Yapit Developers
Applications
Yapit platform documentation

Build on Yapit.

Everything you need to create bots and integrations for your communities. Start with the Node.js SDK, explore the REST API, and build tools that make Yapit yours.

Choose where to begin

Find the tools, API methods and guides for your next integration.

Developer workspace: Create bot applications, configure permissions, manage installations and review verification from the Applications area. Open Applications ↗

No documentation sections matched your search. Try a method name, scope or event.
Start here · 01

Quick start

Build your first Yapit bot with Node.js. The SDK takes care of bot authentication and event polling so you can focus on your bot's behaviour.

Create a bot ↗
1
Create a bot application

Open the Yapit bot dashboard and create an application. Save the token when it is displayed; it cannot be retrieved later.

2
Install it in a guild

Choose a guild you own and install the bot there. Bots can only access guilds where they have been installed.

3
Download the SDK

Use the Yapit Bot SDK archive. Extract the yapit-bot-sdk folder beside your bot project.

4
Run your bot

Use Node.js 20 or newer, install the local SDK package, set your token as an environment variable, and start your bot.

Your first bot

This minimal example connects to Yapit and replies to !ping in a guild where the bot is installed. Enable messages.read and messages.write in the bot dashboard for this example.

JavaScript · index.js
import { YapitBot } from 'yapit-bot-sdk';

const bot = new YapitBot({
  token: process.env.YAPIT_BOT_TOKEN,
  baseUrl: process.env.YAPIT_API_URL || 'https://yapit.online',
});

bot.on('ready', ({ bot: me }) => {
  console.log('Connected as ' + me.username);
});

bot.on('messageCreate', async (message) => {
  if (message.author.isBot) return;
  if (message.content.trim().toLowerCase() === '!ping') {
    await bot.sendMessage(message.channelId, 'Pong!');
  }
});

await bot.start();

Keep YAPIT_BOT_TOKEN in your environment, not in browser code or a public repository. See Security for more.

Manage · 02

Bot applications

Your Yapit account is where you create and manage the bot applications that power your integrations.

Application identity

Set your bot's username, description and profile icon from its management page.

Bot token

Generate a private token when you create a bot. It authenticates the bot SDK and API; it is shown once and can be rotated if lost or exposed. It is never an invite link.

Permissions

Choose the scopes your bot needs. You can update them later and restart the bot to reload its scopes.

Guild installation

Install your own bot into guilds you own from the dashboard. Other users can add a public, verified bot from its Yapit profile with the Add Bot action.

Verification

Eligible bot owners can submit a verification application and review its status or staff feedback.

Bot Discovery

Verified bots can be listed in Bot Discovery when their owner enables listing.

Manage your applications

The public docs site does not store bot tokens or manage application settings. Sign in to Yapit to create, edit, install or remove your bots.

Build · 03

Node.js SDK

The official Yapit Bot SDK wraps the REST API and event polling in a small Node.js client. It requires Node.js 20 or newer.

Download SDK ↓

Install locally

Extract the SDK beside your bot project, then install it from your bot project's directory:

Terminal
npm install ../yapit-bot-sdk

Core methods

MethodPurpose
getMe()Read the bot identity and granted scopes.
getGuilds()List guilds where the bot is installed.
getChannels(guildId)List channels in an installed guild.
getMembers(guildId)List members in an installed guild. Requires members.read.
getEvents({ after })Fetch message events. Requires messages.read.
getMemberEvents({ after })Fetch member and role events. Requires members.read.
getGuildEvents({ after })Fetch guild and role-management events. Requires manage_guild.
sendMessage(channelId, content)Send a text message. Requires messages.write.
start() / stop()Start or stop the SDK's event pollers.

Runtime notes

  • Use a host that supports a persistent Node.js process and environment variables. A static-only website host cannot keep a bot running.
  • The SDK stores separate event cursors in .yapit-event-cursor.json, so each stream can advance independently.
  • Pollers are started automatically by bot.start() for the scopes granted to your bot.
  • Call await bot.stop() when shutting down cleanly.
Reference · 04

REST API reference

Bot API requests are sent to the Yapit API using POST and a JSON request body. Authenticate with your bot token in the Authorization header.

Base URL and authentication

HTTP request
POST https://yapit.online/api.php?a=bot_me
Authorization: Bearer YOUR_BOT_TOKEN
Content-Type: application/json

{}
Same call in other languages
curl -X POST "https://yapit.online/api.php?a=bot_me" \
  -H "Authorization: Bearer $YAPIT_BOT_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{}'

Use the action name in the a query parameter. The request body is JSON. Do not send the bot token as a URL parameter.

Available actions

ActionRequired scopeDescription
bot_meValid tokenRead the bot profile and public Bot/User IDs.
bot_heartbeatValid tokenRefresh bot presence. SDK polling requests also refresh presence.
bot_guildsguilds.readList guilds where the bot is installed.
bot_channelschannels.readList channels for an installed guild. Body: { "guild": 123 }.
bot_membersmembers.readList members in an installed guild and return public User IDs. Body: { "guild": 123 }.
bot_eventsmessages.readPoll new message events. Pass after to continue from the previous cursor.
bot_member_eventsmembers.readPoll member and role events. Use the returned next_cursor on the next request.
bot_moderation_eventsmoderation.readPoll timeout, kick, ban and unban events with actor, reason and expiry details when available.
bot_guild_eventsmanage_guildPoll guild and role-management changes using a separate cursor.
bot_send_messagemessages.writeSend text to a channel. Body: { "channel": 123, "content": "Hello" }.
bot_commands_registercommandsReplace the full slash-command list. Body: { "commands": [...] }.
bot_interactionscommandsPoll slash-command interactions. Pass after; the endpoint returns immediately. The SDK polls every 10 seconds by default.

