# Qweaver — The AI workforce platform (full text)

Qweaver is a suite of AI business products for SMBs, sharing one login, one credit pool, and one company brain. Built and operated by Digital 9 Labs, Singapore. Every tool has two doors: the app a team uses, and an API an AI agent uses.

## Products
- Qweaver QweaverOS (https://app.qweaver.com): AI Business Operating System — The control room for your AI employees.
- Qweaver Helix (https://helix.qweaver.com): AI Website Builder — Your AI web designer.
- Qweaver Loom (https://loom.qweaver.com): AI Content Writer — Your AI content writer.
- Qweaver Flow (https://flow.qweaver.com): AI Automation Software — The one that links the whole suite.
- Qweaver Core (https://core.qweaver.com): AI CRM — Your sales follow-through.
- Qweaver Nexus (https://nexus.qweaver.com): AI Gateway, Credits & Loyalty — The power and routing behind the team.
- Qweaver Forge (https://forge.qweaver.com): ERP, Finance & Custom Software — Your ERP and financial source of truth.

## Docs
- Agents: start here: https://qweaver.com/docs/agents-start-here
- QweaverOS Agent API: https://qweaver.com/docs/qweaveros-agent-api
- WhatsApp for agents: https://qweaver.com/docs/whatsapp-for-agents
- Helix Agent API: https://qweaver.com/docs/helix-agent-api
- Loom Content API: https://qweaver.com/docs/loom-content-api
- Loom Agent API: https://qweaver.com/docs/loom-agent-api
- Flow Agent API: https://qweaver.com/docs/flow-agent-api
- Core Agent API: https://qweaver.com/docs/core-agent-api
- Forge Agent API: https://qweaver.com/docs/forge-agent-api
- Nexus Agent API: https://qweaver.com/docs/nexus-agent-api

---

# Agents: start here

Every Qweaver tool exposes a self-documenting agent API driven by one qwa_ key. Here is the map, and the polite-agent contract.

Qweaver is an AI-workforce platform: one login, one credit pool, one company brain, and a suite of tools (website builder, content studio, automation, CRM, finance, credits). Every tool has two doors — the app a team uses, and an agent API. One qwa_ key (the Agent Kit, issued per person per workspace in QweaverOS) works across the whole suite; each key carries tool grants, and you act with exactly the permissions of the person whose key you hold.

## The suite, one endpoint each

Every endpoint below is self-documenting: GET it with no auth and it returns its own always-current manual. Treat those manuals, not these pages, as the source of truth.

| Tool | Endpoint | What it does |
| --- | --- | --- |
| QweaverOS | https://app.qweaver.com/api/agent | Control plane: identity, company brain, approvals, skills, the agent runner |
| Helix | https://helix.qweaver.com/api/agent | Websites, landing pages, and quiz funnels |
| Loom | https://loom.qweaver.com/api/agent | SEO articles and content |
| Flow | https://flow.qweaver.com/api/agent | Scheduled reports, cross-suite workflows, WhatsApp delivery |
| Core | https://core.qweaver.com/api/agent | CRM: contacts, deals, proposals, follow-ups, lead forms |
| Forge | https://forge.qweaver.com/api/agent | Finance: double-entry books, AR/AP, GST, tamper-evident ledger |
| Nexus | https://nexus.qweaver.com/api/agent | Credits, rate card, loyalty points, the model gateway |

## Your first three calls

```bash
# 1. Verify the key and see who you act as
curl -s https://app.qweaver.com/api/agent/verify \
  -H "Content-Type: application/json" -d '{"key":"qwa_..."}'

# 2. Bootstrap: identity + company rules + brain index + capability manifest, in one call
curl -s https://app.qweaver.com/api/agent \
  -H "Authorization: Bearer $QWA_KEY" -H "Content-Type: application/json" \
  -d '{"action":"bootstrap"}'

# 3. Read a tool's live manual before calling it
curl -s https://core.qweaver.com/api/agent
```

## The polite-agent contract

- Read the manual first: GET each tool’s /api/agent before calling actions, and use {"action":"capabilities"} for the machine-readable manifest with readOnly and meters flags per action.
- You act as a person: 403 means "not allowed for this person" (tool not granted, or a hidden brain folder), not a bug. 401 means the key was rotated — the owner downloads a fresh Agent Kit.
- Echo the request id from responses when reporting a problem.
- Metered actions spend the workspace’s shared Nexus credits; check {"action":"rates"} on Nexus to estimate before you fire.
- Outbound messages to real customers route through human approval — see WhatsApp for agents.

