chore: backfill api_and_webhooks for existing accounts

app/controllers/api/v1/accounts/base_controller.rb

@@ -2,5 +2,12 @@ class Api::V1::Accounts::BaseController < Api::BaseController
   include SwitchLocale
   include EnsureCurrentAccountHelper
   before_action :current_account
+  before_action :validate_token_api_access, if: :authenticate_by_access_token?
   around_action :switch_locale_using_account_locale
+
+  private
+
+  def validate_token_api_access
+    render_unauthorized('Invalid Access Token') unless Current.account.feature_enabled?('api_and_webhooks')
+  end
 end

app/controllers/api/v1/accounts/webhooks_controller.rb

@@ -1,4 +1,5 @@
 class Api::V1::Accounts::WebhooksController < Api::V1::Accounts::BaseController
+  before_action :ensure_api_and_webhooks_enabled
   before_action :check_authorization
   before_action :fetch_webhook, only: [:update, :destroy]
 
@@ -22,6 +23,10 @@ class Api::V1::Accounts::WebhooksController < Api::V1::Accounts::BaseController
 
   private
 
+  def ensure_api_and_webhooks_enabled
+    render_unauthorized('You are not authorized to do this action') unless Current.account.feature_enabled?('api_and_webhooks')
+  end
+
   def webhook_params
     params.require(:webhook).permit(:inbox_id, :name, :url, subscriptions: [])
   end

app/listeners/webhook_listener.rb

@@ -108,6 +108,8 @@ class WebhookListener < BaseListener
   end
 
   def deliver_account_webhooks(payload, account)
+    return unless account.feature_enabled?('api_and_webhooks')
+
     account.webhooks.account_type.each do |webhook|
       next unless webhook.subscriptions.include?(payload[:event])
 

config/features.yml

@@ -249,3 +249,7 @@
   display_name: Advanced Assignment
   enabled: false
   premium: true
+- name: api_and_webhooks
+  display_name: API and Webhooks
+  enabled: true
+  column: feature_flags_ext_1

db/migrate/20260709000000_enable_api_and_webhooks_for_existing_accounts.rb

@@ -0,0 +1,12 @@
+# Enable api_and_webhooks for existing accounts.
+# Like 20260120121402_enable_captain_tasks_for_existing_accounts.rb, we don't need
+# to update ACCOUNT_LEVEL_FEATURE_DEFAULTS or clear GlobalConfig cache because
+# api_and_webhooks has `enabled: true` in features.yml - ConfigLoader handles the
+# defaults on deploy automatically.
+class EnableApiAndWebhooksForExistingAccounts < ActiveRecord::Migration[7.0]
+  def up
+    Account.find_in_batches(batch_size: 100) do |accounts|
+      accounts.each { |account| account.enable_features!('api_and_webhooks') }
+    end
+  end
+end

db/schema.rb

@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema[7.1].define(version: 2026_07_06_215758) do
+ActiveRecord::Schema[7.1].define(version: 2026_07_09_000000) do
   # These extensions should be enabled to support this database
   enable_extension "pg_stat_statements"
   enable_extension "pg_trgm"

enterprise/app/services/enterprise/billing/reconcile_plan_features_service.rb

@@ -37,8 +37,10 @@ class Enterprise::Billing::ReconcilePlanFeaturesService
   def perform
     account.disable_features(*PREMIUM_PLAN_FEATURES)
     account.disable_features('captain_integration_v2') if default_plan?
+    account.disable_features('api_and_webhooks')
     account.enable_features(*current_plan_features)
     account.enable_features('captain_integration_v2') if captain_v2_default_eligible?
+    account.enable_features('api_and_webhooks') if api_and_webhooks_eligible?
     account.enable_features(*manually_managed_features)
     account.save!
   end
@@ -56,6 +58,10 @@ class Enterprise::Billing::ReconcilePlanFeaturesService
     end
   end
 
+  def api_and_webhooks_eligible?
+    !default_plan? && account.custom_attributes['subscription_status'] == 'active'
+  end
+
   def default_plan?
     default_plan_name = cloud_plans.first&.dig('name')
     return false if default_plan_name.blank?

