First-party app
Superchat

Superchat

Send WhatsApp, SMS, email and social messages, and manage contacts, conversations, notes, templates and webhooks in Superchat.

stable CommunicationCustomer Relationship Management

About

Superchat ships in the w6w first-party pack. It declares 53 actions, 3 health checks, and the host runs its code in a sandbox that never sees the credential.

App id
io.w6w.superchat
Version
0.1.0
Author
w6w
Licence
MIT
Categories
Communication · Customer Relationship Management

Overview

Superchat is a shared inbox for customer messaging — WhatsApp, SMS, email, Instagram, Facebook Messenger, Telegram and a web chat widget in one workspace — and this app drives it from a workflow through one API key.

Its centre is a single Send Message action that works across every connected channel: pass a channel, a recipient (a contact, an E.164 phone number or an email address; an unknown one creates the contact) and a content type — text, media, email, generic or WhatsApp template, quick reply or list. Templates, template folders, files and message delivery analytics are covered, so a workflow can start a WhatsApp conversation with an approved template and later read whether it was delivered, read or clicked.

The rest is the CRM around those messages: create, search, update and delete contacts and custom attributes, manage contact lists, read and update conversations (status, assignee, labels, snooze), keep internal notes, export a conversation, and manage the webhook subscriptions that report inbound messages and contact changes back out. Health checks cover Superchat’s own status page and API reachability; webhook signing secrets are redacted from every read so they do not land in run records.

Build with Superchat

Three routes to the same 53 actions. The Workflow tab is generated from Superchat's own manifest and carries its real ids, so it is copy-pasteable; the Code and CLI examples are the same call for any action on any app, so every app-specific value in them is a blank you fill in.

Get Channel

channel-get

Fetch one channel by ID.

List Channels

channel-list

List channels (the senders you can pass to Send Message), newest first, one cursor page at a time.

Add Contact to List

contact-add-to-list

Add a contact to a contact list.

List Contact's Lists

contact-contact-lists-list

List the contact lists a contact belongs to, newest first, one cursor page at a time.

List Contact Conversations

contact-conversations-list

List a contact's conversations, newest first, one cursor page at a time.

Create Contact

contact-create

Create a contact. At least one email address or phone number (E.164) is required, because the API requires a handle.

Delete Contact

contact-delete

Delete a contact. This cannot be undone.

Get Contact

contact-get

Fetch one contact by ID.

List Contacts

contact-list

List contacts, newest first, one cursor page at a time.

Get Contact List

contact-lists-get

Fetch one contact list by ID.

List Contact Lists

contact-lists-list

List contact lists, newest first, one cursor page at a time.

Remove Contact from List

contact-remove-from-list

Remove a contact from a contact list (the contact itself is kept).

Search Contacts

contact-search

Find contacts by an exact email, phone, Instagram username or custom-attribute value. The API accepts exactly one search expression per call.

Update Contact

contact-update

Update a contact's name, gender, handles or custom attributes. The API's PATCH requires first name, last name and gender on every call (a missing one would be read as a clear), so this action reads the contact first and re-sends the values you did not change.

Delete Conversation

conversation-delete

Delete a conversation. This cannot be undone.

Create Conversation Export

conversation-export-create

Start an export of a conversation over a time range. Poll Get Conversation Export for the download link.

Get Conversation Export

conversation-export-get

Check an export's status; when `done`, `link.url` is a time-limited download URL.

Get Conversation

conversation-get

Fetch one conversation by ID.

List Conversations

conversation-list

List conversations, newest first, one cursor page at a time.

List Conversation Messages

conversation-messages-list

List the messages in a conversation, optionally only one direction or a time window.

Update Conversation

conversation-update

Change a conversation's status, inbox, snooze time, assigned users or labels. Only the fields you set are sent.

Create Custom Attribute

custom-attribute-create

Define a new custom contact attribute (text, number, date, date-time, single-select or multi-select).

Delete Custom Attribute

custom-attribute-delete

Delete a custom attribute. This cannot be undone.

List Custom Attributes

custom-attribute-list

List the custom contact attributes defined in the workspace.

Delete File

file-delete

Delete a file. This cannot be undone.

Get File

file-get

Fetch one file by ID.

List Files

file-list

List uploaded files, newest first, one cursor page at a time.

Get Inbox

inbox-get

Fetch one inbox by ID.

List Inboxes

inbox-list

List inboxes, newest first, one cursor page at a time.

Get Label

label-get

Fetch one label by ID.

List Labels

label-list

List conversation labels, newest first, one cursor page at a time.

Get Current User

me-get

Return the user the API key belongs to and the workspace name.

Get Message Analytics

message-analytics-get

Delivery and engagement timestamps (attempted, delivered, failed, read, clicked, replied) for up to 100 messages.

Get Message

message-get

Fetch one message by ID.

Send Message

message-send

Send a message on one of your channels (WhatsApp, SMS, email, Instagram, Messenger, Telegram) to a contact id, phone number (E.164) or email address. An unknown phone/email creates the contact.

Create Conversation Note

note-create

Add an internal note (never sent to the contact) to a conversation.

Delete Conversation Note

note-delete

Delete a note. This cannot be undone.

List Conversation Notes

note-list

List the internal notes on a conversation.

Update Conversation Note

note-update

Replace a note's content (and attached files, if given).

