Get topic messages

Bearer token for the request. Two flavors:

• Static API key — pass your API key (the value returned as apiKey when the bot was created). Must be paired with X-Signature + X-Timestamp (the hmacSignature scheme).
• OAuth access token — pass the JWT returned by POST /oauth/token. No signature headers are required.

HMAC-SHA256 signature for request verification. Required only when authenticating with a static API key. Omit when using an OAuth access token.

HMAC signature of the request for authentication and replay protection.

Required only when authenticating with a static API key. If you are using an OAuth access token (issued by POST /oauth/token), omit this header — the JWT carries all the authentication and integrity guarantees.

Replay Protection: The signature includes a timestamp to prevent replay attacks. Requests with timestamps older than 5 minutes are rejected.

The signature payload differs by HTTP method:

• POST/PUT/PATCH/DELETE: HMAC-SHA256 of {timestamp}.{body}
• GET: HMAC-SHA256 of {timestamp}.{uri}

The signature is calculated as:

1. Get the current Unix timestamp in milliseconds
2. Determine the payload:
   • For POST/PUT/PATCH/DELETE: Use {timestamp}.{body} where body is the request body
   • For GET: Use {timestamp}.{uri} where uri is the full request URI (e.g., /v2/members?limit=10)
3. Calculate HMAC-SHA256 of the combined payload using your API secret
4. Hex-encode the output
5. Include the timestamp in the X-Timestamp header

Example for GET request to /v2/members?limit=10:

timestamp = 1699564800000
payload = "1699564800000./v2/members?limit=10"
signature = HMAC-SHA256(secret, payload)
X-Signature: hex(signature)
X-Timestamp: 1699564800000

Example for POST request with body {"topicId":"123","text":"Hello"}:

timestamp = 1699564800000
payload = '1699564800000.{"topicId":"123","text":"Hello"}'
signature = HMAC-SHA256(secret, payload)
X-Signature: hex(signature)
X-Timestamp: 1699564800000

For multipart/form-data requests, sign the exact raw request body bytes (including boundaries and file bytes) as transmitted.

Unix timestamp in milliseconds when the request was created. Used for replay protection — requests older than 5 minutes are rejected.

Required only when authenticating with a static API key. Omit when using an OAuth access token.

The ID of the topic to get messages from

Maximum number of messages to return (default: 50, max: 100)

Opaque cursor for pagination. Use the value from nextCursor in the response. Cursors are cryptographically signed and validated server-side to prevent tampering.

Return messages created before this timestamp (Unix milliseconds). Mutually exclusive with after.

Return messages created after this timestamp (Unix milliseconds). Mutually exclusive with before.

Filter messages by sender ID

Sort order for messages (default: desc - newest first)

Include system messages (default: true)

Filter to messages within a specific thread (replies to a parent message)

Include user IDs in reaction data (default: false, heavier payload)