## Self-serve onboarding, end to end

You can go from nothing to an authenticated agent without a human in the loop. Three calls: create the workspace, fetch your key, bootstrap.

```bash
# 1. Create a workspace (free, 100 credits, a content site, no card).
#    Keep the cookie jar: the key fetch below is session-authenticated.
curl -s -c jar.txt https://app.qweaver.com/api/auth/signup \
  -H "Content-Type: application/json" \
  -d '{"name":"Your Name","email":"you@company.com","password":"at-least-8-chars","company":"Your Company"}'
# → {"ok":true,"companyId":"your-company","agent":{"keyUrl":"/api/admin/user-kit?format=json&..."}}

# 2. Fetch your agent key as JSON (follow the keyUrl the signup returned)
curl -s -b jar.txt "https://app.qweaver.com/api/admin/user-kit?format=json&companyId=your-company&email=you@company.com"
# → {"key":"qwa_...","role":"owner","tools":[...]}

# 3. Start working
curl -s https://app.qweaver.com/api/agent \
  -H "Authorization: Bearer qwa_..." -H "Content-Type: application/json" \
  -d '{"action":"bootstrap"}'
```

- The same key works across every tool in the suite; it carries the tool grants of the person it belongs to.
- A human owner can also issue and re-download Agent Kits in QweaverOS (Settings → Workspaces); ?format=json returns the key, the default returns a printable PDF.
- Free tier: 100 credits at signup. Credits are spent only when Qweaver’s own AI generates — reads, saves, scheduling, CRM and every call you make with your OWN model are free, so a BYO-model agent can run a workspace at zero cost. Full detail at https://qweaver.com/pricing.
- Machine-readable site summaries live at https://qweaver.com/llms.txt and https://qweaver.com/llms-full.txt.

---

# QweaverOS Agent API

The control plane: verify your key, learn the company from its brain, see what needs a human, and run long tasks — everything else hangs off this.

QweaverOS is the control plane for the whole suite: identity, the company brain, approvals, and the tools. Its agent API is where every session should start — the live manual literally opens with "START HERE" and is written to be pasted into any AI along with the owner’s key.

## Endpoint and auth

```text
POST https://app.qweaver.com/api/agent
Authorization: Bearer <your qwa_ key>
Content-Type: application/json

# Key verification (no bearer needed):
POST https://app.qweaver.com/api/agent/verify  {"key":"qwa_..."}
```

You act with exactly the permissions of the person whose key you hold — no more, no less. {"action":"bootstrap"} returns identity, company rules, your private notes, the brain index, and a capability manifest in one call; {"action":"capabilities"} gives exact parameter schemas so you never guess a param name.

## The company brain

- brain_list / brain_read / brain_search — the notes this person can see; folders are open by default, hiding is a per-person deny an owner sets.
- brain_write — owners and managers create or update notes (same path = update, full history); a STAFF key’s write becomes a pending proposal (202) an owner approves, so usage makes the brain smarter safely.
- brain_history / brain_restore / brain_snapshot / brain_versions — every edit is audited and reversible.
- branding — the company’s logo and exact colours; use them in anything you produce. Branding is managed only in QweaverOS and read-only everywhere else.
- personal_list / personal_read / personal_write — your private notes and preferences, readable by no other member, auto-loaded into your context.

## Approvals, skills, and the runner

- {"action":"approvals"} — items waiting for a person (for example a WhatsApp reply you drafted). You draft; a human approves before anything leaves the company.
- skills_list / skill_read — reusable playbooks for how this company does things; when a task matches a skill’s description, read it and follow it before improvising.
- POST /api/agent/run {"goal":"...","mode":"read_only"|"normal"} — the agent runner for long multi-step work; 202 with a runId to poll. read_only mode structurally cannot write, safe to schedule unattended.

## Side effects and safety

Read actions are free and safe. Writes create audited records. Tool actions may spend the workspace’s Nexus credits or queue a message for human approval. Nothing goes out to a real customer without a human approving it first.

## The live manual

```bash
curl -s https://app.qweaver.com/api/agent
```

---

# WhatsApp for agents

How an agent gets messages onto a company’s own WhatsApp line today: drafts a human approves, and Flow workflows with WhatsApp delivery.

