Bots overview
Bots allow you to
- Send content into and out of Zulip.
- Send content to and from another product.
- Automate tasks a human user could do.
A bot that sends content to or from another product is often called an
integration.
Pre-made bots
Zulip natively supports integrations with over one hundred products, and with
almost a thousand more through Zapier and IFTTT. If you're looking to add an
integration with an existing product, see our
list of integrations, along with those of
Zapier and IFTTT.
Anatomy of a bot
You can think of a bot as a special kind of user, with limited permissions.
Each bot has a name, profile picture, email, bot type and API key.
- The name and profile picture play the same role they do for human users. They
are the most visible attributes of a bot.
- The email is not used for anything, and will likely be removed in a
future version of Zulip.
- The bot type determines what the bot can and can't do (see below).
- The API key is how the bot identifies itself to Zulip. Anyone with the
bot's API key can impersonate the bot.
Bot type
The bot type determines what the bot can do.
| Bot type |
Permissions |
Common uses |
| Generic |
Like a normal user account |
Automating tasks, bots that listen to all messages on a channel |
| Incoming webhook |
Limited to only sending messages into Zulip |
Automated notifications into Zulip |
| Outgoing webhook |
Generic bot that also receives new messages via HTTP post requests |
Third party integrations, most custom bots |
A generic bot acts like a normal Zulip user that can only access Zulip via
the API. There's a handful of actions bots can't take, including creating other
bots.
An outgoing webhook bot can read direct messages where the bot
is a participant, and channel messages where the bot is
mentioned. When the bot is DM'd or
mentioned, it POSTs the message content to a URL of your choice. The
POST request format can be in a Zulip format or a Slack-compatible
format. This is the preferred bot type for interactive bots built on
top of Zulip Botserver.
Use the most limited bot type that supports your integration. Anyone with the
bot's API key can do anything the bot can, so giving bots unnecessary
permissions can expose your organization to unnecessary risk.
Channel permissions for bots
Bots can be subscribed to channels, and assigned channel
permissions just like human users. In private
channels with protected history, a bot can only access messages sent after it
was subscribed to the channel.
Bots can send messages to any channel that their owner can, inheriting their
owner's sending permissions. You can give a bot
channel management permissions, just like you would for a human user.
Adding bots
By default, anyone other than guests can add a bot to a
Zulip organization, but administrators can
restrict bot creation. Any bot that is added
is visible and available for anyone to use.
Integrations that act on behalf of users
If you want an integration to impersonate you (e.g., write messages that come
from your Zulip account), use your personal API key, rather
than a bot's API key. You won't need to create a bot.
If you need a bot to send messages on behalf of multiple users, ask Zulip
support or your server administrator to run the
manage.py change_user_role can_forge_sender command to give a bot
permission to send messages as users in your organization. Bots with the
can_forge_sender permission can also see the names of all channels,
including private channels. This is important for implementing integrations
like the Jabber and IRC mirrors.
Related articles