APA docs
Your website’s own assistant, with the name you choose. One line on your site, or the chat API for apps, WhatsApp bots and call centres.
Quick start
- Sign in with your work email and add your website.
- Verify it, then create your assistant: her name, greeting, tone, colours and voice.
- She reads your site in minutes. Try her in the Test tab.
- Paste the widget on your site, or use the chat API.
Verify your website
APA only learns and answers on sites you have proven are yours. Add a TXT record cabana-site-verification=<token>, a meta tag <meta name="cabana-site-verification" content="<token>">, or a file /<token>.txt. We look again every day; if the site turns into something APA cannot be used with, she pauses until a person checks.
How she learns
She reads your sitemap and pages, following robots.txt, and keeps up: she re-reads your site every day, and when the widget notices a page has changed she re-reads that page from your server straight away. Pages that disappear are forgotten. What a visitor’s browser shows is never stored as knowledge, so no one can teach her false facts through the widget. You can add text and FAQs, and exclude pages, in the console or by API.
How she stays truthful
She answers only from your pages, your added knowledge and your custom actions. After she writes a reply, every price, number, phone number, email address and link in it is checked against those sources, and anything not found is removed. When the answer is not there she says so and offers to connect the visitor with your team. Typos, accents, Sheng and Pidgin are understood: questions are corrected against the words on your own site before searching.
The widget
Paste before </body> on every page. The key is publishable and only works on your verified site. The console’s Install tab gives you the exact line.
<script async src="https://cabana.africa/apa/w.js" data-key="apa_pk_live_…" data-bot="<assistant id>"></script>It runs in its own shadow root, so your page’s styles cannot break it, and it reads the page the visitor is on so she knows what they are looking at.
JavaScript API
APA.open(); // open the chat
APA.close(); APA.toggle();
APA.ask('Do you have rooms this weekend?'); // open and ask
APA.setContext({ page: 'room', room: 'Deluxe Ocean View', price: 'KES 14,000' });
APA.on('lead', e => console.log(e)); // also: message, handoff, open, closeContext you set is used to understand the question; facts in her answer still have to come from your site.
Voice
Visitors can tap the microphone and talk, hands-free: she listens, answers aloud, and listens again until they stop. Speech is recognised by the visitor’s browser; her voice comes from our speech service, or the device’s own voice where that is unavailable. Pick her voice in Personality.
Page actions
She can move the visitor around your site: open a page, scroll to a section, highlight something, fill a form field for them to check, or press a button you allow. Actions only ever target your own site and are shown to the visitor as they happen. Turn each kind on or off in Actions.
Authentication
Base URL https://cabana.africa/api/apa/v1. From your server, send a secret key: Authorization: Bearer apa_sk_….
Chat
| Field | Meaning |
|---|---|
bot | The assistant’s id (optional with one assistant) |
message | What the person said, up to 2,000 characters |
visitor | Your ID for the person, so conversations are kept apart |
conversation_id | To continue a conversation |
client_id | Your message ID; a retry with the same one returns the same reply |
channel | e.g. whatsapp, app, call |
tz | The person’s time zone, e.g. Africa/Nairobi |
curl -X POST https://cabana.africa/api/apa/v1/chat \
-H "Authorization: Bearer apa_sk_live_…" -H "Content-Type: application/json" \
-d '{"message":"Bei ya safari ya Mara ni ngapi?","visitor":"wa-254700000000","channel":"whatsapp"}'
# → { "conversation_id": "…", "reply": "…", "sources": [ { "title", "url" } ], "actions": [], "handoff": false, "lang": "sw" }Add knowledge
{ "bot": "…", "title": "Cancellation policy", "text": "Full refund up to 14 days before…",
"faq": [ { "q": "Can I pay with M-Pesa?", "a": "Yes, Paybill 123456." } ] }Send a url to replace an earlier entry with the same address.
Conversations
The messages, with the sources each answer used.
Deletes the conversation and its messages for good, for example when a visitor asks to be forgotten.
