chore: backfill api_and_webhooks for existing accounts

<img width="2616" height="1716" alt="CleanShot 2026-07-09 at 14 22
42@2x"
src="https://github.com/user-attachments/assets/504e58df-0243-4cb9-a811-62504fdcb0ac"
/>

---------

Co-authored-by: Sivin Varghese <64252451+iamsivin@users.noreply.github.com>
Co-authored-by: Sony Mathew <sony@chatwoot.com>

Gemfile.lock

@@ -1030,7 +1030,7 @@ GEM
       addressable (>= 2.8.0)
       crack (>= 0.3.2)
       hashdiff (>= 0.4.0, < 2.0.0)
-    websocket-driver (0.7.7)
+    websocket-driver (0.8.2)
       base64
       websocket-extensions (>= 0.1.0)
     websocket-extensions (0.1.5)

app/controllers/api/v1/accounts/base_controller.rb

@@ -2,5 +2,12 @@ class Api::V1::Accounts::BaseController < Api::BaseController
   include SwitchLocale
   include EnsureCurrentAccountHelper
   before_action :current_account
+  before_action :validate_token_api_access, if: :authenticate_by_access_token?
   around_action :switch_locale_using_account_locale
+
+  private
+
+  def validate_token_api_access
+    render_unauthorized('Invalid Access Token') unless Current.account.feature_enabled?('api_and_webhooks')
+  end
 end

app/controllers/api/v1/accounts/microsoft/authorizations_controller.rb

@@ -6,7 +6,10 @@ class Api::V1::Accounts::Microsoft::AuthorizationsController < Api::V1::Accounts
       {
         redirect_uri: "#{base_url}/microsoft/callback",
         scope: scope,
-        state: state
+        state: state,
+        # Force the Microsoft account picker so an already-signed-in account does not
+        # silently authorize and re-bind to an existing inbox in the new-inbox flow.
+        prompt: 'select_account'
       }
     )
     if redirect_url

app/controllers/api/v1/accounts/webhooks_controller.rb

@@ -1,4 +1,5 @@
 class Api::V1::Accounts::WebhooksController < Api::V1::Accounts::BaseController
+  before_action :ensure_api_and_webhooks_enabled
   before_action :check_authorization
   before_action :fetch_webhook, only: [:update, :destroy]
 
@@ -22,6 +23,10 @@ class Api::V1::Accounts::WebhooksController < Api::V1::Accounts::BaseController
 
   private
 
+  def ensure_api_and_webhooks_enabled
+    render_unauthorized('You are not authorized to do this action') unless Current.account.feature_enabled?('api_and_webhooks')
+  end
+
   def webhook_params
     params.require(:webhook).permit(:inbox_id, :name, :url, subscriptions: [])
   end

app/controllers/public/api/v1/inboxes/contacts_controller.rb

@@ -18,7 +18,8 @@ class Public::Api::V1::Inboxes::ContactsController < Public::Api::V1::InboxesCon
       contact: @contact_inbox.contact,
       params: permitted_params.to_h.deep_symbolize_keys.except(:identifier)
     )
-    render json: contact_identify_action.perform
+    contact_identify_action.perform
+    @contact_inbox.reload
   end
 
   private

app/javascript/dashboard/api/captain/assistant.js

@@ -37,6 +37,20 @@ class CaptainAssistant extends ApiClient {
       params: { range, timezone_offset: getTimezoneOffset() },
     });
   }
+
+  getDrilldown({ assistantId, metric, range, page, signal }) {
+    const requestConfig = {
+      params: {
+        metric,
+        range,
+        timezone_offset: getTimezoneOffset(),
+        page,
+      },
+    };
+    if (signal) requestConfig.signal = signal;
+
+    return axios.get(`${this.url}/${assistantId}/drilldown`, requestConfig);
+  }
 }
 
 export default new CaptainAssistant();

app/javascript/dashboard/components-next/captain/pageComponents/overview/AssistantDrilldownDrawer.vue

