GraphQL overview

The Hubbo GraphQL endpoint, how requests are authenticated with a project key, and what the client_* operations are.

Hubbo exposes a single GraphQL API. Queries and mutations use HTTPS, subscriptions use a WebSocket on the same path.

Transport	URL
HTTP (queries, mutations)	https://api.hubbo.io/graphql
WebSocket (subscriptions)	wss://api.hubbo.io/graphql

There is no public REST API

Hubbo does not have a public REST API. The client GraphQL operations, whose names start with client_, are the only operations designed to be called with a project key. They are what the Hubbo widget itself uses, so treat them as an integration surface that follows the widget rather than as a versioned public API.

Two families of operations

Client operations, whose names start with client_: read published content and submit visitor input (NPS responses, survey responses, status subscriptions, chat). Authenticated with the account key.
All other operations (for example createNotification, getTeamMembers, updateStatusPage) are used by the admin app. They require a signed-in team member and the right role permissions. They cannot be used with a project key and are not documented as an integration API.

Authentication for client operations

The server reads the account key from the hubbo_api_key cookie, or from the Hubbo-Project-Key request header. The widget sets both: it primes the cookie through the embed endpoint and then sends the header on every request, with credentials included.

curl https://api.hubbo.io/graphql \
  -H 'Content-Type: application/json' \
  -H 'Hubbo-Project-Key: ACCOUNT_KEY' \
  -H 'Origin: https://example.com' \
  -d '{"query":"{ client_getCurrentAccount { name origin usageAllowed } }"}'

Origin and CORS apply

Browser requests are accepted only from the website origin saved in the account (refreshed live when you change it), from hubbo.io, and from the Hubbo admin app. Calling the API from another website fails the CORS check. Public writes (chat, NPS, surveys) are also rate-limited. Remember that each call to client_getCurrentAccount can count a page view, so do not use it as a health check.

Calling from JavaScript

const response = await fetch('https://api.hubbo.io/graphql', {
  method: 'POST',
  credentials: 'include',
  headers: {
    'Content-Type': 'application/json',
    'Hubbo-Project-Key': 'ACCOUNT_KEY',
  },
  body: JSON.stringify({
    query: `query {
      client_getAllNotifications(filters: { state: published }) {
        id title description variant category startDate endDate
      }
    }`,
  }),
});

const { data, errors } = await response.json();

Subscriptions

The widget uses the graphql-ws protocol over wss://api.hubbo.io/graphql. See Realtime subscriptions.

Reference articles

Treat field lists as living docs

Field sets can grow as the product evolves. Production GraphQL does not expose schema introspection — rely on these Resources articles (and the widget’s own requests) rather than an auto-generated schema explorer against api.hubbo.io.