Public API | Stand Feature Reference

Before you begin

Plan availability: All plans, within existing feature and usage allowances.

Prerequisite: Browser authorization, a completed profile and active organization membership, plus the scopes and resource permissions required by each operation.

Key boundary: Initial onboarding, account deletion, billing and team-member changes remain in the browser. API access does not unlock paid features or provide representative WebSocket access.

01

Choose the interface for the job

Your task	Use
Manage your Stand account from a tool or script	The public management API, or its CLI. Available on every plan with scoped browser authorization.
Let a Stand-in look up data or act in your business systems	Stand-in access to your systems: Business integrations configured from your OpenAPI definition.
Build a visitor-facing conversation interface	The custom chat UI visitor API, which uses session-scoped visitor tokens rather than account-management credentials.
Open or customize the installed widget	The Stand JavaScript API and website components.

02

What you can manage

The public contract contains 109 operations across 19 business scopes. Profile, Sites, organization, conversations, digests, Stand-ins, knowledge and integrations each have read/write scopes; team and analytics have read scopes, and feedback has a write scope.

The published OpenAPI contract defines supported routes, operation IDs, scopes, request bodies, pagination and responses. The CLI uses that same contract; internal dashboard routes outside it are not available to external clients.

Site script editing requires prior browser opt-in by the owner. An API client cannot enable JavaScript experimentation or grant Stand-admin behavior access, including as part of a larger Site update.

Area	Supported behavior
Profile and branding	Read and edit an existing profile, greetings, avatars and personal lapel-pin branding after browser onboarding.
Sites and organization	Create, read, update and delete Sites; inspect routing matches; manage personal Site preferences, Site and organization instructions, privacy and branding; read plan and usage.
Conversations and team reads	List and inspect authorized conversations, send messages, mark seen, close, take over or offer a handoff; search and export permitted history; read the team and invite-provider default.
Digests	Read and change personal digest and AI-digest preferences; request a digest within existing plan and role limits.
Stand-ins	Create, read, update, clone and delete owned Stand-ins; manage enablement, skills, avatars, branding and attached knowledge or integration tools.
Knowledge	Create, describe and delete bases; upload or replace approved files; crawl websites; add and refresh sitemaps; inspect and search documents or indexed sections; cancel tasks; inspect connected Stand-ins and manage attachments within plan allowances.
Integrations, analytics and feedback	Manage shared organization integration definitions and OpenAPI previews; read permitted statistics and Live Shows; submit feedback.

03

Authorization and account permissions

The account holder signs in and approves permissions in the browser. Signup, terms acceptance and initial profile or organization creation use the existing browser flow; a token alone does not complete onboarding.

A request needs both its granted scope and the account’s normal active membership, role, ownership and plan permissions. A profile update that renames the organization also needs organization-write permission. Disabling an account or organization blocks further use of an existing token.

The CLI provides the supported browser device-authorization flow, stores credentials privately and refreshes short-lived access within the existing session limits. Do not place account credentials in website code or use a visitor session token to administer the account.

04

Requests, responses and larger data

Use the published operation’s method, path and input schema. JSON is the ordinary request format; image and knowledge-file operations use multipart uploads. Each operation lists its required permission.
Use the pagination, filters and response shape declared by the operation. A list page is not necessarily a complete inventory, and transcript reads are bounded; use filtered history export when a complete retained export is needed.
API failures use the documented error object with a code, message and timestamp. A 401 requires valid authorization; a 403 can mean missing scope, role, ownership or plan permission. Repeating the same request does not grant access.
Knowledge uploads allow a maximum of 10 MiB per supported file; the API’s encoded multipart request limit is 12 MiB. The CLI also applies an 11 MiB combined file/text-content budget. Inspect indexing tasks before treating an upload as searchable knowledge.
History exports contain private conversation data. Choose the intended filters and destination, check the export’s completion result, and obtain approval before sharing it with another service.

05

Make changes deliberately

Read the current resource and retain its ID before editing it. Names are not unique identities. Collection replacement writes must preserve the members you intend to keep.
This API does not provide a general idempotency or conditional-revision guarantee. If a write times out or its result is uncertain, inspect the resource before retrying; it may already have succeeded.
Site JavaScript experimentation and temporary Stand-admin behavior access require the owner’s prior opt-in in the browser. After consent, authorized API clients can edit experiments, but cannot enable or restore either permission.
Reading account data does not make a person Available or refresh human presence. Explicit personal Site-preference writes remain available. Representative WebSockets, Site-connection credentials, MCP and WordPress are outside this management contract.

06

Related features

Stand CLI — Install and manage Stand from a terminal or coding agent. The CLI provides browser authorization, named commands, schema discovery, uploads and history export, with readable output for people and JSON for automation.
Stand-in access to your systems — OpenAPI integrations are team-shared connections that let selected AI Stand-ins read live data or perform confirmed actions through customer-provided REST APIs.
Custom chat UI — Custom chat UIs let a website render its own visitor conversation interface, including interfaces built with an AI coding agent, while Stand provides routing, AI replies, human chat, and conversation history through the visitor HTTP and WebSocket APIs. Stand’s live examples include an inline React client, the homepage hero’s chat, and the homepage’s pink cow chat.
Conversation export — Stand exports one selected conversation as clipboard-ready Markdown or every conversation matching the active History filters as a downloadable JSON dataset.
Managing and inspecting knowledge sources — The knowledge-base view shows each source’s progress, indexed text, usage, and last refresh. Members can inspect shared sources; the member who owns a knowledge base can change its sources, cancel ingestion, or delete it.