Back to top

API Documentation

Authorize

Overview

We currently allow applications to authenticate with OAuth 2 protocol. OAuth2 has different strategies and Rechat supports two of them:

Strategy Use case
Bearer (AccessToken) User login required
ClientPassword User login makes no sense in the context (eg Registration, where user has no credentials to begin with)

The ClientPassword authentication method is only reserved for for Rechat’s internal applications. Partners trying to create integrations should use OAuth process to fetch new tokens.

You should use a third party library for handling the whole process.

If you are writing code to handle these steps, you are most probably doing it wrong.

Authentication

Get Token
POST/oauth2/token

Basically, login in rechat (and other oauth2 based API’s) means fetching access_token from the server and providing it in the HTTP headers for the remainder of the session like this:

Authorization: Bearer <fetched_access_token>

Additional to access_token, this endpoint will give you:

  • Profile of the logged in user.

  • Expirey date of the access token

  • A refresh token

Example URI

POST /oauth2/token
Request
HideShow
Body
{
  "client_id": "bf0da47e-7226-11e4-905b-0024d71b10fc",
  "client_secret": "secret",
  "username": "[email protected]",
  "password": "aaaaaa",
  "grant_type": "password"
}
Response  200
HideShow
Body
{
  "access_token": "ODVmNmI0NmEtZjdmYy0xMWYwLTk1MmItZDZjMjdlZDQ0MThh",
  "refresh_token": "ODVmNjQ5NDQtZjdmYy0xMWYwLTk1MmItZDZjMjdlZDQ0MThh",
  "expires_in": 2678400,
  "code": "OK",
  "data": {
    "type": "user",
    "username": null,
    "first_name": "Unit",
    "last_name": "Test",
    "email": "[email protected]",
    "phone_number": "+4368120265807",
    "created_at": 1493115498.770362,
    "id": "80a227b2-29a0-11e7-b636-e4a7a08e15d4",
    "address_id": null,
    "cover_image_url": null,
    "profile_image_url": null,
    "updated_at": 1493115498.770744,
    "user_status": "Active",
    "profile_image_thumbnail_url": null,
    "cover_image_thumbnail_url": null,
    "email_confirmed": true,
    "timezone": "America/Chicago",
    "user_type": "Admin",
    "deleted_at": null,
    "phone_confirmed": false,
    "is_shadow": false,
    "personal_room": null,
    "brand": null,
    "fake_email": false,
    "features": [
      "Deals"
    ],
    "last_seen_at": null,
    "email_signature": null,
    "daily_enabled": false,
    "email_quota": 30000,
    "website": null,
    "instagram": null,
    "twitter": null,
    "linkedin": null,
    "youtube": null,
    "facebook": null,
    "designation": null,
    "tiktok": null,
    "mfa_enabled": false,
    "xpressdocs_user_id": "80a227b2-29a0-11e7-b636-e4a7a08e15d4",
    "current_time": "7:40 PM - Thursday Jan 22, 2026",
    "push_allowed": true,
    "agents": null,
    "last_seen_type": null,
    "active_brand": null,
    "display_name": "Unit Test",
    "abbreviated_display_name": "Unit",
    "online_state": "Offline",
    "has_password": true
  },
  "token_type": "Bearer"
}

Refresh Token
POST/oauth2/token

An access token has a expiry date and thus will be expired. But every time you get an access token (as documented above), you will be given a refresh token which has a longer expiry.

At any time, you can exchange the refresh token with a new pair of tokens like this:

Example URI

POST /oauth2/token
Request
HideShow
Body
{
  "refresh_token": "ODVmNjQ5NDQtZjdmYy0xMWYwLTk1MmItZDZjMjdlZDQ0MThh",
  "grant_type": "refresh_token",
  "client_id": "bf0da47e-7226-11e4-905b-0024d71b10fc",
  "client_secret": "secret"
}
Response  200
HideShow
Body
{
  "access_token": "ODVmOTQ2YjItZjdmYy0xMWYwLTk1MmItZDZjMjdlZDQ0MThh",
  "refresh_token": "ODVmOGU1YmUtZjdmYy0xMWYwLTk1MmItZDZjMjdlZDQ0MThh",
  "expires_in": 2678400,
  "code": "OK",
  "token_type": "Bearer"
}

Multi-factor authentication

Overview

MFA is an opt-in feature, allowing users to set it up in their account settings. Once MFA is activated, MFA will be required when making certain API requests, such as changing the password.