@@ -0,0 +1,234 @@
+<script setup>
+import { computed, nextTick, onBeforeUnmount, ref, watch } from 'vue';
+import { useEventListener } from '@vueuse/core';
+import { useI18n } from 'vue-i18n';
+import CaptainAssistant from 'dashboard/api/captain/assistant';
+import { useReportDrilldown } from 'dashboard/routes/dashboard/settings/reports/composables/useReportDrilldown';
+import ReportDrilldownCard from 'dashboard/routes/dashboard/settings/reports/components/ReportDrilldownCard.vue';
+import Button from 'dashboard/components-next/button/Button.vue';
+import Spinner from 'dashboard/components-next/spinner/Spinner.vue';
+import TeleportWithDirection from 'dashboard/components-next/TeleportWithDirection.vue';
+
+const props = defineProps({
+  open: { type: Boolean, default: false },
+  assistantId: { type: [String, Number], default: null },
+  metric: { type: String, default: '' },
+  metricName: { type: String, default: '' },
+  metricValue: { type: String, default: '' },
+  range: { type: String, default: '' },
+});
+
+const emit = defineEmits(['close']);
+
+const { t } = useI18n();
+const drawerRef = ref(null);
+const {
+  records,
+  meta,
+  isFetching,
+  isFetchingMore,
+  hasError,
+  hasRecords,
+  hasMore,
+  open: openDrilldown,
+  close,
+  loadMore,
+} = useReportDrilldown(params => CaptainAssistant.getDrilldown(params));
+
+let previousActiveElement = null;
+
+const isOpen = computed(() => props.open);
+const title = computed(() => props.metricName || '');
+
+const subtitle = computed(() => {
+  if (!meta.value.conversation_count) return '';
+
+  return t('CAPTAIN.OVERVIEW.DRILLDOWN.RESULT_COUNT_CONVERSATION', {
+    count: meta.value.conversation_count,
+  });
+});
+
+const recordKey = record => `${record.conversation?.id}-${record.occurred_at}`;
+
+const restoreFocus = () => {
+  if (previousActiveElement?.isConnected) {
+    previousActiveElement.focus();
+  }
+  previousActiveElement = null;
+};
+
+const closeDrawer = () => {
+  close();
+  emit('close');
+  restoreFocus();
+};
+
+const rememberActiveElement = () => {
+  if (previousActiveElement) return;
+
+  previousActiveElement =
+    document.activeElement instanceof HTMLElement
+      ? document.activeElement
+      : null;
+};
+
+const focusDrawer = () => {
+  nextTick(() => drawerRef.value?.focus());
+};
+
+const fetchDrilldown = () => {
+  if (!props.metric || !props.assistantId) return;
+
+  openDrilldown({
+    assistantId: props.assistantId,
+    metric: props.metric,
+    range: props.range,
+  });
+};
+
+const onKeydown = event => {
+  if (!isOpen.value) return;
+
+  if (event.key === 'Escape') {
+    event.preventDefault();
+    event.stopPropagation();
+    closeDrawer();
+  }
+};
+
+useEventListener(document, 'keydown', onKeydown);
+
+watch(
+  () => props.open,
+  isDrawerOpen => {
+    if (!isDrawerOpen) {
+      close();
+      restoreFocus();
+      return;
+    }
+
+    rememberActiveElement();
+    fetchDrilldown();
+    focusDrawer();
+  },
+  { immediate: true }
+);
+
+watch(
+  () => [props.metric, props.range],
+  () => {
+    if (props.open) fetchDrilldown();
+  }
+);
+
+// The drawer's headline value is a snapshot of the previous assistant's card,
+// so switching assistants (e.g. browser Back/Forward) closes it instead of
+// refetching records that would no longer match the header.
+watch(
+  () => props.assistantId,
+  () => {
+    if (props.open) closeDrawer();
+  }
+);
+
+onBeforeUnmount(() => {
+  restoreFocus();
+});
+</script>
+
+<template>
+  <TeleportWithDirection to="body">
+    <Transition name="report-drilldown-fade">
+      <div
+        v-if="isOpen"
+        class="fixed inset-0 z-50 bg-black/30"
+        role="presentation"
+        @click.self="closeDrawer"
+      >
+        <aside
+          ref="drawerRef"
+          class="fixed inset-y-0 end-0 flex w-full max-w-xl flex-col bg-n-solid-1 shadow-xl outline outline-1 outline-n-container"
+          role="dialog"
+          aria-modal="true"
+          :aria-label="title"
+          tabindex="-1"
+        >
+          <header
+            class="flex items-start justify-between gap-4 border-b border-n-weak px-6 py-5"
+          >
+            <div class="min-w-0">
+              <h2 class="truncate text-base font-medium text-n-slate-12">
+                {{ title }}
+              </h2>
+              <p
+                v-if="metricValue"
+                class="mt-1 text-xl font-semibold text-n-slate-12"
+              >
+                {{ metricValue }}
+              </p>
+              <div
+                class="text-sm text-n-slate-11"
+                :class="{
+                  'mt-2': metricValue,
+                  'mt-1': !metricValue,
+                }"
+              >
+                {{ subtitle }}
+              </div>
+            </div>
+            <Button
+              ghost
+              slate
+              size="sm"
+              icon="i-ph-x"
+              :aria-label="$t('CAPTAIN.OVERVIEW.DRILLDOWN.CLOSE')"
+              @click="closeDrawer"
+            />
+          </header>
+
+          <div class="min-h-0 flex-1 overflow-y-auto px-5 py-3">
+            <div
+              v-if="isFetching"
+              class="flex h-40 items-center justify-center"
+            >
+              <Spinner />
+            </div>
+
+            <div
+              v-else-if="hasError"
+              class="flex h-40 items-center justify-center text-sm text-n-ruby-11"
+            >
+              {{ $t('CAPTAIN.OVERVIEW.DRILLDOWN.ERROR') }}
+            </div>
+
+            <div
+              v-else-if="!hasRecords"
+              class="flex h-40 items-center justify-center text-sm text-n-slate-10"
+            >
+              {{ $t('CAPTAIN.OVERVIEW.DRILLDOWN.EMPTY') }}
+            </div>
+
+            <div v-else class="flex flex-col gap-2">
+              <ReportDrilldownCard
+                v-for="record in records"
+                :key="recordKey(record)"
+                :record="record"
+              />
+
+              <Button
+                v-if="hasMore"
+                faded
+                slate
+                size="sm"
+                class="mx-auto mt-2"
+                :label="$t('CAPTAIN.OVERVIEW.DRILLDOWN.LOAD_MORE')"
+                :is-loading="isFetchingMore"
+                @click="loadMore"
+              />
+            </div>
+          </div>
+        </aside>
+      </div>
+    </Transition>
+  </TeleportWithDirection>
+</template>

app/javascript/dashboard/components-next/captain/pageComponents/overview/MetricCard.vue

@@ -8,16 +8,35 @@ const props = defineProps({
   hint: { type: String, default: '' },
   // null = neutral, true = good direction, false = bad direction
   trendGood: { type: Boolean, default: null },
+  clickable: { type: Boolean, default: false },
 });
 
+const emit = defineEmits(['click']);
+
 const trendClass = computed(() => {
   if (props.trendGood === null) return 'text-n-slate-11';
   return props.trendGood ? 'text-n-teal-11' : 'text-n-ruby-11';
 });
+
+const onActivate = () => {
+  if (props.clickable) emit('click');
+};
 </script>
 
