Update your bot’s knowledge from your own systems.

Authentication

Every bot has a secret API token, shown in the KB API card of its editor. Send it on every request as the X-Mebot-Token header.

curl https://www.drivebird.com/api/mebot/kb/entries \
  -H "X-Mebot-Token: mbk_your_secret_token"

Limits

• • Up to 20 knowledge entries per bot.
• • Up to 2,000 characters per entry description (titles up to 160).
• • 60 requests per minute per client.

Endpoints

{"ok": true, "entries": [{"id": 12, "title": "Opening hours", "description": "Mon–Sat 10am–7pm", "source": "API", "sort_order": 3, "updated_at": "2026-07-20 12:40:00"}]}

{"title": "Price list", "description": "Consultation ₹500. Laser from ₹2,000."}

{"ok": true, "entry": {"id": 13, "title": "Price list", "source": "API", …}}

{"description": "Consultation ₹600. Laser from ₹2,000."}

{"ok": true, "entry": {"id": 13, …}}

{"ok": true}

Errors

Failures return {"ok": false, "error": "…"} with the matching status code.

Lead webhook

Set a webhook URL on your bot and we POST every captured lead to it as JSON. Set the URL in your bot’s editor; the signing secret is shown there too.

Headers

Verifying it

Sign the body exactly as received — before any JSON parsing, and without re-encoding it. Compare with a timing-safe function, never ==.

// PHP
$body      = file_get_contents('php://input');
$expected  = 'sha256=' . hash_hmac('sha256', $body, $yourSigningSecret);
$received  = $_SERVER['HTTP_X_DRIVEBIRD_SIGNATURE'] ?? '';

if (! hash_equals($expected, $received)) {
    http_response_code(401);
    exit;
}

// Node (Express — note express.raw, not express.json)
const expected = 'sha256=' + crypto.createHmac('sha256', secret).update(req.body).digest('hex');

if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(req.get('X-DriveBird-Signature') || ''))) {
    return res.sendStatus(401);
}

Payload

{
  "event": "LEAD-CAPTURED",
  "bot":   { "id": 12, "name": "Clinic Bot", "business_name": "The Clinic" },
  "lead":  {
    "name": "Asha Rao", "email": "asha@example.com", "phone": "+91…",
    "note": null, "asked_for_a_person": false
  },
  "conversation": { "id": 4821, "visitor_ref": "v-abc123", "started_at": "2026-09-15 14:22" }
}

Retries, and why you must dedupe

We allow 8 seconds for a reply. A timeout, a connection failure, a 5xx, a 408 or a 429 is retried — three attempts in all, after 60 seconds and then 5 minutes. Any other 4xx is treated as a refusal and not retried.

That makes delivery at least once, not exactly once: if your endpoint records a lead and then fails to answer in time, we will send that same lead again. Use conversation.id as the key — it is stable across retries — and make your handler ignore an id you have already stored.

More free DriveBird tools

While your bot answers customers, these run free for everyone.