From f9385a31fcda78cbf2ddd179414aa939e488b0ac Mon Sep 17 00:00:00 2001 From: Muhsin Keloth Date: Fri, 5 Jun 2026 11:01:25 +0400 Subject: [PATCH] fix(api): allow agent bots to read conversations and manage labels (#14655) Agent bots assigned to a conversation can now fetch that conversation's details and manage its labels using their bot token. Previously these two operations returned `Access to this endpoint is not authorized for bots`, even though the same token worked for sending messages, updating the conversation, and setting custom attributes. Fixes https://linear.app/chatwoot/issue/PLA-174/agent-bot-tokens-cannot-fetch-conversation-details-or-manage-labels Co-authored-by: Muhsin <12408980+muhsin-k@users.noreply.github.com> Co-authored-by: Claude Opus 4.8 (1M context) --- app/controllers/concerns/access_token_auth_helper.rb | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/app/controllers/concerns/access_token_auth_helper.rb b/app/controllers/concerns/access_token_auth_helper.rb index b7fc14e74..fb52a8eeb 100644 --- a/app/controllers/concerns/access_token_auth_helper.rb +++ b/app/controllers/concerns/access_token_auth_helper.rb @@ -1,8 +1,9 @@ module AccessTokenAuthHelper BOT_ACCESSIBLE_ENDPOINTS = { - 'api/v1/accounts/conversations' => %w[toggle_status toggle_typing_status toggle_priority create update custom_attributes], + 'api/v1/accounts/conversations' => %w[show toggle_status toggle_typing_status toggle_priority create update custom_attributes], 'api/v1/accounts/conversations/messages' => ['create'], - 'api/v1/accounts/conversations/assignments' => ['create'] + 'api/v1/accounts/conversations/assignments' => ['create'], + 'api/v1/accounts/conversations/labels' => %w[index create] }.freeze def ensure_access_token