 <template>
-  <div class="flex flex-col gap-3 p-5 group bg-n-solid-1">
+  <div
+    class="flex flex-col gap-3 p-5 group bg-n-solid-1"
+    :class="
+      clickable
+        ? 'cursor-pointer transition-colors hover:bg-n-slate-2/50 focus-visible:outline focus-visible:outline-2 focus-visible:outline-n-brand'
+        : ''
+    "
+    :role="clickable ? 'button' : undefined"
+    :tabindex="clickable ? 0 : undefined"
+    @click="onActivate"
+    @keydown.enter.self.prevent="onActivate"
+    @keydown.space.self.prevent="onActivate"
+  >
     <div class="flex items-center gap-1.5">
       <span class="text-sm font-medium text-n-slate-11">{{ label }}</span>
       <span

app/javascript/dashboard/components/widgets/ChannelItem.vue

@@ -1,7 +1,7 @@
 <script setup>
 import { computed } from 'vue';
 import ChannelSelector from '../ChannelSelector.vue';
-import { IS_WHATSAPP_INBOX_CREATION_DISABLED } from 'dashboard/constants/globals';
+import { IS_INSTAGRAM_WHATSAPP_INBOX_CREATION_DISABLED } from 'dashboard/constants/globals';
 
 const props = defineProps({
   channel: {
@@ -21,7 +21,10 @@ const hasFbConfigured = computed(() => {
 });
 
 const hasInstagramConfigured = computed(() => {
-  return window.chatwootConfig?.instagramAppId;
+  return (
+    !IS_INSTAGRAM_WHATSAPP_INBOX_CREATION_DISABLED &&
+    window.chatwootConfig?.instagramAppId
+  );
 });
 
 const hasTiktokConfigured = computed(() => {
@@ -59,7 +62,7 @@ const isActive = computed(() => {
 
   if (key === 'whatsapp_call') {
     return (
-      !IS_WHATSAPP_INBOX_CREATION_DISABLED &&
+      !IS_INSTAGRAM_WHATSAPP_INBOX_CREATION_DISABLED &&
       props.enabledFeatures.channel_voice &&
       !!window.chatwootConfig?.whatsappAppId &&
       window.chatwootConfig.whatsappAppId !== 'none'

app/javascript/dashboard/constants/globals.js

@@ -79,6 +79,7 @@ export default {
 };
 export const DEFAULT_REDIRECT_URL = '/app/';
 
-// Temporarily disables WhatsApp embedded signup and WhatsApp Call inbox
-// creation. Flip to false when the channel is brought back.
-export const IS_WHATSAPP_INBOX_CREATION_DISABLED = true;
+// Temporarily disables Instagram and WhatsApp inbox creation
+// (WhatsApp embedded signup popup, Instagram OAuth, WhatsApp Call).
+// Flip to false when the channels are brought back.
+export const IS_INSTAGRAM_WHATSAPP_INBOX_CREATION_DISABLED = true;

app/javascript/dashboard/i18n/locale/en/integrations.json

@@ -439,6 +439,13 @@
           "HINT": "Average replies the assistant sends per conversation."
         }
       },
+      "DRILLDOWN": {
+        "CLOSE": "Close details",
+        "EMPTY": "No records found for this metric.",
+        "ERROR": "Could not load records. Please try again.",
+        "LOAD_MORE": "Load more",
+        "RESULT_COUNT_CONVERSATION": "{count} conversation | {count} conversations"
+      },
       "KNOWLEDGE": {
         "TITLE": "Knowledge coverage",
         "COVERAGE": "{pct}% approved",
@@ -446,17 +453,6 @@
         "PENDING": "Pending FAQs",
         "DOCUMENTS": "Documents"
       },
-      "FLAGGED": {
-        "TITLE": "Response quality",
-        "TOTAL": "{count} flagged · {rate}"
-      },
-      "CREDITS": {
-        "TITLE": "Credit usage",
-        "UNIT": "credits",
-        "LEGEND": "Daily credits used",
-        "AXIS_START": "{count}d ago",
-        "AXIS_END": "Today"
-      },
       "LINKS": {
         "DOCS": {
           "TITLE": "Captain docs",
@@ -470,13 +466,6 @@
           "TITLE": "Billing",
           "DESCRIPTION": "Manage credits and plan"
         }
-      },
-      "FLAG_REASONS": {
-        "INCORRECT": "Incorrect info",
-        "INCOMPLETE": "Incomplete",
-        "OUTDATED": "Outdated",
-        "INAPPROPRIATE": "Inappropriate",
-        "OTHER": "Other"
       }
     },
     "ASSISTANT_SWITCHER": {

app/javascript/dashboard/i18n/locale/en/settings.json

@@ -263,7 +263,7 @@
     "EMAIL_VERIFICATION_SENT": "Verification email has been sent. Please check your inbox.",
     "ACCOUNT_SUSPENDED": {
       "TITLE": "Account Suspended",
-      "MESSAGE": "Your account is suspended. Please reach out to the support team for more information."
+      "MESSAGE": "Your account has been suspended after we detected activity that may violate our policies or put other users at risk. If you believe this is a mistake, please contact our support team."
     },
     "NO_ACCOUNTS": {
       "TITLE": "No account found",

app/javascript/dashboard/routes/dashboard/captain/assistants/overview/Index.vue

@@ -3,6 +3,7 @@ import { computed, ref, watch } from 'vue';
 import { useI18n } from 'vue-i18n';
 import { useRoute } from 'vue-router';
 import { FEATURE_FLAGS } from 'dashboard/featureFlags';
+import { usePolicy } from 'dashboard/composables/usePolicy';
 import CaptainAssistant from 'dashboard/api/captain/assistant';
 
 import PageLayout from 'dashboard/components-next/captain/PageLayout.vue';
@@ -10,6 +11,7 @@ import CaptainPaywall from 'dashboard/components-next/captain/pageComponents/Pay
 import RangeSelector from 'dashboard/components-next/captain/pageComponents/overview/RangeSelector.vue';
 import WelcomeCard from 'dashboard/components-next/captain/pageComponents/overview/WelcomeCard.vue';
 import MetricCard from 'dashboard/components-next/captain/pageComponents/overview/MetricCard.vue';
+import AssistantDrilldownDrawer from 'dashboard/components-next/captain/pageComponents/overview/AssistantDrilldownDrawer.vue';
 import KnowledgeCard from 'dashboard/components-next/captain/pageComponents/overview/KnowledgeCard.vue';
 import QuickLinks from 'dashboard/components-next/captain/pageComponents/overview/QuickLinks.vue';
 import InboxBanner from 'dashboard/components-next/captain/pageComponents/overview/InboxBanner.vue';
@@ -17,6 +19,9 @@ import CoverageBanner from 'dashboard/components-next/captain/pageComponents/ove
 
 const { t } = useI18n();
 const route = useRoute();
+// Drilldown is admin-only; the backend policy enforces the same restriction.
+const { checkPermissions } = usePolicy();
+const canDrilldown = computed(() => checkPermissions(['administrator']));
 
 const selectedRange = ref('this_month');
 