  • Setup MFA: To get started, make a POST request to /users/self/mfa/setup. This endpoint will return two important fields, mfa_url and mfa_qr_code, which can be used with an authenticator application to add a new service.

  • Verify MFA: POST /users/self/mfa/verify After setting up MFA, it’s not immediately enabled for the user. We require users to verify it first by providing a token. The verification step enables the MFA for the user and also marks the current access_token/refresh_token pair as MFA validated.

  • Validate MFA: If a user with verified MFA needs to sign in again, the new access_token/refresh_token pair won’t be MFA validated by default. This means that every request made with the access token will result in a 401 MFA required error. In such cases, the client must call POST /users/self/mfa/validate with a valid MFA token generated by the authenticator application to mark the tokens as MFA validated.

  • Delete MFA: DELETE /users/self/mfa endpoint with a valid MFA token can be used to remove the multi-factor authentication from the user.

Setup MFA

Setup MFA
POST/users/self/mfa/setup

Example URI

POST /users/self/mfa/setup
Response  200
HideShow
Body
{
  "code": "OK",
  "data": {
    "type": "user",
    "username": null,
    "first_name": "updated first name",
    "last_name": "Test",
    "email": "[email protected]",
    "phone_number": "+4368120265807",
    "created_at": 1493115498.770362,
    "id": "80a227b2-29a0-11e7-b636-e4a7a08e15d4",
    "address_id": null,
    "cover_image_url": "https://test.cloudfront.net/80a227b2-29a0-11e7-b636-e4a7a08e15d4/f0cf92c0-f7fc-11f0-8c7d-09c4c6e349ce.jpg",
    "profile_image_url": "https://test.cloudfront.net/80a227b2-29a0-11e7-b636-e4a7a08e15d4/f0d5d450-f7fc-11f0-8c7d-09c4c6e349ce.jpg",
    "updated_at": 1769132619.292185,
    "user_status": "Active",
    "profile_image_thumbnail_url": null,
    "cover_image_thumbnail_url": null,
    "email_confirmed": true,
    "timezone": "America/Chicago",
    "user_type": "Agent",
    "deleted_at": null,
    "phone_confirmed": true,
    "is_shadow": false,
    "personal_room": null,
    "brand": null,
    "fake_email": false,
    "features": [
      "Deals"
    ],
    "last_seen_at": null,
    "email_signature": "Here is my great signature",
    "daily_enabled": true,
    "email_quota": 30000,
    "website": null,
    "instagram": null,
    "twitter": null,
    "linkedin": null,
    "youtube": null,
    "facebook": null,
    "designation": null,
    "tiktok": null,
    "mfa_enabled": false,
    "xpressdocs_user_id": "80a227b2-29a0-11e7-b636-e4a7a08e15d4",