A workspace connects its own WhatsApp line to Qweaver by scanning a QR from QweaverOS (WhatsApp Access) — the number stays the company’s own. Once a line is connected, agents have two live, guard-railed paths to get messages onto it.

## Path 1 — draft, human approves

Conversational replies to real customers are draft-first: the agent drafts, the message lands in the QweaverOS approvals queue ({"action":"approvals"}), and a human approves before anything is sent. Never assume something was sent — check. This is deliberate: nothing reaches a real customer without a person saying so.

## Path 2 — Flow delivery (scheduled and workflow sends)

Flow reports and workflows take WhatsApp as an output destination. An agent can create a scheduled report or a custom workflow through the Flow Agent API, set deliverWhatsapp, and each run’s result auto-delivers to the configured number — this is how "connect your agent, then let it build workflows that message you" works today.

```bash
curl -s https://flow.qweaver.com/api/agent \
  -H "Authorization: Bearer $QWA_KEY" -H "Content-Type: application/json" \
  -d '{"action":"create_report","name":"Weekly owner pulse",
       "sources":["core","forge","helix_leads"],"cadence":"weekly",
       "time":"09:00","timezone":"Asia/Singapore","daysOfWeek":["mon"]}'
```

## The guardrails

- WhatsApp delivery is an output destination, not permission to message arbitrary recipients.
- Customer-facing replies always route through human approval.
- Runs are metered on the workspace’s Nexus credits and logged.
- The line is the company’s own number (they scanned the QR); treat it with the care you would treat their phone.

Connecting a line: a workspace owner opens QweaverOS → WhatsApp Access, adds a line, and either scans the rotating QR or sends the public pairing link to the phone’s owner. Lines are per-workspace; agencies can share a client line’s inbound stream with an HQ workspace without re-pairing.

---

# Helix Agent API

Build and edit websites, landing pages, and quiz funnels by API — verify generated pages before publish, wire pixels, and run the AI chat widget.

Helix builds websites, landing pages, and quiz funnels. The agent API lets you create and edit sites the same way a human uses the app: describe what you want, verify what was generated, then publish.

## Endpoint and auth

```text
POST https://helix.qweaver.com/api/agent
Authorization: Bearer <your qwa_ key>   # needs the helix grant
```

## Highlights from the live manual

- get_page — read the generated page (sections, html, seo) BEFORE publish; the draft URL 404s until publish, this action is how you verify content first.
- update_site — set the site’s WhatsApp number, Meta Pixel ID, and GTM container; tags inject on every published page at serve time, no republish needed.
- The AI web-chat widget — configure persona and lead capture; it refuses to invent prices, and captured leads flow through the same rail as lead forms (stored + WhatsApp + Core CRM).
- Quiz funnels — multi-step funnels where contact details are collected late and the final WhatsApp CTA carries the visitor’s result and answers.
- Generation is billed on the workspace’s Nexus credits.

## The live manual

```bash
curl -s https://helix.qweaver.com/api/agent
```

---

# Loom Content API

Pull published articles from a Loom site as JSON: list, search, and fetch by slug, with the SEO fields your pages should use verbatim.

Loom is the Qweaver content studio. Every Loom site exposes its PUBLISHED articles through one JSON endpoint, so any website, app, or agent can render the blog without touching the studio. This is the same API the qweaver.com blog itself consumes.

## Endpoint and auth

```text
POST https://loom.qweaver.com/api/content
Authorization: Bearer <site API key>
Content-Type: application/json
```

- The key is per-site, found in Loom under the site’s Developer API section. Store it as a server-side env var (for example CONTENT_API_KEY); never ship it in client-side code.
- CORS is open (Access-Control-Allow-Origin: *), methods POST and OPTIONS.
- Only published articles are returned.

## List articles

```bash
curl -s https://loom.qweaver.com/api/content \
  -H "Authorization: Bearer $CONTENT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"action":"list_articles","limit":20,"offset":0}'
```

| Field | Type | Notes |
| --- | --- | --- |
| action | string | list_articles |
| limit | number | 1-50, default 20 |
| offset | number | default 0; page with pagination.has_more |
| sort | string | published_at_asc for oldest-first; default newest-first |
| search | string | optional text filter |
| category_slug / author_slug | string | optional archive filters |

The response carries articles[], pagination {limit, offset, total, has_more}, site {id, name, domain}, and generated_at.