@@ -69,34 +74,38 @@ const metricFor = (statKey, formatValue, direction, trendKind = 'percent') => {
 const metrics = computed(() => [
   {
     key: 'handled',
+    metric: 'conversations_handled',
     label: t('CAPTAIN.OVERVIEW.METRICS.HANDLED.LABEL'),
     hint: t('CAPTAIN.OVERVIEW.METRICS.HANDLED.HINT'),
     ...metricFor('conversations_handled', v => v.toLocaleString(), 'up'),
   },
   {
     key: 'autoResolution',
+    metric: 'auto_resolution_rate',
     label: t('CAPTAIN.OVERVIEW.METRICS.AUTO_RESOLUTION.LABEL'),
     hint: t('CAPTAIN.OVERVIEW.METRICS.AUTO_RESOLUTION.HINT'),
     ...metricFor('auto_resolution_rate', v => `${v}%`, 'up', 'point'),
   },
   {
     key: 'handoff',
+    metric: 'handoff_rate',
     label: t('CAPTAIN.OVERVIEW.METRICS.HANDOFF.LABEL'),
     hint: t('CAPTAIN.OVERVIEW.METRICS.HANDOFF.HINT'),
     ...metricFor('handoff_rate', v => `${v}%`, 'down', 'point'),
   },
+  {
+    key: 'reopen',
+    metric: 'reopen_rate',
+    label: t('CAPTAIN.OVERVIEW.METRICS.REOPEN.LABEL'),
+    hint: t('CAPTAIN.OVERVIEW.METRICS.REOPEN.HINT'),
+    ...metricFor('reopen_rate', v => `${v}%`, 'down', 'point'),
+  },
   {
     key: 'hoursSaved',
     label: t('CAPTAIN.OVERVIEW.METRICS.HOURS_SAVED.LABEL'),
     hint: t('CAPTAIN.OVERVIEW.METRICS.HOURS_SAVED.HINT'),
     ...metricFor('hours_saved', formatDuration, 'up'),
   },
-  {
-    key: 'reopen',
-    label: t('CAPTAIN.OVERVIEW.METRICS.REOPEN.LABEL'),
-    hint: t('CAPTAIN.OVERVIEW.METRICS.REOPEN.HINT'),
-    ...metricFor('reopen_rate', v => `${v}%`, 'down', 'point'),
-  },
   {
     key: 'depth',
     label: t('CAPTAIN.OVERVIEW.METRICS.DEPTH.LABEL'),
@@ -109,6 +118,22 @@ const metrics = computed(() => [
     ),
   },
 ]);
+
+const drilldown = ref({ metric: '', label: '', value: '' });
+const isDrilldownOpen = ref(false);
+
+const openDrilldown = metric => {
+  drilldown.value = {
+    metric: metric.metric,
+    label: metric.label,
+    value: metric.value,
+  };
+  isDrilldownOpen.value = true;
+};
+
+const closeDrilldown = () => {
+  isDrilldownOpen.value = false;
+};
 </script>
 
 <template>
@@ -144,6 +169,8 @@ const metrics = computed(() => [
             :trend="metric.trend"
             :hint="metric.hint"
             :trend-good="metric.trendGood"
+            :clickable="canDrilldown && Boolean(metric.metric)"
+            @click="openDrilldown(metric)"
           />
         </div>
 
@@ -151,6 +178,17 @@ const metrics = computed(() => [
 
         <QuickLinks />
       </div>
+
+      <AssistantDrilldownDrawer
+        v-if="canDrilldown"
+        :open="isDrilldownOpen"
+        :assistant-id="assistantId"
+        :metric="drilldown.metric"
+        :metric-name="drilldown.label"
+        :metric-value="drilldown.value"
+        :range="selectedRange"
+        @close="closeDrilldown"
+      />
     </template>
   </PageLayout>
 </template>

app/javascript/dashboard/routes/dashboard/onboarding/inbox-setup/useChannelConfig.js

@@ -1,5 +1,5 @@
 import { useMapGetter } from 'dashboard/composables/store';
-import { IS_WHATSAPP_INBOX_CREATION_DISABLED } from 'dashboard/constants/globals';
+import { IS_INSTAGRAM_WHATSAPP_INBOX_CREATION_DISABLED } from 'dashboard/constants/globals';
 
 // OAuth/SDK channels need installation-level app credentials to be usable. When
 // the credential is missing the channel is "not configured" and is hidden from
@@ -14,12 +14,14 @@ export function useChannelConfig() {
     // WhatsApp is onboarded only via Meta embedded signup, which needs both the
     // app id (not the 'none' sentinel) and the signup configuration id.
     whatsapp: () =>
-      !IS_WHATSAPP_INBOX_CREATION_DISABLED &&
+      !IS_INSTAGRAM_WHATSAPP_INBOX_CREATION_DISABLED &&
       Boolean(installationConfig.whatsappAppId) &&
       installationConfig.whatsappAppId !== 'none' &&
       Boolean(installationConfig.whatsappConfigurationId),
     facebook: () => Boolean(installationConfig.fbAppId),
-    instagram: () => Boolean(installationConfig.instagramAppId),
+    instagram: () =>
+      !IS_INSTAGRAM_WHATSAPP_INBOX_CREATION_DISABLED &&
+      Boolean(installationConfig.instagramAppId),
     tiktok: () => Boolean(installationConfig.tiktokAppId),
     gmail: () => Boolean(installationConfig.googleOAuthClientId),
     outlook: () => Boolean(globalConfig.value.azureAppId),

app/javascript/dashboard/routes/dashboard/onboarding/specs/inbox-setup/useDetectedChannels.spec.js