Get Template Analytics

template-analytics-get

Aggregated send, delivery, read, click and reply counts and rates per template over a period.

Delete Template

template-delete

Delete a template. This cannot be undone.

Create Template Folder

template-folder-create

Create a template folder, optionally nested or tied to a WhatsApp Business Account.

Delete Template Folder

template-folder-delete

Delete a template folder. This cannot be undone.

List Template Folders

template-folder-list

List template folders, newest first, one cursor page at a time.

Get Template

template-get

Fetch one template by ID.

List Templates

template-list

List message templates, newest first, one cursor page at a time.

Get User

user-get

Fetch one user by ID.

List Users

user-list

List workspace users, newest first, one cursor page at a time.

Create Webhook Subscription

webhook-create

Subscribe an HTTPS URL to Superchat events. The response carries the signing `secret` ONCE here; store it now, because every other read of the subscription is redacted by this app.

Delete Webhook Subscription

webhook-delete

Delete a webhook subscription. This cannot be undone.

Get Webhook Subscription

webhook-get

Fetch one webhook subscription. The signing `secret` is redacted.

List Webhook Subscriptions

webhook-list

List webhook subscriptions. The signing `secret` is redacted.

Update Webhook Subscription

webhook-update

Replace a subscription's target URL and/or events (PUT). Events you leave out are not kept: pass the full list you want. The signing `secret` is redacted.

A workflow step names the app and the action, and the editor fills in the connection when you pick one. This is the Step shape from the workflow spec, carrying Superchat's real ids.

{
  "manifestVersion": "2",
  "name": "superchat-example",
  "steps": [
    {
      "id": "channel-get",
      "uses": {
        "app": "io.w6w.superchat",
        "action": "channel-get",
        "connection": "conn_YOUR_CONNECTION_ID"
      },
      "with": {
        "channelId": "<channelId>"
      }
    }
  ]
}

Here are some of the things you can do

  • Get Channel

    read
    channel-get
  • List Channels

    read
    channel-list
  • Add Contact to List

    perform
    contact-add-to-list
  • List Contact's Lists

    read
    contact-contact-lists-list
  • List Contact Conversations

    read
    contact-conversations-list

+48 more actions available

Every app-specific value here is a blank you have to fill in. An app action is reached through the connection that authenticates it, so the address is a connection id, not the app id — and connections belong to your account, so a public page cannot know yours. Create one for Superchat, then fill in the three blanks: conn_YOUR_CONNECTION_ID, the action key, and the parameters that action declares. The call itself is real — the shape is transcribed from the studio's own snippet builder, which prints the same kind of blanks — but nothing in it is specific to Superchat. The Workflow tab is where this app's real ids are.

Install
npm install @w6w/sdk
yarn add @w6w/sdk
pnpm add @w6w/sdk
deno add npm:@w6w/sdk
Code
import { W6wClient, isActionRun } from "@w6w/sdk";

// Reads W6W_BASE_URL and W6W_TOKEN from the environment when omitted.
const client = new W6wClient();

const envelope = await client.run({
  urn: "conn_YOUR_CONNECTION_ID",
  action: "channel-get",
  payload: {
    channelId: "<value>",
  },
});

if (isActionRun(envelope)) console.log(envelope.value);
Install the CLI
npm install -g @w6w/cli
CLI
w6w run conn_YOUR_CONNECTION_ID --action channel-get --payload '{"channelId":"<value>"}'

Give an AI agent Superchat — without giving it Superchat's credentials. One MCP endpoint exposes every app, function and workflow the caller is entitled to, as tools it can discover and run. Access is granted per team while we onboard.

One tool call
{
  "name": "w6w_invoke",
  "arguments": {
    "ref": "app:io.w6w.superchat#channel-get",
    "input": {
      "channelId": "<channelId>"
    }
  }
}

Every tool names its target with a single ref. The app: form above doesn't name a connection at all — the host resolves which of the caller's Superchat connections to sign with, and refuses rather than guesses when the answer is ambiguous.

What the agent gets

Credentials it can't read

The token is attached host-side, at the moment of the call. It is never a tool argument, never in the model's context, and never in a transcript — so a prompt injection has nothing to exfiltrate.

A tool surface scoped to the caller

Tools are derived per end user from what that person has actually connected and is entitled to — not one shared bot identity carrying the union of everyone's access.

A durable workflow in one call

Multi-step work runs on the workflow engine and returns a run handle the agent can poll — retries, branching and state survive the conversation that started them.

Health-aware discovery

Superchat's declared health checks are on the surface too, so an agent can tell "the vendor is down" from "your credential expired" before it burns a retry on either.

The MCP surface is part of the hosted platform. Superchat itself is MIT, and the runtime that executes it is source-available (FSL).

Request MCP access

Health checks

Superchat declares its own checks, so its health is a property of the app rather than something the host guesses at.

service

Superchat platform status

Resource status from status.superchat.de (Better Stack): WebApp, API, Webchat, Worker, Webhook Infrastructure and the review page.

dependency

API reachable

Unauthenticated GET /v1.0/me. The auth layer's empty 401 passes: it proves the API and its gateway are answering. Key validity is the derived `auth:*` check's job.

quota

Rate-limit headroom

Not exposed: the limit is 2500 requests per 5 minutes per workspace, but no header or endpoint reports usage.