    "current_time": "7:43 PM - Thursday Jan 22, 2026",
    "push_allowed": true,
    "agents": [
      {
        "id": "69a677f8-65e3-4e1e-ab92-4dc2c38093d8",
        "email": "[email protected]",
        "mlsid": "00920130",
        "fax": "(972) 264-4703",
        "full_name": "Gholi Sweet",
        "first_name": "Gholi",
        "last_name": "Sweet",
        "middle_name": null,
        "phone_number": "(972) 264-4703",
        "nar_number": "797500044",
        "office_mui": "15512742",
        "status": "Active",
        "office_mlsid": "RCHT01X",
        "work_phone": "(469) 358-8080",
        "generational_name": null,
        "matrix_unique_id": "155155530",
        "updated_at": 1769132617.800233,
        "deleted_at": null,
        "created_at": 1769132617.800233,
        "mls": "NTREIS",
        "license_number": null,
        "designation": null,
        "nrds": "01053140",
        "type": "agent",
        "office_id": null,
        "secret_questions": [
          "(972) XXX-XX03",
          "jewellxxxxxxxxxxxxxal.net",
          "(469) XXX-XX80"
        ]
      }
    ],
    "last_seen_type": null,
    "active_brand": null,
    "display_name": "updated first name Test",
    "abbreviated_display_name": "updated first name",
    "online_state": "Offline",
    "mfa_url": "otpauth://totp/Rechat:test%40rechat.com?issuer=Rechat&secret=L2AJ5K7OFOFAQ54YW6B5WGM34MDC5L5M&algorithm=SHA1&digits=6&period=30",
    "mfa_qr_code": "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAANQAAADUCAYAAADk3g0YAAAAAklEQVR4AewaftIAAApXSURBVO3BQY7gRpIAQXei/v9l3z7GKQGCWS1pNszsD9ZaVzysta55WGtd87DWuuZhrXXNw1rrmoe11jUPa61rHtZa1zysta55WGtd87DWuuZhrXXNw1rrmoe11jUPa61rfvhI5W+qmFSmihOVqeImlaniRGWqOFGZKiaVqeILlTcq3lCZKiaVv6nii4e11jUPa61rHtZa1/xwWcVNKicVJypTxYnKFxWTylRxovKGyhsqU8VJxaTyhcpU8UbFTSo3Pay1rnlYa13zsNa65odfpvJGxW9SmSqmikllqvhCZao4UZkq3lD5X6byRsVvelhrXfOw1rrmYa11zQ//cSonFW+oTBVvqLyhclLxRcWJylRxUjGpTCpTxYnKVPFf9rDWuuZhrXXNw1rrmh/+x1ScqJxUTCpfVEwqb6j8TSpfVEwq/588rLWueVhrXfOw1rrmh19W8W9W8UXFicobFW+oTBVfqEwVJyqTylTxmyr+TR7WWtc8rLWueVhrXfPDZSr/JipTxaQyVZxUTCpTxUnFpHKiMlW8oTJVTCpTxaQyVZxUTCpTxaQyVZyo/Js9rLWueVhrXfOw1rrmh48q/ssqTiomlROVqeKLii8qJpWp4g2VNyomlTcq/kse1lrXPKy1rnlYa13zw0cqU8UbKlPFpPKbVKaKNypOVN5QuUnli4pJ5UTlC5WbKk5UpoovHtZa1zysta55WGtd88NHFZPKVPGGylQxqUwVk8pUMal8UfFFxaQyVZyoTBVvVNxU8YbKScWkclJxojJVTBU3Pay1rnlYa13zsNa6xv7gA5U3KiaVqWJSeaPiROWLiknlpOILld9U8YbKVDGpTBVvqJxUTCpTxaRyUnHTw1rrmoe11jUPa61rfvjLVN6omFSmipsqTlR+k8pJxaQyVUwqU8WJyknFpDJV/CaVqeKkYlKZVKaKLx7WWtc8rLWueVhrXfPDZRUnKlPFicoXKlPFpHKi8oXKFxWTyonKFxVfqLxRcVJxojJVnFT