enterprise/app/services/internal/accounts/internal_attributes_service.rb

@@ -54,7 +54,7 @@ class Internal::Accounts::InternalAttributesService
   def valid_feature_list
     Enterprise::Billing::ReconcilePlanFeaturesService::BUSINESS_PLAN_FEATURES +
       Enterprise::Billing::ReconcilePlanFeaturesService::ENTERPRISE_PLAN_FEATURES +
-      %w[inbound_emails]
+      %w[inbound_emails api_and_webhooks]
   end
 
   # Account notes functionality removed for now

lib/tasks/api_and_webhooks_migration.rake

@@ -0,0 +1,59 @@
+# Grandfather api_and_webhooks for existing accounts (cloud only).
+#
+# Adds api_and_webhooks to each account's manually_managed_features internal
+# attribute so per-account billing reconciles never strip the feature from
+# accounts that existed before the flag was introduced. Idempotent.
+#
+# Usage Examples:
+#   # Grandfather a single account
+#   ACCOUNT_ID=1 bundle exec rake api_and_webhooks:grandfather
+#
+#   # Grandfather all accounts in the installation
+#   bundle exec rake api_and_webhooks:grandfather
+# rubocop:disable Metrics/BlockLength
+namespace :api_and_webhooks do
+  desc 'Grandfather api_and_webhooks via manually_managed_features for existing accounts'
+  task grandfather: :environment do
+    abort 'Aborted. This task requires the enterprise edition.' unless ChatwootApp.enterprise?
+
+    account_id = ENV.fetch('ACCOUNT_ID', nil)
+    accounts = account_id.present? ? Account.where(id: account_id) : Account.all
+
+    if account_id.blank?
+      print 'No ACCOUNT_ID specified. This will grandfather ALL accounts. Continue? [y/N] '
+      abort 'Aborted.' unless $stdin.gets.chomp.casecmp('y').zero?
+    end
+
+    if account_id.present? && accounts.empty?
+      puts "Error: Account with ID #{account_id} not found"
+      exit(1)
+    end
+
+    total = accounts.count
+    puts "Grandfathering api_and_webhooks for #{total} account(s)..."
+
+    updated = 0
+    skipped = 0
+    errored = 0
+
+    accounts.find_each do |account|
+      service = Internal::Accounts::InternalAttributesService.new(account)
+      features = service.manually_managed_features
+
+      if features.include?('api_and_webhooks')
+        skipped += 1
+        next
+      end
+
+      service.manually_managed_features = features + ['api_and_webhooks']
+      account.enable_features!('api_and_webhooks')
+      updated += 1
+    rescue StandardError => e
+      errored += 1
+      puts "  Account #{account.id} — error: #{e.message}"
+    end
+
+    puts "Done! Updated: #{updated}, Skipped: #{skipped}, Errored: #{errored}, Total: #{total}"
+  end
+end
+# rubocop:enable Metrics/BlockLength

spec/controllers/api/base_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 RSpec.describe 'API Base', type: :request do
-  let!(:account) { create(:account) }
+  let!(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
   let!(:user) { create(:user, account: account) }
 
   describe 'request with api_access_token for user' do
@@ -23,6 +23,32 @@ RSpec.describe 'API Base', type: :request do
       end
     end
 
+    context 'when the account does not have the api_and_webhooks feature' do
+      let!(:admin) { create(:user, :administrator, account: account) }
+      let!(:conversation) { create(:conversation, account: account) }
+
+      before do
+        account.disable_features!('api_and_webhooks')
+      end
+
+      it 'returns unauthorized for token authenticated requests' do
+        get "/api/v1/accounts/#{account.id}/conversations/#{conversation.display_id}",
+            headers: { api_access_token: admin.access_token.token },
+            as: :json
+
+        expect(response).to have_http_status(:unauthorized)
+        expect(response.parsed_body['error']).to eq('Invalid Access Token')
+      end
+
+      it 'allows session authenticated requests' do
+        get "/api/v1/accounts/#{account.id}/conversations/#{conversation.display_id}",
+            headers: admin.create_new_auth_token,
+            as: :json
+
+        expect(response).to have_http_status(:success)
+      end
+    end
+
     context 'when it is an invalid api_access_token' do
       it 'returns unauthorized' do
         get '/api/v1/profile',
@@ -94,6 +120,19 @@ RSpec.describe 'API Base', type: :request do
       end
     end
 
