Concepts

Connect your API

Give a bot live access to your own backend — your SaaS, your database, your business logic — without ever handing Bothive your credentials or DB.

The model

Bothive never connects to your database. Instead, your bot calls your API endpoints, and your backend runs the query, enforces your auth, and applies your business rules. The bot is a smart orchestration layer on top of the API you already have.

user asks the bot → bot calls your endpoint (e.g. POST /match) → your backend queries your DB → returns result → bot explains it

This keeps the security boundary where it belongs: your data and rules stay yours.

Three ways to give a bot context

Knowledge base (static)

Upload docs, FAQs, product info as files. The bot retrieves relevant chunks at runtime. Use for things that rarely change.

Request context (per-call)

Pass live data your app already has — the logged-in user, their plan — in the `context` field when you call the bot.

Your API (dynamic)

Connect your backend so the bot can run actions and fetch live data on demand. This page is about this one.

Connecting your API

Go to Connect your API.
Enter your base URL and auth (Bearer token or API key — stored encrypted, per-user).
Add your endpoints — or upload your OpenAPI / Swagger spec and we fill them in automatically.
Hit Connect. Your endpoints become tools named integration.<slug>.<capability>.
In the builder, add those tools to your bot. Now it can call your backend.

Example: a matching assistant

Say your SaaS has a matching algorithm behind POST /match. Connect it as a capability:

@integration my_saas
@name "My SaaS"
@base_url "https://api.yoursaas.com"
@auth type: "bearer"

@capability runMatch(userId)
  @method POST
  @endpoint "/match"
@end

The bot now decides when to call runMatch, hits your API with the user's token, and explains the results — your algorithm and data never leave your servers.

How your credentials are handled

Tokens are encrypted at rest and scoped to your account.
Outbound calls are SSRF-guarded — they can't be redirected to internal or metadata addresses.
Every user connects their own API with their own token; nothing is shared.