Chatsimple Authentication

generated: '2026-08-13'
method: searched
source: https://docs.expertise.ai/live/integrations/zapier
docs: https://docs.expertise.ai/live/integrations/zapier
note: >-
  NOT DERIVED FROM A SPEC — Chatsimple / Expertise AI publishes no OpenAPI, so
  derive-authentication.py had nothing to read. Everything below was read from
  the provider's own published Zapier integration reference (the only page on
  docs.expertise.ai that documents HTTP endpoints) and from live probes of the
  API host. No scheme was invented.
summary:
  types:
  - apiKey
  api_key_in:
  - header
  oauth2_flows: []
  oauth_supported: false
  oauth_evidence: >-
    api.expertise.ai implements the RFC 8414 / RFC 9728 discovery routes and
    answers them with HTTP 404 and the JSON body {"error":"oauth_not_supported"}
    — an explicit machine-readable statement that this API does not use OAuth.
    scopes/ is therefore correctly skipped for this provider.
schemes:
- name: apiKeyHeader
  type: apiKey
  in: header
  parameter_name: X-API-KEY
  description: >-
    The API key issued by Chatsimple / Expertise AI. Documented on every Zapier
    endpoint. Issued from the authenticated dashboard; the docs do not publish a
    key format or prefix.
  source: https://docs.expertise.ai/live/integrations/zapier
  applies_to:
  - GET https://api.expertise.ai/v0/users/zapier
  - POST https://api.expertise.ai/v0/users/zapier/subscribe
  - DELETE https://api.expertise.ai/v0/users/zapier/unsubscribe
  - GET https://api.expertise.ai/v0/users/zapier/get_leads
tenancy_headers:
- header: X-USER-ID
  required: true
  description: Identifies the Expertise AI account the call acts on behalf of.
- header: X-CHATBOT-ID
  required: true
  description: Identifies the specific agent/chatbot within that account.
- header: X-HTML-SNIPPET
  required: false
  description: >-
    Used only on the connection/login call; the embed snippet is parsed
    server-side to recover user_id and chatbot_id.
- header: X-HOOKURL
  required: false
  description: Target callback URL, sent on the webhook subscribe call.
tenancy_note: >-
  The API key alone does not scope a request. Every documented call also carries
  X-USER-ID and X-CHATBOT-ID, so the effective credential is a triple
  (key + account + agent) rather than a single bearer token. There is no scope,
  permission or role vocabulary published anywhere.
mcp:
  endpoint: https://api.expertise.ai/mcp
  auth: gated
  observed: >-
    Anonymous JSON-RPC initialize and tools/list both return HTTP 401 with
    {"error":{"code":-32001,"message":"Unauthorized"}} and no WWW-Authenticate
    header, so the challenge is not discoverable — a client cannot learn from
    the response how to authenticate.
  documented: false
  documented_note: >-
    The MCP server is not mentioned anywhere in the public documentation, so how
    a caller obtains and presents credentials for it is unpublished.
console:
  dashboard: https://my.expertise.ai
  note: >-
    API keys, the embed snippet and integration credentials are all issued from
    the authenticated dashboard. API access itself is sold on the Enterprise
    tier ("Custom API integration"), per the public pricing page.
gaps:
- No published authentication guide outside the Zapier page.
- No key format, prefix, rotation policy, expiry or revocation procedure published.
- No OAuth, no OIDC, no scopes, no mTLS.
- MCP auth entirely undocumented.