Custom actions
Let her ask your own systems: availability, prices, booking status. Add an action in the console with a name (like check_availability), a description of when to use it, an https address and its parameters as JSON Schema. When she needs it, we POST:
{ "tool": "check_availability", "arguments": { "date": "2026-12-24", "guests": 2 },
"conversation_id": "…", "assistant": "…", "visitor": "…" }signed with Cabana-Signature (see webhooks) under the action signing secret shown in the console. Answer within 8 seconds with JSON or text; she uses only what you return.
Webhooks
| Event | When |
|---|---|
apa.lead | A visitor left their name and a way to reach them |
apa.handoff | A visitor asked for a person, with the last messages |
property.verified, property.updated | Your website was verified, or its standing changed |
ping | A test from the console |
Check Cabana-Signature: t=…,v1=…: an HMAC-SHA256 of t + "." + raw body under your signing secret; reject anything older than five minutes. Failed deliveries retry after 1, 5 and 30 minutes, then 2, 6 and 24 hours.
import { createHmac, timingSafeEqual } from 'node:crypto';
export function verified(rawBody, header, secret) {
const p = Object.fromEntries(String(header).split(',').map(x => x.split('=')));
if (!p.t || Math.abs(Date.now() / 1000 - Number(p.t)) > 300) return false;
const want = createHmac('sha256', secret).update(`${p.t}.${rawBody}`).digest('hex');
return want.length === String(p.v1).length && timingSafeEqual(Buffer.from(want), Buffer.from(p.v1));
}Errors and limits
Errors are JSON: { "error": "…", "code": "…" }: 400, 401 invalid_key, 402 trial_ended, 403 paused or origin_not_verified, 404, 429. The free trial includes one assistant on one website, 150 pages, 300 conversations and 3,000 messages a month, voice, and two custom actions.
Privacy
APA is operated by Cabana, Nairobi, Kenya. Contact apa@cabana.africa.
- Your website: we read and keep your public pages to answer from them.
- Visitors: we keep conversations, a random visitor ID stored in their browser, the page they were on, and any details they choose to give (like a name and phone number for a lead), for your business to follow up. Voice is turned into text by the visitor’s browser.
- Service providers: hosting and database (Vercel, Supabase), email (Resend), and AI models run on Groq and Cloudflare Workers AI, which process messages and your page text to write replies and her voice.
- Retention: conversations are kept while your account is open; you can delete any of them in the console or by API. Your business decides how it uses leads.
- Rights: visitors can ask you, or us, to see or delete their conversation.
Terms of service
Please read these terms carefully. They explain what you can expect from us and what we expect from you.
1. About these terms
These terms are the agreement between you (the business or organisation that opens a workspace, “you”) and Cabana, operating APA from Nairobi, Kenya (“we”, “us”). They apply to the APA website, console, scripts, widgets, links, APIs, webhooks, sandbox and any email or support we provide for it (together, the “Service”). By creating a workspace, adding a website or app, creating an API key, or otherwise using the Service, you accept these terms. If you accept them for an organisation, you confirm you have the authority to bind it. If you do not agree, do not use the Service.
APA is a separate service. It has its own terms, and nothing here gives you rights in other Cabana services.
2. Who may use it
You must be at least 18, be able to enter a contract, and use the Service for business, professional or organisational purposes, not as a consumer. You must give us true and current information when you sign up and keep it up to date. One person may manage several workspaces; each is a separate account.
3. Your workspace and your team
You are responsible for everything done through your workspace, your sign-in codes and your API keys, including by people you invite. Keep secret keys on your servers only, never in a web page, app or public repository. Tell us at once if you think a key or an email account has been compromised so we can help you revoke it. We may assume anyone using your keys or signed in as you is acting for you.
