The main features of the REST API are: creating and removing Chat Rooms, adding/removing users to Chat Rooms and generating and expiring Websocker Server access tokens. The typical flow for those scenarios are shown in the diagram below.

[1] - Client app makes a request to your back end service. Your back end authenticates the user and checks all permissions, per your custom business logic.

[2] - Your back end service makes server-to-server REST API call to the I2A Chat REST API.

[3] - Your back end service receives a JSON response from the I2A Chat REST API.

[4] - Your back end service returns response to the Client App. Again, it's entirely up to you and your app requirements what data you include in the response.

This architecture allows your backend to implement any custom chat-related logic on your end. For example assume you want users under 13 years of age invite to their Chat Rooms only their peers or younger. Or you want only adult users to create chat rooms. Or you want only premium users to be able to create group conversations. For obvious reasons, I2A Chat Service cannot implement all types of such requirements on its end. Your backend is where all that custom checks should happen, as described in step [1].

Your back end service is considered to be the source of truth about users, their permissions etc. it handles all authentication and authorization related logic.

As you may have already noticed, your back end service is also considered to be the source of truth about Chat Rooms and User - Chat Room relations (who's in which Chat Room). Each time you create or remove a new Chat Room or join / kick user from a Chat Room via the REST API your back end service must update that information in its database. So, for example, when a user wants to list all chat rooms they're in, you have that information:

[1] and [2] here are request and response communication between your client and server apps to get a list of Chat Rooms or get information who's in which Chat Room.

What if the Client app wants to know something you don't have? For example, it wants to show the last message written in given Chat Room, wants to know the time of that message, or wants to know how many unread messages user has in given Chat Room? Those type of requests are to be made via the WebSocket.

REST API Root URL:

• Sandbox environment: https://chat-server-stg.i2asolutions.com
• Production environment: TODO

Authentication:

All HTTP calls to the REST API must include a header X-Application-Secret where you pass your App's Secret. Secret is generated automatically when you create a new App in the I2A Chat Management Panel.

IMPORTANT: the App Secret should be known only by your own server. Never put App Secret in the client app. To remind you of that, all REST API paths are prefixed with /server-to-server/ indicating that they shall be called only from your server.