+    context 'when the account does not have the api_and_webhooks feature' do
+      it 'returns unauthorized for accessible bot endpoints' do
+        create(:agent_bot_inbox, inbox: inbox, agent_bot: agent_bot)
+        account.disable_features!('api_and_webhooks')
+
+        post "/api/v1/accounts/#{account.id}/conversations/#{conversation.display_id}/toggle_status",
+             headers: { api_access_token: agent_bot.access_token.token },
+             as: :json
+
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
+
     context 'when the account is suspended' do
       it 'returns 401 unauthorized' do
         account.update!(status: :suspended)

spec/controllers/api/v1/accounts/conversations/assignments_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 RSpec.describe 'Conversation Assignment API', type: :request do
-  let(:account) { create(:account) }
+  let(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
 
   describe 'POST /api/v1/accounts/{account.id}/conversations/<id>/assignments' do
     let(:conversation) { create(:conversation, account: account) }

spec/controllers/api/v1/accounts/conversations/messages_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 RSpec.describe 'Conversation Messages API', type: :request do
-  let!(:account) { create(:account) }
+  let!(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
 
   describe 'POST /api/v1/accounts/{account.id}/conversations/<id>/messages' do
     let!(:inbox) { create(:inbox, account: account) }

spec/controllers/api/v1/accounts/conversations_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 RSpec.describe 'Conversations API', type: :request do
-  let(:account) { create(:account) }
+  let(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
 
   describe 'GET /api/v1/accounts/{account.id}/conversations' do
     context 'when it is an unauthenticated user' do

spec/controllers/api/v1/accounts/webhook_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 RSpec.describe 'Webhooks API', type: :request do
-  let(:account) { create(:account) }
+  let(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
   let(:inbox) { create(:inbox, account: account) }
   let(:webhook) { create(:webhook, account: account, inbox: inbox, url: 'https://hello.com', name: 'My Webhook') }
   let(:administrator) { create(:user, account: account, role: :administrator) }
@@ -26,6 +26,16 @@ RSpec.describe 'Webhooks API', type: :request do
         expect(response.parsed_body['payload']['webhooks'].count).to eql account.webhooks.count
       end
     end
+
+    context 'when api_and_webhooks feature is disabled' do
+      it 'returns unauthorized even for an admin' do
+        account.disable_features!('api_and_webhooks')
+        get "/api/v1/accounts/#{account.id}/webhooks",
+            headers: administrator.create_new_auth_token,
+            as: :json
+        expect(response).to have_http_status(:unauthorized)
+      end
+    end
   end
 
   describe 'POST /api/v1/accounts/<account_id>/webhooks' do

spec/enterprise/services/enterprise/billing/reconcile_plan_features_service_spec.rb