4. Proving you own your website or app
Nothing runs on a website or app until you prove it is yours, by a DNS record, a meta tag or a file for a website, or a declaration on your developer website plus your store listing for an app. You promise that you own or are authorised to manage every website and app you add, and that you will keep the proof in place. We re-check every day. If the proof disappears you have seven days to restore it before the property stops being verified. If a site stops matching what you registered, we may pause the Service on it, tell you why, and restore it once a person at APA is satisfied. This protects the people who use your site and everyone else who uses the Service. You agree to this monitoring.
5. Acceptable use
You must not, and must not let anyone else:
- break any law, or use the Service for or on a website or app that is unlawful, deceptive, fraudulent or harmful (including gambling or adult content you are not licensed for, phishing, counterfeit or fake documents, investment fraud, drugs or weapons trade, or content that exploits children);
- run the Service against a website or app you do not own or manage, or pretend to be another business or person;
- probe, scan, overload or try to get around the security or the limits of the Service, or attempt to reach another customer’s data;
- copy, resell, white-label or build a competing service from the Service, or use its output to train a competing model, without our written agreement;
- share your keys, or use more than one free trial by opening several workspaces;
- use the Service in a way that breaches the rights of anyone else.
We may suspend or limit anything that breaks this section, immediately if there is a risk to people or to the Service.
6. What APA does
APA lets you add an AI assistant, with a name you choose, to your website or app. She learns your pages and the knowledge you add, and answers your visitors from them, by text or voice. Each assistant is a child of Cabana’s own APA, which supplies her brain and a set of rules that apply to every assistant. You choose her name, greeting, tone, colours, voice, knowledge and actions.
7. Tell people they are talking to an assistant
You must make clear to visitors that they are talking to an automated assistant, and you must not let her pose as a human or as a named person. The default greeting does this; if you change it, keep it clear. You must offer a way to reach a person where the law, or the importance of the matter, requires it. APA can offer to connect a visitor with your team, and you are responsible for answering leads and requests that she passes to you.
8. What she says is based on your content
She answers only from your website, the knowledge you add and the actions you connect. A check removes prices, numbers, phone numbers, email addresses and links that are not in those sources. This reduces mistakes but cannot remove them. AI can still misread, misunderstand or omit things. You are responsible for keeping your content accurate and complete, for the answers she gives from it, and for any commitments made on your behalf. Do not rely on her for medical, legal, financial or safety-critical advice, and do not add knowledge that tells her to give it. We may set rules that apply to all assistants to prevent this.
9. What not to collect
Do not use APA to collect card numbers, passwords, one-time codes, government ID numbers, health information or other sensitive data she was not built for, and do not instruct her to. She is built to avoid asking for them, and her actions never fill in payment or password fields. You are responsible for any data your visitors choose to give through her, including leads, and for how you use it.
10. Page actions and custom actions
Page actions (opening pages, scrolling, highlighting, filling fields for the visitor to check, and pressing buttons you allow) stay on your own website and are shown to the visitor as they happen. Custom actions call addresses you provide, on the public internet over HTTPS, with a signature you can verify. You are responsible for what those systems do, for securing them, and for what they return, which she will use as a source. You must not point an action at a system you are not entitled to use.
11. Voice
Voice conversations use the visitor’s browser to turn speech into text and our speech service, or the device’s own voice, to speak. You must give visitors any notice and obtain any consent the law requires of you for voice interaction.
12. Conversations and leads
Conversations, the visitor’s details they choose to share, and the page they were on are kept in your workspace for you to read and use. You can delete any conversation in your console or by API, for example when a visitor asks to be forgotten. We may review conversations to keep the Service safe, to investigate misuse, and, in aggregate, to improve it.
13. Data protection
For your visitors’ conversations and leads, you decide why they are collected and how they are used, and APA processes them for you. We are responsible for our own systems and for the safety and quality uses described in the privacy notice, which forms part of these terms. You will give your visitors the notices and obtain the consents the law requires of you. Each of us will comply with the data protection laws that apply to us, including the Kenya Data Protection Act, 2019, and, where they apply, the GDPR and similar laws. AI services (Groq and Cloudflare Workers AI) process messages and your page text to write her replies; they do so on our instructions.
