure the event lands in a dead-letter queue you can inspect and replay from the dashboard once your endpoint is healthy. Delivery logs show every attempt with its response code and which endpoint it was aimed at. If Inbound Body Purge is enabled, inbound SMS events use exactly one attempt with no retries so the body can be scrubbed inside a tight window.
Can I send WhatsApp templates through the API?
Yes. Send free-form WhatsApp text inside the 24-hour window, or an approved template any time outside it. Pass template_name, template_language such as en_US, and template_components alongside to_phone. Components are passed to the Meta Cloud API verbatim, so any header of text, image, video or PDF, any body variable, and any button parameter defined in your template editor is honored.
Can I send SMS through the API?
Yes, through the same send endpoint by including to_phone in E.164 format. The sending number is server-controlled to your provisioned Twilio number and cannot be overridden, which is what keeps A2P 10DLC campaigns compliant. Each successful outbound call counts as 1 against your monthly SMS quota regardless of how many segments Twilio splits it into. SMS requires Professional or Business tier and a provisioned number.
What is External Reply Mode?
External Reply Mode turns off the ChatGenius AI for a single conversation, one channel, or every channel at once. Inbound messages still reach your webhook, but nothing is generated or sent on our side. Your backend replies through the API instead. This is the setting to use when ChatGenius is the messaging layer and your own system owns the conversation logic.
What is Inbound Body Purge?
A per-account compliance toggle for SMS. When enabled, inbound message bodies are forwarded to your webhook with one delivery attempt and then immediately scrubbed from our storage: the message row, the webhook event log and the SMS queue. Conversations become metadata-only locally, keeping message id, timestamp, sender number, direction, delivery status and ticket reference. Built for healthcare-adjacent and privacy-strict deployments where your server is the system of record. Requires AI off on SMS, since purge clears the same context the AI would reply from.
Are there rate limits?
The authenticated v1 surface allows 200 requests per minute per client with a 20 per second burst, inside a system-wide ceiling of 1000 per minute. A sliding window is used rather than a fixed one, and every response carries RateLimit headers so you can back off before being throttled. Outbound sending also respects each platform's own limits, and idempotency keys prevent duplicate delivery when you retry.
How do I get set up?
In the portal, open the Webhook & Send API section. Create a named API key for authenticating requests, then register an endpoint URL and choose which of the 31 events it should receive. Each endpoint gets its own signing secret. Send a test delivery from the panel before going live, and watch it land in the delivery log. Full reference at /docs/rest-api for endpoints, /docs/webhook-events for payloads, and /docs/mcp for the MCP server.
Can I use ChatGenius from Claude, ChatGPT or another AI assistant?
Yes, and from any other assistant that speaks the Model Context Protocol. Two ways. Hosted: paste https://sumgenius.ai/api/mcp into claude.ai, ChatGPT, Cursor or any client with a custom connector, click Connect, and approve it once in ChatGenius. Local: the chatgenius-mcp npm package runs on your computer with an API key. Either way the assistant gets 105 tools: read and reply to conversations, manage contacts and tags, check availability and book, build and publish flows, approve comment replies, schedule posts, and edit the knowledge base. Tools that reach a person or publish are flagged so the client asks you first, you choose read-only or read-and-act when you connect, and you can disconnect any assistant from Settings. Documented at /docs/mcp.