## Fetch one article

```bash
curl -s https://loom.qweaver.com/api/content \
  -H "Authorization: Bearer $CONTENT_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"slug":"your-article-slug"}'
```

Passing a slug with no action returns the single article including its full content HTML. Article fields: id, title, slug, excerpt, featured_image, seo_title, meta_description, published_at, updated_at, category, author_name, category_slug, author_slug, canonical_url.

## Errors

| Status | Meaning |
| --- | --- |
| 401 | Missing or invalid API key |
| 404 | Article not found (bad slug, or not published) |
| 400 | Missing required payload (no action and no slug) |

## Rendering rules that make the SEO work

- Server-render the pages. AI crawlers (GPTBot, ClaudeBot, PerplexityBot) do not run JavaScript; a client-side-only blog is invisible to them.
- Use seo_title and meta_description verbatim as the page title and description.
- Emit canonical_url as the canonical link.
- Use featured_image as og:image.
- The content HTML can carry FAQ blocks; render them with FAQPage JSON-LD so answer engines can lift them.

---

# Loom Agent API

The agent-first way to operate Loom: a self-documenting endpoint driven by qwa_ agent keys with per-action capability flags.

Where the Content API is read-only delivery for websites, the Agent API is how an AI agent OPERATES Loom for its owner: articles, briefs, and the content pipeline. It is deliberately self-documenting so these docs cannot drift from the deployed behaviour.

## Read the manual first

```bash
curl -s https://loom.qweaver.com/api/agent
```

GET returns the always-current manual as markdown, no auth needed. Treat that document, not this page, as the source of truth for available actions.

## Calling actions

```bash
curl -s https://loom.qweaver.com/api/agent \
  -H "Authorization: Bearer $QWA_KEY" \
  -H "Content-Type: application/json" \
  -d '{"action":"capabilities"}'
```

- Auth is a qwa_ agent key (Qweaver Agent Kit), issued per workspace in QweaverOS by the owner; the key needs the loom grant.
- FIRST call in a brand-new workspace: {"action":"create_site","name":"My Blog"} — every article action needs a siteId, and a self-serve signup is provisioned with one already, so list_sites shows it.
- The capabilities action returns a machine-readable manifest of every action with its readOnly and meters flags: what this key can do, and what costs credits.
- Every response is JSON and carries a request id (also the x-request-id header on GET); echo it when reporting an issue.

---

# Flow Agent API

Scheduled cross-suite reports and custom workflows — with real scheduling, async runs, and WhatsApp delivery of results.

Flow automates: scheduled reports, cross-suite workflows, and SOPs. This is the tool that turns "my agent should send me a weekly pulse on WhatsApp" into three API calls.

## Endpoint and auth

```text
POST https://flow.qweaver.com/api/agent
Authorization: Bearer <your qwa_ key>   # needs the flow grant
```

## Highlights from the live manual

- create_report — a scheduled cross-suite report over sources like core, helix_leads, loom_social, campaigns, forge, nexus, web_analytics, search_console; real scheduling with time, IANA timezone, and daysOfWeek; format text or a branded PDF.
- create_workflow — custom multi-step recipes with named write steps (for example core_create_followup, nexus_award_points); confirm the owner’s intent before scheduling anything that executes writes.
- run_report / run_workflow — ASYNC: returns 202 with a jobId to poll; idempotencyKey makes retries safe (the same key returns the original job, deduped).
- deliverWhatsapp — results with a WhatsApp number auto-deliver. Delivery is an output destination, not permission to message arbitrary recipients.
- Email is guard-railed at the send layer and agents cannot bypass it: notification-kind only, a single recipient per call, suppression list always wins, out-of-hours sends defer.
- Runs are metered on Nexus credits and logged.

## The live manual

```bash
curl -s https://flow.qweaver.com/api/agent
```

---

# Core Agent API

The CRM by API: contacts with dedupe, deals and stages, proposals and quotes, follow-ups, hosted lead forms, and an evidence-based enrichment model.

Core is the CRM: contacts, pipeline, proposals, activities and follow-ups. Forge is the sole source of truth for invoices, payments, AR, recurring billing and accounting — Core hands won deals off to it.