@@ -6,11 +6,11 @@ import { useDetectedChannels } from '../../inbox-setup/useDetectedChannels';
 
 vi.mock('vue-router');
 
-// Neutralize the temporary WhatsApp kill switch so these specs keep covering
-// the credential-based gating it short-circuits.
+// Neutralize the temporary Instagram/WhatsApp kill switch so these specs keep
+// covering the credential-based gating it currently short-circuits.
 vi.mock('dashboard/constants/globals', async importOriginal => ({
   ...(await importOriginal()),
-  IS_WHATSAPP_INBOX_CREATION_DISABLED: false,
+  IS_INSTAGRAM_WHATSAPP_INBOX_CREATION_DISABLED: false,
 }));
 
 // Mounts the composable against a real store and the real useAccount (only

app/javascript/dashboard/routes/dashboard/settings/inbox/channels/Whatsapp.vue

@@ -7,7 +7,7 @@ import ThreeSixtyDialogWhatsapp from './360DialogWhatsapp.vue';
 import CloudWhatsapp from './CloudWhatsapp.vue';
 import WhatsappEmbeddedSignup from './WhatsappEmbeddedSignup.vue';
 import ChannelSelector from 'dashboard/components/ChannelSelector.vue';
-import { IS_WHATSAPP_INBOX_CREATION_DISABLED } from 'dashboard/constants/globals';
+import { IS_INSTAGRAM_WHATSAPP_INBOX_CREATION_DISABLED } from 'dashboard/constants/globals';
 
 const route = useRoute();
 const router = useRouter();
@@ -24,7 +24,7 @@ const PROVIDER_TYPES = {
 
 const hasWhatsappAppId = computed(() => {
   return (
-    !IS_WHATSAPP_INBOX_CREATION_DISABLED &&
+    !IS_INSTAGRAM_WHATSAPP_INBOX_CREATION_DISABLED &&
     window.chatwootConfig?.whatsappAppId &&
     window.chatwootConfig.whatsappAppId !== 'none'
   );

app/javascript/dashboard/routes/dashboard/settings/reports/composables/useReportDrilldown.js

@@ -1,7 +1,13 @@
 import { computed, ref } from 'vue';
 import ReportsAPI from 'dashboard/api/reports';
 
-export function useReportDrilldown() {
+// `fetcher` is any `({ ...request, page, signal }) => Promise` returning the
+// shared drilldown envelope (`{ data: { meta, payload } }`), so the same paging
+// and abort machinery backs both the reports and Captain assistant drilldowns.
+// The default is wrapped so `ReportsAPI` stays the receiver when invoked.
+export function useReportDrilldown(
+  fetcher = params => ReportsAPI.getDrilldown(params)
+) {
   const activeRequest = ref(null);
   const records = ref([]);
   const meta = ref({});
@@ -20,17 +26,7 @@ export function useReportDrilldown() {
   const isCurrentRequest = token =>
     token === requestToken && !!activeRequest.value;
 
-  const requestFingerprint = request =>
-    JSON.stringify({
-      metric: request.metric,
-      bucketTimestamp: request.bucketTimestamp,
-      from: request.from,
-      to: request.to,
-      type: request.type,
-      id: request.id,
-      groupBy: request.groupBy,
-      businessHours: request.businessHours,
-    });
+  const requestFingerprint = request => JSON.stringify(request);
 
   const abortActiveRequest = () => {
     if (!activeRequestController) return;
@@ -55,7 +51,7 @@ export function useReportDrilldown() {
     hasError.value = false;
 
     try {
-      const response = await ReportsAPI.getDrilldown({
+      const response = await fetcher({
         ...request,
         page,
         signal: controller.signal,

app/listeners/webhook_listener.rb

@@ -108,6 +108,8 @@ class WebhookListener < BaseListener
   end
 
   def deliver_account_webhooks(payload, account)
+    return unless account.feature_enabled?('api_and_webhooks')
+
     account.webhooks.account_type.each do |webhook|
       next unless webhook.subscriptions.include?(payload[:event])
 

config/features.yml

@@ -249,3 +249,7 @@
   display_name: Advanced Assignment
   enabled: false
   premium: true
+- name: api_and_webhooks
+  display_name: API and Webhooks
+  enabled: true
+  column: feature_flags_ext_1

db/migrate/20260709000000_enable_api_and_webhooks_for_existing_accounts.rb

@@ -0,0 +1,12 @@
+# Enable api_and_webhooks for existing accounts.
+# Like 20260120121402_enable_captain_tasks_for_existing_accounts.rb, we don't need
+# to update ACCOUNT_LEVEL_FEATURE_DEFAULTS or clear GlobalConfig cache because
+# api_and_webhooks has `enabled: true` in features.yml - ConfigLoader handles the
+# defaults on deploy automatically.
+class EnableApiAndWebhooksForExistingAccounts < ActiveRecord::Migration[7.0]
+  def up
+    Account.find_in_batches(batch_size: 100) do |accounts|
+      accounts.each { |account| account.enable_features!('api_and_webhooks') }
+    end
+  end
+end

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[7.1].define(version: 2026_07_06_215758) do
+ActiveRecord::Schema[7.1].define(version: 2026_07_09_000000) do
   # These extensions should be enabled to support this database
   enable_extension "pg_stat_statements"
   enable_extension "pg_trgm"

enterprise/app/builders/captain/assistant_drilldown_builder.rb

@@ -1,6 +1,6 @@
 # Lists the underlying records behind a single Captain assistant stat card, so a
 # viewer can drill from an aggregate (e.g. "auto-resolution 42%") into the exact
-# conversations or messages that produced it.
+# conversations that produced it.
 #
 # The window is resolved by Captain::AssistantStatsWindow from the same `range`
 # and `timezone_offset` the stat card used, so the drilldown covers precisely the
@@ -11,10 +11,8 @@ class Captain::AssistantDrilldownBuilder
   RESOLVED_EVENT_NAMES = Captain::AssistantStatsBuilder::RESOLVED_EVENT_NAMES
   HANDOFF_EVENT_NAMES = Captain::AssistantStatsBuilder::HANDOFF_EVENT_NAMES
 