8poe11jUPa61rHtZa1/xwmcpUMVVMKlPFVDGpnKhMFScVk8pUMalMFZPKVDGpTBU3VUwqk8pJxaQyVbxRcaIyVUwqU8UbKlPFb3pYa13zsNa65mGtdc0PH1VMKicqb6j8TRUnFZPKVPGGyknFScXfpDJVTCpvVHxR8YXKVPHFw1rrmoe11jUPa61r7A8+UJkqTlTeqDhRmSpOVKaKSWWqmFTeqHhD5YuKSeWk4kTli4oTlZOKE5U3Kn7Tw1rrmoe11jUPa61r7A8+UDmpmFSmihOVqWJSOal4Q+WLiknlpGJSmSreUJkqTlROKk5U3qg4Ubmp4kRlqvjiYa11zcNa65qHtdY19gcXqUwVv0nli4qbVKaKE5Wp4kRlqphUTipOVL6oeEPlpGJSOak4UTmp+OJhrXXNw1rrmoe11jU/fKQyVZyoTBWTyhcVk8pUcaIyVUwqU8VU8ZsqflPFicpUMalMFZPKScWk8obKScVvelhrXfOw1rrmYa11zQ8fVUwqJxWTyknFFxU3VUwqU8WkclJxovJGxYnKVDGpTBUnKicqv6liUpkqJpWp4qaHtdY1D2utax7WWtfYH3ygMlWcqPymikllqjhR+aLiROVvqphUpoo3VKaKSeXfpGJSOan44mGtdc3DWuuah7XWNfYHH6i8UTGpTBVvqJxUTConFZPKVDGpnFScqEwVb6icVEwqU8WJylRxk8pU8YbKFxU3Pay1rnlYa13zsNa65oePKiaVqWJSeUNlqripYlKZKiaVqeJEZap4Q2WqeENlqphUporfpPKGylTxRsWk8pse1lrXPKy1rnlYa13zwy9TmSomlZOKNyq+qDipOFG5qeKLikllqjipOFGZKk4qJpWTijcq/kkPa61rHtZa1zysta6xP/hA5aTiROWmiknli4oTlZOKE5V/UsUbKlPFpHJSMan8pooTlanii4e11jUPa61rHtZa1/zwUcWkMqmcVEwqU8Wk8kXFGypvVEwqU8W/icpJxVQxqZxUvFExqUwVX6hMFTc9rLWueVhrXfOw1rrmh7+sYlI5UZkqJpVJZao4Ufmi4qTijYpJ5d9EZap4Q+ULlTcq/qaHtdY1D2utax7WWtf88MsqTiomlanipOJEZar4ouJEZaq4qeImlROVE5WTiqnii4pJZar4Jz2sta55WGtd87DWuuaHj1TeUHlD5aTiDZU3KiaVqWKqOFGZKiaVqeJEZaqYVKaKqWJSOamYVN5QmSreUPmi4jc9rLWueVhrXfOw1rrmh8sq3qh4Q+VE5YuKSWWqOFF5Q2WqmFRuUjmpeKNiUnlD5YuKE5Wp4jc9rLWueVhrXfOw1rrG/uADlS8qJpU3Km5S+aJiUrmpYlL5ouLfRGWqOFGZKiaVqeI3Pay1rnlYa13zsNa6xv7gA5WpYlKZKm5SmSomlaliUpkqJpWp4kRlqrhJ5W+qmFROKiaVqWJSmSomlS8qJpWp4qaHtdY1D2utax7WWtfYH3ygMlVMKlPFicpJxT9JZar4J6lMFZPKVDGpTBVvqJxUvKHyRsWkMlVMKlPFTQ9rrWse1lrXPKy1rrE/uEhlqrhJZaqYVKaKN1SmiknljYoTld9U8YbKScWJyhsVX6h8UXHTw1rrmoe11jUPa61r7A/+QSpTxaRyUvGFylQxqZxUnKicVHyhMlWcqPyTKiaVk4pJZaqYVKaKv+lhrXXNw1rrmoe11jU/XKZyU8UbKm9UnFScqLxRcaIyVUwqb6icVJyo/KaKE5WpYlJ5Q2WquOlhrXXNw1rrmoe11jU/fKQyVZyovKFyUjFV3KRyUvGGyhsqf5PKGxUnKicqb6h8UfGbHtZa1zysta55WGtdY3/wH6byRsUbKicVJypTxaQyVbyh8kbFpHJTxRsqU8UbKlPFpHJScdPDWuuah7XWNQ9rrWt++Ejlb6o4qThReaNiUplUpoqpYlJ5Q2Wq+ELlpOJEZap4Q+UNlaniRGWqmFR+08Na65qHtdY1D2uta364rOImlZOKNyreUJkqTlSmii8q3qiYVE4qJpWp4kRlqphUvqh4o+KkYlKZKr54WGtd87DWuuZhrXXND79M5Y2KN1TeqJhU3lA5qZhU3lD5QmWqmFTeUDmpOKmYVE5UfpPKb3pYa13zsNa65mGtdc0P/3EVk8pUcVPFicpJxRsqJxUnKl9UTConKlPFVHGiMlWcqJyoTBW/6WGtdc3DWuuah7XWNT/8P6MyVUwqU8WkMlX8TRUnKicVk8pUMancpDJVvKEyVZxU/E0Pa61rHtZa1zysta754ZdV/JNUpoqTijdUpopJ5URlqjhReaPiN6mcqLxRMan8lzysta55WGtd87DWusb+4AOVv6liUpkqJpU3KiaVqeILlZOKN1TeqJhUpoo3VH5TxYnKScWJylTxxcNa65qHtdY1D2uta+wP1lpXPKy1rnlYa13zsNa65mGtdc3DWuuah7XWNQ9rrWse1lrXPKy1rnlYa13zsNa65mGtdc3DWuuah7XWNQ9rrWv+DzyTlqwG7yhHAAAAAElFTkSuQmCC",
    "has_password": true
  }
}