14. Trial, plans and prices
APA is free during the trial programme, with the limits shown in your console, for the period shown there. Paid plans and their prices are coming soon. We will announce them well before any charge, you will not be charged anything unless you choose a paid plan and agree to its price, and we will give you reasonable notice before the free trial or any free feature ends or changes. Limits may be adjusted to prevent abuse.
15. Our service, and changes to it
We work hard to keep the Service available and correct, but we do not promise it will be uninterrupted or error-free. We may change, improve or remove features, run maintenance, and set or change usage limits. If we make a change that materially harms you, we will give notice where we reasonably can. The sandbox and test keys are for building and are not for production use.
16. Intellectual property
We own the Service and everything in it, including its software, models, scores, designs, documentation and brand. You get a limited, non-exclusive, non-transferable, revocable right to use the Service during these terms, for your own business, in line with them. You keep everything that is yours: your websites, content, data and brand. You give us the rights we need to read, process and store them to run the Service for you, and, where these terms or the privacy notice say so, to improve our fraud and quality systems. Feedback you give may be used by us without obligation.
17. Confidentiality
Each of us will keep the other’s non-public information confidential, use it only for the Service, and protect it with reasonable care, except where we must disclose it by law or to our advisers and service providers who are bound to confidentiality. Information that is public, or that we learn lawfully from someone else, is not confidential.
18. Disclaimer
The Service is provided “as it is” and “as available”. To the fullest extent the law allows, we give no warranties of any kind, express or implied, including merchantability, fitness for a particular purpose, accuracy, non-infringement, or that results will be achieved. Outputs of automated systems, including AI, can be wrong; you are responsible for how you use them and for your own decisions. Nothing in these terms limits anything that cannot lawfully be limited.
19. Limits on our liability
To the fullest extent the law allows, we are not liable for indirect, incidental, special, consequential or punitive loss, loss of profit, revenue, goodwill or data, or business interruption, even if told it might happen. Our total liability to you for all claims arising from the Service in any 12 months is limited to the amount you paid us for the Service in the 12 months before the first claim, or, if you have paid nothing, to KES 10,000. These limits do not apply to liability that cannot be limited by law, including for fraud or for death or personal injury caused by negligence.
20. Your responsibility to us
You will compensate us for losses, claims, fines and reasonable costs that come from your breach of these terms, your breach of law, your content, or your use of the Service in a way we did not allow, including claims by people whose data you handled through the Service. We will tell you promptly of a claim, let you help defend it, and not settle it in a way that binds you without your agreement, which you will not unreasonably withhold.
21. Suspension and ending
You may stop using the Service at any time and ask us to close your workspace. We may suspend or end the Service for you if you break these terms, if the law requires, if keeping you would put people or the Service at risk, or if we stop offering the Service, and we will tell you why where we can. When a workspace ends, your keys stop working. We delete or anonymise its data as set out in the privacy notice, keeping only what we must by law or need to protect people from fraud. Clauses that by their nature should survive (including ownership, confidentiality, disclaimers, liability, compensation and governing law) do.
22. Notices and support
We will contact you at the email of your workspace owner, and by notices in your console. You can write to us at apa@cabana.africa. Please keep the owner email current: notices sent to it count as received.
23. Changes to these terms
We may update these terms. We will give notice of material changes in your console or by email before they apply, and the date at the bottom will change. If you keep using the Service after the change applies, you accept the new terms. If you do not agree, you may stop and close your workspace.
24. Law and disputes
These terms and any dispute about them are governed by the laws of Kenya. We will try to settle any dispute in good faith first. If we cannot, the courts of Kenya have exclusive jurisdiction, except that either of us may ask any court for urgent protection of its intellectual property or confidential information. If a part of these terms is found unenforceable, the rest still applies. Our failure to enforce a right is not a waiver of it. You may not transfer these terms without our written consent; we may transfer them as part of a merger or sale of the business. These terms, with the privacy notice, are the whole agreement for the Service.
Last updated 15 October 2026.