-  # Metrics whose records are individual messages rather than conversations.
-  MESSAGE_METRICS = %w[hours_saved].freeze
   SUPPORTED_METRICS = %w[
-    conversations_handled auto_resolution_rate handoff_rate hours_saved reopen_rate conversation_depth
+    conversations_handled auto_resolution_rate handoff_rate reopen_rate
   ].freeze
 
   DEFAULT_PAGE = 1
@@ -43,21 +41,14 @@ class Captain::AssistantDrilldownBuilder
   def meta
     {
       metric: metric,
-      record_type: record_type,
       current_page: current_page,
       per_page: per_page,
       total_count: paginated_records.total_count,
-      conversation_count: conversation_count,
+      conversation_count: paginated_records.total_count,
       range: { since: range.first.to_i, until: range.last.to_i }
     }
   end
 
-  def conversation_count
-    return paginated_records.total_count unless message_metric?
-
-    drilldown_scope.except(:includes).reorder(nil).distinct.count(:conversation_id)
-  end
-
   def paginated_records
     @paginated_records ||= drilldown_scope.page(current_page).per(per_page)
   end
@@ -67,9 +58,7 @@ class Captain::AssistantDrilldownBuilder
     when 'conversations_handled' then handled_conversations
     when 'auto_resolution_rate' then conversations_for(resolved_events.select(:conversation_id))
     when 'handoff_rate' then event_conversations(HANDOFF_EVENT_NAMES)
-    when 'hours_saved' then public_reply_messages
     when 'reopen_rate' then reopened_conversations
-    when 'conversation_depth' then depth_conversations
     else
       raise ArgumentError, "Unsupported assistant drilldown metric: #{metric}"
     end
@@ -88,13 +77,6 @@ class Captain::AssistantDrilldownBuilder
     conversations_for(handled_conversation_ids)
   end
 
-  # Public agent-facing replies the assistant sent; the rows behind hours_saved.
-  def public_reply_messages
-    handled_messages.where(message_type: :outgoing, private: false)
-                    .includes(:sender, conversation: [:assignee, :contact, :inbox])
-                    .reorder(created_at: :desc)
-  end
-
   # Conversations in the handled cohort that recorded one of the given reporting
   # events in the window (resolved or handed-off).
   def event_conversations(event_names)
@@ -129,11 +111,6 @@ class Captain::AssistantDrilldownBuilder
     conversations_for(ids)
   end
 
-  # Conversations the assistant sent at least one public reply in; the denominator behind conversation_depth.
-  def depth_conversations
-    conversations_for(handled_messages.where(message_type: :outgoing, private: false).select(:conversation_id))
-  end
-
   def conversations_for(conversation_ids)
     account.conversations
            .where(id: conversation_ids)
@@ -147,10 +124,6 @@ class Captain::AssistantDrilldownBuilder
 
   def metric = params[:metric].to_s
 
-  def message_metric? = MESSAGE_METRICS.include?(metric)
-
-  def record_type = message_metric? ? 'message' : 'conversation'
-
   def current_page = [params[:page].to_i, DEFAULT_PAGE].max
 
   def per_page

enterprise/app/services/enterprise/billing/reconcile_plan_features_service.rb

@@ -37,8 +37,10 @@ class Enterprise::Billing::ReconcilePlanFeaturesService
   def perform
     account.disable_features(*PREMIUM_PLAN_FEATURES)
     account.disable_features('captain_integration_v2') if default_plan?
+    account.disable_features('api_and_webhooks')
     account.enable_features(*current_plan_features)
     account.enable_features('captain_integration_v2') if captain_v2_default_eligible?
+    account.enable_features('api_and_webhooks') if api_and_webhooks_eligible?
     account.enable_features(*manually_managed_features)
     account.save!
   end
@@ -56,6 +58,10 @@ class Enterprise::Billing::ReconcilePlanFeaturesService
     end
   end
 
+  def api_and_webhooks_eligible?
+    !default_plan? && account.custom_attributes['subscription_status'] == 'active'
+  end
+
   def default_plan?
     default_plan_name = cloud_plans.first&.dig('name')
     return false if default_plan_name.blank?

enterprise/app/services/internal/accounts/internal_attributes_service.rb

@@ -54,7 +54,7 @@ class Internal::Accounts::InternalAttributesService
   def valid_feature_list
     Enterprise::Billing::ReconcilePlanFeaturesService::BUSINESS_PLAN_FEATURES +
       Enterprise::Billing::ReconcilePlanFeaturesService::ENTERPRISE_PLAN_FEATURES +
-      %w[inbound_emails]
+      %w[inbound_emails api_and_webhooks]
   end
 