@@ -0,0 +1,54 @@
+require 'rails_helper'
+
+describe Enterprise::Billing::ReconcilePlanFeaturesService do
+  let(:account) { create(:account) }
+
+  before do
+    create(:installation_config, {
+             name: 'CHATWOOT_CLOUD_PLANS',
+             value: [
+               { 'name' => 'Hacker', 'product_id' => ['plan_id_hacker'], 'price_ids' => ['price_hacker'] },
+               { 'name' => 'Startups', 'product_id' => ['plan_id_startups'], 'price_ids' => ['price_startups'] }
+             ]
+           })
+  end
+
+  describe '#perform' do
+    context 'with api_and_webhooks feature' do
+      it 'enables the feature for a paid plan with an active subscription' do
+        account.update!(custom_attributes: { 'plan_name' => 'Startups', 'subscription_status' => 'active' })
+
+        described_class.new(account: account).perform
+
+        expect(account.reload).to be_feature_enabled('api_and_webhooks')
+      end
+
+      it 'disables the feature for a paid plan on trial' do
+        account.enable_features!('api_and_webhooks')
+        account.update!(custom_attributes: { 'plan_name' => 'Startups', 'subscription_status' => 'trialing' })
+
+        described_class.new(account: account).perform
+
+        expect(account.reload).not_to be_feature_enabled('api_and_webhooks')
+      end
+
+      it 'disables the feature on the default plan' do
+        account.enable_features!('api_and_webhooks')
+        account.update!(custom_attributes: { 'plan_name' => 'Hacker', 'subscription_status' => 'active' })
+
+        described_class.new(account: account).perform
+
+        expect(account.reload).not_to be_feature_enabled('api_and_webhooks')
+      end
+
+      it 'keeps the feature enabled when manually managed' do
+        account.update!(custom_attributes: { 'plan_name' => 'Hacker', 'subscription_status' => 'trialing' })
+        Internal::Accounts::InternalAttributesService.new(account).manually_managed_features = ['api_and_webhooks']
+
+        described_class.new(account: account).perform
+
+        expect(account.reload).to be_feature_enabled('api_and_webhooks')
+      end
+    end
+  end
+end

spec/listeners/webhook_listener_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 describe WebhookListener do
   let(:listener) { described_class.instance }
-  let!(:account) { create(:account) }
+  let!(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
   let(:report_identity) { Reports::UpdateAccountIdentity.new(account, Time.zone.now) }
   let!(:user) { create(:user, account: account) }
   let!(:inbox) { create(:inbox, account: account) }
@@ -44,6 +44,30 @@ describe WebhookListener do
       end
     end
 
+    context 'when api_and_webhooks feature is disabled' do
+      before do
+        account.disable_features!('api_and_webhooks')
+      end
+
+      it 'does not trigger account webhooks' do
+        create(:webhook, inbox: inbox, account: account)
+        expect(WebhookJob).not_to receive(:perform_later)
+        listener.message_created(message_created_event)
+      end
+
+      it 'still triggers API inbox webhooks' do
+        channel_api = create(:channel_api, account: account)
+        api_conversation = create(:conversation, account: account, inbox: channel_api.inbox, assignee: user)
+        api_message = create(:message, message_type: 'outgoing', account: account, inbox: channel_api.inbox, conversation: api_conversation)
+        api_event = Events::Base.new(event_name, Time.zone.now, message: api_message)
+        expect(WebhookJob).to receive(:perform_later).with(
+          channel_api.webhook_url, api_message.webhook_data.merge(event: 'message_created'),
+          :api_inbox_webhook, secret: channel_api.secret, delivery_id: instance_of(String)
+        ).once
+        listener.message_created(api_event)
+      end
+    end
+
     context 'when inbox is an API Channel' do
       it 'triggers webhook if webhook_url is present' do
         channel_api = create(:channel_api, account: account)

spec/models/account_spec.rb

@@ -108,7 +108,7 @@ RSpec.describe Account do
 
     it 'configures the account feature flag extension column' do
       expect(described_class.flag_columns).to include('feature_flags', 'feature_flags_ext_1')
-      expect(described_class.flag_mapping['feature_flags_ext_1']).to eq({})
+      expect(described_class.flag_mapping['feature_flags_ext_1']).to eq(feature_api_and_webhooks: 1)
     end
 
     it 'keeps existing feature flags on the original column' do

spec/requests/api/v1/accounts/base_controller_spec.rb

@@ -1,7 +1,7 @@
 require 'rails_helper'
 
 RSpec.describe 'Api::V1::Accounts::BaseController', type: :request do
-  let(:account) { create(:account) }
+  let(:account) { create(:account).tap { |account| account.enable_features!('api_and_webhooks') } }
   let(:inbox) { create(:inbox, account: account) }
   let!(:conversation) { create(:conversation, account: account, inbox: inbox) }
   let(:agent) { create(:user, account: account, role: :agent) }