## Endpoint and auth

```text
POST https://core.qweaver.com/api/agent
Authorization: Bearer <your qwa_ key>   # needs the core grant
```

## Highlights from the live manual

- summary — pipeline value and follow-ups due today, in one call.
- create_contact / import_contacts / update_contact — dedupes on email and WhatsApp number; bulk import fills missing fields on matches instead of duplicating (max 100 rows per call).
- list_deals / create_deal / move_deal / stale_deals — pipeline operations, including "which open deals have sat in their stage too long".
- log_activity / list_followups / create_followup — activity types include whatsapp, call, email, meeting, note; logging with a contactId stamps last_contacted_at.
- Proposals and quotes are draft-first: agents draft, status changes are human-only; share_quote returns the public accept/decline URL.
- create_form — a hosted lead form whose submissions auto-create the contact and open a high-priority follow-up; the default form captures name + WhatsApp + message.
- record_fact — enrichment writes require named EVIDENCE (for example crm.whatsapp-reply, crm.form-submission); sending a self-graded confidence score is a 400 by design.
- Broadcasts: agents draft only.

## The live manual

```bash
curl -s https://core.qweaver.com/api/agent
```

---

# Forge Agent API

Finance you can read but not corrupt: AR/AP, GST, stock and integrity checks by API, with exactly one deliberately draft-safe write.

Forge is the suite’s finance foundation: multi-company double-entry books, Singapore-first (GST) with US support. Journal entries form a per-company SHA-256 hash chain — immutability is enforced by database triggers and cryptographically verifiable.

## Endpoint and auth

```text
POST https://forge.qweaver.com/api/agent
Authorization: Bearer <your qwa_ key>   # needs the erp grant
```

A workspace holds many COMPANIES, each with its own chart of accounts, tax codes and base currency — resolve the company first with list_companies, never assume one. Amounts are exact-decimal strings ("1090.00").

## Read actions

- summary — AR/AP outstanding, bank balance, YTD P&L, top overdue, per company.
- list_invoices / ar_aging / ap_aging / list_payments — documents, aging buckets, posted payments.
- gst_summary — GST F5 boxes 1-8 computed from posted documents.
- stock_levels — weighted-average balances with below-reorder flags.
- verify_integrity — recomputes the journal hash chain; run it when anyone asks "can I trust these numbers?".

## The one write, and why

prepare_invoice creates a QUOTATION — no journal entry, no GL effect — for a human to review and convert inside the ERP. Posting is final in this ledger, so agents can never post invoices, payments, or journals directly. To fix a posted mistake a human reverses it; there is no edit or delete, by design.

## The live manual

```bash
curl -s https://forge.qweaver.com/api/agent
```

---

# Nexus Agent API

Credits, the rate card, and customer loyalty points — plus an OpenAI-compatible model gateway for developers.

Nexus is the suite’s money rail: the workspace’s top-up credit balance for running AI helpers, and — separately — the customers’ loyalty points programs. Keep the two apart when talking to an owner: points belong to the customer, not the wallet.

## Endpoint and auth

```text
POST https://nexus.qweaver.com/api/agent
Authorization: Bearer <your qwa_ key>   # needs the nexus grant
```

## Highlights from the live manual

- balance / spend_summary — the workspace credit balance and spend by tool.
- rates — the public rate card (credits per 1,000 tokens, per image, per run). Use it to estimate spend before you fire; provider cost and margin are never exposed.
- list_programs / award_points / deduct_points / adjust_points — loyalty programs keyed by customer phone; awards auto-enrol, deductions never go below zero, idempotency keys make retries safe.
- list_keys / create_key / revoke_key — workspace API keys; the raw secret is returned exactly once.

## For developers: the model gateway

```bash
curl -s https://nexus.qweaver.com/v1/chat/completions \
  -H "Authorization: Bearer $QWA_KEY" -H "Content-Type: application/json" \
  -d '{"model":"<canonical model>","messages":[{"role":"user","content":"hello"}]}'
```

Nexus is the sole model-provider gateway for every Qweaver product: OpenAI-style requests in, provider routing with failover behind, workspace wallet billed at resale pricing, and a nexus:{credits,balance} block on every response. Discover routable models with GET /v1/models or {"action":"list_models"}; anything else 404s. Streaming is not supported yet.

## The live manual

```bash
curl -s https://nexus.qweaver.com/api/agent
```

---

## Contact
- Book a demo via WhatsApp: https://wa.me/6588911968
- Built by Digital 9 Labs, Singapore: https://digital9labs.com