   # Account notes functionality removed for now

lib/tasks/api_and_webhooks_migration.rake

@@ -0,0 +1,59 @@
+# Grandfather api_and_webhooks for existing accounts (cloud only).
+#
+# Adds api_and_webhooks to each account's manually_managed_features internal
+# attribute so per-account billing reconciles never strip the feature from
+# accounts that existed before the flag was introduced. Idempotent.
+#
+# Usage Examples:
+#   # Grandfather a single account
+#   ACCOUNT_ID=1 bundle exec rake api_and_webhooks:grandfather
+#
+#   # Grandfather all accounts in the installation
+#   bundle exec rake api_and_webhooks:grandfather
+# rubocop:disable Metrics/BlockLength
+namespace :api_and_webhooks do
+  desc 'Grandfather api_and_webhooks via manually_managed_features for existing accounts'
+  task grandfather: :environment do
+    abort 'Aborted. This task requires the enterprise edition.' unless ChatwootApp.enterprise?
+
+    account_id = ENV.fetch('ACCOUNT_ID', nil)
+    accounts = account_id.present? ? Account.where(id: account_id) : Account.all
+
+    if account_id.blank?
+      print 'No ACCOUNT_ID specified. This will grandfather ALL accounts. Continue? [y/N] '
+      abort 'Aborted.' unless $stdin.gets.chomp.casecmp('y').zero?
+    end
+
+    if account_id.present? && accounts.empty?
+      puts "Error: Account with ID #{account_id} not found"
+      exit(1)
+    end
+
+    total = accounts.count
+    puts "Grandfathering api_and_webhooks for #{total} account(s)..."
+
+    updated = 0
+    skipped = 0
+    errored = 0
+
+    accounts.find_each do |account|
+      service = Internal::Accounts::InternalAttributesService.new(account)
+      features = service.manually_managed_features
+
+      if features.include?('api_and_webhooks')
+        skipped += 1
+        next
+      end
+
+      service.manually_managed_features = features + ['api_and_webhooks']
+      account.enable_features!('api_and_webhooks')
+      updated += 1
+    rescue StandardError => e
+      errored += 1
+      puts "  Account #{account.id} — error: #{e.message}"
+    end
+
+    puts "Done! Updated: #{updated}, Skipped: #{skipped}, Errored: #{errored}, Total: #{total}"
+  end
+end
+# rubocop:enable Metrics/BlockLength

spec/controllers/api/base_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 RSpec.describe 'API Base', type: :request do
-  let!(:account) { create(:account) }
+  let!(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
   let!(:user) { create(:user, account: account) }
 
   describe 'request with api_access_token for user' do
@@ -23,6 +23,32 @@ RSpec.describe 'API Base', type: :request do
       end
     end
 
+    context 'when the account does not have the api_and_webhooks feature' do
+      let!(:admin) { create(:user, :administrator, account: account) }
+      let!(:conversation) { create(:conversation, account: account) }
+
+      before do
+        account.disable_features!('api_and_webhooks')
+      end
+
+      it 'returns unauthorized for token authenticated requests' do
+        get "/api/v1/accounts/#{account.id}/conversations/#{conversation.display_id}",
+            headers: { api_access_token: admin.access_token.token },
+            as: :json
+
+        expect(response).to have_http_status(:unauthorized)
+        expect(response.parsed_body['error']).to eq('Invalid Access Token')
+      end
+
+      it 'allows session authenticated requests' do
+        get "/api/v1/accounts/#{account.id}/conversations/#{conversation.display_id}",
+            headers: admin.create_new_auth_token,
+            as: :json
+
+        expect(response).to have_http_status(:success)
+      end
+    end
+
     context 'when it is an invalid api_access_token' do
       it 'returns unauthorized' do
         get '/api/v1/profile',
@@ -94,6 +120,19 @@ RSpec.describe 'API Base', type: :request do
       end
     end
 
+    context 'when the account does not have the api_and_webhooks feature' do
+      it 'returns unauthorized for accessible bot endpoints' do
+        create(:agent_bot_inbox, inbox: inbox, agent_bot: agent_bot)
+        account.disable_features!('api_and_webhooks')
+
+        post "/api/v1/accounts/#{account.id}/conversations/#{conversation.display_id}/toggle_status",
+             headers: { api_access_token: agent_bot.access_token.token },
+             as: :json
+
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
+
     context 'when the account is suspended' do
       it 'returns 401 unauthorized' do
         account.update!(status: :suspended)

spec/controllers/api/v1/accounts/conversations/assignments_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 RSpec.describe 'Conversation Assignment API', type: :request do
-  let(:account) { create(:account) }
+  let(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
 
   describe 'POST /api/v1/accounts/{account.id}/conversations/<id>/assignments' do
     let(:conversation) { create(:conversation, account: account) }

spec/controllers/api/v1/accounts/conversations/messages_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 RSpec.describe 'Conversation Messages API', type: :request do
-  let!(:account) { create(:account) }
+  let!(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
 
   describe 'POST /api/v1/accounts/{account.id}/conversations/<id>/messages' do
     let!(:inbox) { create(:inbox, account: account) }

spec/controllers/api/v1/accounts/conversations_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 RSpec.describe 'Conversations API', type: :request do
-  let(:account) { create(:account) }
+  let(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
 
   describe 'GET /api/v1/accounts/{account.id}/conversations' do
     context 'when it is an unauthenticated user' do

spec/controllers/api/v1/accounts/microsoft/authorization_controller_spec.rb

@@ -43,7 +43,7 @@ RSpec.describe 'Microsoft Authorization API', type: :request do
         ]
         expect(params['scope']).to eq(expected_scope)
         expect(params['redirect_uri']).to eq(["#{ENV.fetch('FRONTEND_URL', 'http://localhost:3000')}/microsoft/callback"])
-        expect(url).not_to match(/(?:\?|&)prompt=/)
+        expect(params['prompt']).to eq(['select_account'])
 
         # Validate state parameter exists and can be decoded back to the account
         expect(params['state']).to be_present

spec/controllers/api/v1/accounts/webhook_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 RSpec.describe 'Webhooks API', type: :request do
-  let(:account) { create(:account) }
+  let(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
   let(:inbox) { create(:inbox, account: account) }
   let(:webhook) { create(:webhook, account: account, inbox: inbox, url: 'https://hello.com', name: 'My Webhook') }
   let(:administrator) { create(:user, account: account, role: :administrator) }
@@ -26,6 +26,16 @@ RSpec.describe 'Webhooks API', type: :request do
         expect(response.parsed_body['payload']['webhooks'].count).to eql account.webhooks.count
       end
     end
+
+    context 'when api_and_webhooks feature is disabled' do
+      it 'returns unauthorized even for an admin' do
+        account.disable_features!('api_and_webhooks')
+        get "/api/v1/accounts/#{account.id}/webhooks",
+            headers: administrator.create_new_auth_token,
+            as: :json
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
   end
 