Verify MFA after setup

Verify MFA after setup
POST/users/self/mfa/verify

Example URI

POST /users/self/mfa/verify
Request
HideShow
Body
{
  "token": "553328"
}
Response  200
HideShow
Body
{
  "code": "OK",
  "data": {
    "type": "user",
    "username": null,
    "first_name": "updated first name",
    "last_name": "Test",
    "email": "[email protected]",
    "phone_number": "+4368120265807",
    "created_at": 1493115498.770362,
    "id": "80a227b2-29a0-11e7-b636-e4a7a08e15d4",
    "address_id": null,
    "cover_image_url": "https://test.cloudfront.net/80a227b2-29a0-11e7-b636-e4a7a08e15d4/f0cf92c0-f7fc-11f0-8c7d-09c4c6e349ce.jpg",
    "profile_image_url": "https://test.cloudfront.net/80a227b2-29a0-11e7-b636-e4a7a08e15d4/f0d5d450-f7fc-11f0-8c7d-09c4c6e349ce.jpg",
    "updated_at": 1769132619.292185,
    "user_status": "Active",
    "profile_image_thumbnail_url": null,
    "cover_image_thumbnail_url": null,
    "email_confirmed": true,
    "timezone": "America/Chicago",
    "user_type": "Agent",
    "deleted_at": null,
    "phone_confirmed": true,
    "is_shadow": false,
    "personal_room": null,
    "brand": null,
    "fake_email": false,
    "features": [
      "Deals"
    ],
    "last_seen_at": null,
    "email_signature": "Here is my great signature",
    "daily_enabled": true,
    "email_quota": 30000,
    "website": null,
    "instagram": null,
    "twitter": null,
    "linkedin": null,
    "youtube": null,
    "facebook": null,
    "designation": null,
    "tiktok": null,
    "mfa_enabled": true,
    "xpressdocs_user_id": "80a227b2-29a0-11e7-b636-e4a7a08e15d4",
    "current_time": "7:43 PM - Thursday Jan 22, 2026",
    "push_allowed": true,
    "agents": [
      {
        "id": "69a677f8-65e3-4e1e-ab92-4dc2c38093d8",
        "email": "[email protected]",
        "mlsid": "00920130",
        "fax": "(972) 264-4703",
        "full_name": "Gholi Sweet",
        "first_name": "Gholi",
        "last_name": "Sweet",
        "middle_name": null,
        "phone_number": "(972) 264-4703",
        "nar_number": "797500044",
        "office_mui": "15512742",
        "status": "Active",
        "office_mlsid": "RCHT01X",
        "work_phone": "(469) 358-8080",
        "generational_name": null,
        "matrix_unique_id": "155155530",
        "updated_at": 1769132617.800233,
        "deleted_at": null,
        "created_at": 1769132617.800233,
        "mls": "NTREIS",
        "license_number": null,
        "designation": null,
        "nrds": "01053140",
        "type": "agent",
        "office_id": null,
        "secret_questions": [
          "(972) XXX-XX03",
          "jewellxxxxxxxxxxxxxal.net",
          "(469) XXX-XX80"
        ]
      }
    ],
    "last_seen_type": null,
    "active_brand": null,
    "display_name": "updated first name Test",
    "abbreviated_display_name": "updated first name",
    "online_state": "Offline",
    "has_password": true
  }
}

Validate an MFA token

Validate an MFA token
POST/users/self/mfa/validate

Example URI

POST /users/self/mfa/validate
Request
HideShow
Body
{
  "token": "553328"
}
Response  204

Remove MFA

Remove MFA
DELETE/users/self/mfa

Example URI

DELETE /users/self/mfa
Request
HideShow
Body
{
  "token": "553328"
}
Response  204

Generated by aglio on 23 Jan 2026