REST API: contacts
Create, inspect, export, and maintain contact records.
Contacts are organization records. The REST API can create, list, inspect, export, and delete a contact. Use a stable external identifier in your own system. Treat the AgentStack contact identifier that the API returns as the key for later reads or deletions. Make a contact export an explicit operator job with a defined retention destination. Do not export contacts automatically after every conversation.
The agent-specific verification and resume settings control how an embedded conversation can connect to a verified contact. When you enable or regenerate verification, the API returns secret material. Store the secret material only in a protected server-side secret manager. After you regenerate the secret, rotate your integrations. Never return the secret material to a browser. The runtime configuration includes guest-use behavior. Clients must not rely on undocumented response fields.
A contact deletion is a consequential data action. Verify the identity of the contact. Record the reason in your system. Follow the response envelope. For details about the widget JWT and the visitor experience, read Identity verification. For changes to contact policy, use the exact request shapes in the API reference.