   describe 'POST /api/v1/accounts/<account_id>/webhooks' do

spec/controllers/public/api/v1/inbox/contacts_controller_spec.rb

@@ -47,5 +47,17 @@ RSpec.describe 'Public Inbox Contacts API', type: :request do
       data = response.parsed_body
       expect(data['name']).to eq 'John Smith'
     end
+
+    it 'does not expose internal contact columns' do
+      contact.update!(identifier: 'contact-identifier', custom_attributes: { tier: 'vip' }, additional_attributes: { company_name: 'Acme' })
+
+      patch "/public/api/v1/inboxes/#{api_channel.identifier}/contacts/#{contact_inbox.source_id}",
+            params: { name: 'John Smith' }
+
+      expect(response).to have_http_status(:success)
+      data = response.parsed_body
+      expect(data.keys).to include('email', 'id', 'name', 'phone_number', 'pubsub_token', 'source_id')
+      expect(data.keys).not_to include('account_id', 'identifier', 'custom_attributes', 'additional_attributes', 'company_id')
+    end
   end
 end

spec/enterprise/services/enterprise/billing/reconcile_plan_features_service_spec.rb

@@ -0,0 +1,54 @@
+require 'rails_helper'
+
+describe Enterprise::Billing::ReconcilePlanFeaturesService do
+  let(:account) { create(:account) }
+
+  before do
+    create(:installation_config, {
+             name: 'CHATWOOT_CLOUD_PLANS',
+             value: [
+               { 'name' => 'Hacker', 'product_id' => ['plan_id_hacker'], 'price_ids' => ['price_hacker'] },
+               { 'name' => 'Startups', 'product_id' => ['plan_id_startups'], 'price_ids' => ['price_startups'] }
+             ]
+           })
+  end
+
+  describe '#perform' do
+    context 'with api_and_webhooks feature' do
+      it 'enables the feature for a paid plan with an active subscription' do
+        account.update!(custom_attributes: { 'plan_name' => 'Startups', 'subscription_status' => 'active' })
+
+        described_class.new(account: account).perform
+
+        expect(account.reload).to be_feature_enabled('api_and_webhooks')
+      end
+
+      it 'disables the feature for a paid plan on trial' do
+        account.enable_features!('api_and_webhooks')
+        account.update!(custom_attributes: { 'plan_name' => 'Startups', 'subscription_status' => 'trialing' })
+
+        described_class.new(account: account).perform
+
+        expect(account.reload).not_to be_feature_enabled('api_and_webhooks')
+      end
+
+      it 'disables the feature on the default plan' do
+        account.enable_features!('api_and_webhooks')
+        account.update!(custom_attributes: { 'plan_name' => 'Hacker', 'subscription_status' => 'active' })
+
+        described_class.new(account: account).perform
+
+        expect(account.reload).not_to be_feature_enabled('api_and_webhooks')
+      end
+
+      it 'keeps the feature enabled when manually managed' do
+        account.update!(custom_attributes: { 'plan_name' => 'Hacker', 'subscription_status' => 'trialing' })
+        Internal::Accounts::InternalAttributesService.new(account).manually_managed_features = ['api_and_webhooks']
+
+        described_class.new(account: account).perform
+
+        expect(account.reload).to be_feature_enabled('api_and_webhooks')
+      end
+    end
+  end
+end

spec/listeners/webhook_listener_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 describe WebhookListener do
   let(:listener) { described_class.instance }
-  let!(:account) { create(:account) }
+  let!(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
   let(:report_identity) { Reports::UpdateAccountIdentity.new(account, Time.zone.now) }
   let!(:user) { create(:user, account: account) }
   let!(:inbox) { create(:inbox, account: account) }
@@ -44,6 +44,30 @@ describe WebhookListener do
       end
     end
 
+    context 'when api_and_webhooks feature is disabled' do
+      before do
+        account.disable_features!('api_and_webhooks')
+      end
+
+      it 'does not trigger account webhooks' do
+        create(:webhook, inbox: inbox, account: account)
+        expect(WebhookJob).not_to receive(:perform_later)
+        listener.message_created(message_created_event)
+      end
+
+      it 'still triggers API inbox webhooks' do
+        channel_api = create(:channel_api, account: account)
+        api_conversation = create(:conversation, account: account, inbox: channel_api.inbox, assignee: user)
+        api_message = create(:message, message_type: 'outgoing', account: account, inbox: channel_api.inbox, conversation: api_conversation)
+        api_event = Events::Base.new(event_name, Time.zone.now, message: api_message)
+        expect(WebhookJob).to receive(:perform_later).with(
+          channel_api.webhook_url, api_message.webhook_data.merge(event: 'message_created'),
+          :api_inbox_webhook, secret: channel_api.secret, delivery_id: instance_of(String)
+        ).once
+        listener.message_created(api_event)
+      end
+    end
+
     context 'when inbox is an API Channel' do
       it 'triggers webhook if webhook_url is present' do
         channel_api = create(:channel_api, account: account)

spec/models/account_spec.rb

@@ -108,7 +108,7 @@ RSpec.describe Account do
 
     it 'configures the account feature flag extension column' do
       expect(described_class.flag_columns).to include('feature_flags', 'feature_flags_ext_1')
-      expect(described_class.flag_mapping['feature_flags_ext_1']).to eq({})
+      expect(described_class.flag_mapping['feature_flags_ext_1']).to eq(feature_api_and_webhooks: 1)
     end
 
     it 'keeps existing feature flags on the original column' do

spec/requests/api/v1/accounts/base_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 RSpec.describe 'Api::V1::Accounts::BaseController', type: :request do
-  let(:account) { create(:account) }
+  let(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
   let(:inbox) { create(:inbox, account: account) }
   let!(:conversation) { create(:conversation, account: account, inbox: inbox) }
   let(:agent) { create(:user, account: account, role: :agent) }