Guild boundaries: Guild, channel and member lookups are limited to guilds where the bot is installed. A bot cannot use these endpoints to browse unrelated communities.

The current bot API uses REST requests and event polling. It does not provide a public WebSocket gateway, webhooks, voice support or message attachments.

Access control · 05

Permissions & scopes

Grant only the scopes your bot needs. Required scopes are included automatically; optional scopes control access to additional data and actions.

Manage scopes ↗
guilds.read

Required. Read the guilds where the bot is installed.

channels.read

Required. Read channels within installed guilds.

messages.read

Receive new message events through the message event stream.

messages.write

Send text messages to channels. Also required when using interaction.reply().

members.read

Read member lists and receive member and role events.

messages.mention

Use Yapit user mentions when sending messages. Sending still requires messages.write.

moderation.read

Receive moderation events such as timeouts, kicks, bans and unbans.

manage_guild

Subscribe to guild configuration and role-management events. This is an event subscription, not permission to edit guild settings.

commands

Register slash commands and receive command interactions.

Apply permission changes

  1. Open Developers → Manage bot → Permissions in Yapit.
  2. Enable the scopes your bot needs and save the changes.
  3. Restart your Node.js bot so the SDK reloads its granted scopes.
Least privilege

Do not request every scope by default. Start with the minimum permissions for your bot's features and add more only when needed.

Interactions · 06

Slash commands

Slash commands are registered by your bot's code. The SDK polls command interactions automatically when the bot has the commands scope.

1. Enable the required scopes

Enable commands to register commands and receive invocations. Enable messages.write if the bot will answer using interaction.reply(). You do not need messages.read for slash commands.

2. Register the command definitions

Call registerCommands() with the complete command list. Registration replaces the current list; it does not append to it.

JavaScript · commands.js
await bot.registerCommands([
  { name: 'ping', description: 'Check whether the bot is online.' },
  {
    name: 'say',
    description: 'Repeat text in this channel.',
    options: [
      {
        name: 'text',
        description: 'Text to repeat.',
        type: 'string',
        required: true
      }
    ]
  }
]);

3. Handle command interactions

JavaScript · interactionCreate
bot.on('interactionCreate', async (interaction) => {
  if (interaction.commandName === 'ping') {
    await interaction.reply('Pong!');
  } else if (interaction.commandName === 'say') {
    await interaction.reply(interaction.options.getString('text'));
  }
});

await bot.start();

Command and option limits

  • Up to 100 commands per bot and up to 25 options per command.
  • Command names are 1–32 lowercase letters, numbers, underscores or hyphens.
  • Descriptions are 1–100 characters. String option values are limited to 1,000 characters.
  • Supported option types: string, integer, number, boolean and user.
  • Use getString, getInteger, getNumber, getBoolean or getUser to read values.

What users type

For one option, users can enter /say Hello there. For several options, named pairs such as /profile user:<@123456789012> are recommended. A user option must identify a member of the current guild.

Response visibility: interaction.reply(content) sends a normal message to the command's channel. It is not a private or ephemeral response, and it requires messages.write.

Event streams · 07

Events

Yapit delivers bot events through separate polling streams. The SDK manages the cursors and emits convenient event names for your listeners.

Message events

Enable messages.read to receive message events. The SDK emits messageCreate for new messages.

Channel mentions

The SDK emits mention_channel when a valid channel is mentioned with #. The event contains channel, sourceChannel, guild, author and the normalized message. Mentioned channel IDs are resolved only inside the message's own guild.

JavaScript · mention_channel
bot.on('mention_channel', ({ channel, sourceChannel, author, message }) => {
  console.log(
    author.username + ' mentioned #' + channel.name +
    ' in #' + sourceChannel.name
  );
});

Member and moderation events

ScopeEventsDetails
members.readmember_join, member_leaveMember and guild snapshots.
members.readmember_role_add, member_role_removeMember, role and guild details.
moderation.readmember_timeout, member_untimeoutModeration actor, reason and expiry details when available.
moderation.readmember_kick, member_ban, member_unbanMember and actor details, with reason when supplied.

Guild-management events

Enable manage_guild to receive guild configuration and role lifecycle events. The SDK emits manage_guild and direct action events such as guild_update, role_create, role_update, role_delete and roles_reordered, along with camel-case aliases.

Important distinction

manage_guild subscribes to events; it does not grant a bot the ability to edit guild settings or roles.

Independent cursors

Each stream has its own saved cursor in .yapit-event-cursor.json: cursor for messages, memberCursor for member events, guildCursor for guild events and interactionCursor for slash commands. A failure in one stream does not stop the others.

Best practices · 08

Security

Bot tokens provide access to your bot's granted permissions. Treat them with the same care as account passwords.

Keep tokens server-side

Store tokens in environment variables. Never place them in frontend JavaScript, browser storage or client-side application code.

Do not commit secrets

Keep real tokens out of Git repositories, screenshots, logs and shared messages. Add local secret files to .gitignore.

Rotate exposed tokens

Reset a token immediately if it may have been exposed. A reset invalidates the previous token.

Limit permissions

Grant only the scopes required by your bot and review them when its features change.

Suggested environment

Environment variables
YAPIT_BOT_TOKEN=your_private_bot_token
YAPIT_API_URL=https://yapit.online

Never expose a real token in an issue report or support request. If you need help debugging a bot, share the error message and remove credentials first.