Biklo for developersTESTsandbox-api.biklo.comchange

Reply to a buyer

POST/v1/threads/{id}/messages

scope messages.write

Every reply passes through the same chat-protection scan the seller dashboard applies. A message carrying contact details is refused with 422 blocked_by_chat_protection and a detected list saying what was found, or is masked before it is stored — check chat_protection.was_masked and show your user the body we return, not the one you sent.

Request body#

FieldTypeRequiredDescription
bodystringrequiredYour reply. Must be a non-empty string after trimming (body_required, 400) and at most 5000 characters (body_too_long, 400).

Example

{
    "body": "Yes, it is in stock — we ship within 24 hours."
}

Response#

FieldTypeDescription
dataobjectThe message as it was stored.
data.idintegerThe new message id.
data.thread_idintegerThe conversation it landed in.
data.fromstringAlways seller here.
data.bodystringWhat was actually stored — compare it with what you sent, because chat protection may have changed it.
data.created_atstringISO-8601 UTC.
chat_protectionobjectWhat our contact-detail scan did with your message. Your reply gets exactly the same treatment a seller typing in the dashboard gets. Absent when the scan did not run.
chat_protection.decisionstringWhat it decided. A blocked message is refused outright with a 422, so a data object here means it was allowed.
chat_protection.was_maskedbooleantrue means the stored text DIFFERS from what you sent — a phone number or email was removed. Worth logging: your system and the buyer are now looking at different text.

Example

{
    "data": {
        "id": 174421,
        "thread_id": 107373,
        "from": "seller",
        "body": "Yes, it is in stock — we ship within 24 hours.",
        "created_at": "2026-09-10T06:15:30Z"
    },
    "chat_protection": {
        "decision": "allow",
        "was_masked": false
    }
}

Failures use the shared error envelope — a machine-readable code and a request_id to quote to support. Error handling.

curl -X POST "https://sandbox-api.biklo.com/v1/threads/711/messages" \
  -H "Authorization: Bearer bk_test_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "body": "Yes, it is in stock — we ship within 24 hours."
}'
<?php

$ch = curl_init('https://sandbox-api.biklo.com/v1/threads/711/messages');

curl_setopt_array($ch, [
    CURLOPT_RETURNTRANSFER => true,
    CURLOPT_CUSTOMREQUEST  => 'POST',
    CURLOPT_HTTPHEADER     => [
        'Authorization: Bearer bk_test_YOUR_KEY',
        'Content-Type: application/json',
    ],
    CURLOPT_POSTFIELDS     => json_encode([
      'body' => 'Yes, it is in stock — we ship within 24 hours.',
    ]),
]);

$response = json_decode(curl_exec($ch), true);
curl_close($ch);

using System.Net.Http;
using System.Net.Http.Headers;

var client = new HttpClient();
client.DefaultRequestHeaders.Authorization =
    new AuthenticationHeaderValue("Bearer", "bk_test_YOUR_KEY");

var request = new HttpRequestMessage(
    new HttpMethod("POST"),
    "https://sandbox-api.biklo.com/v1/threads/711/messages");

request.Content = new StringContent(
    @"{ ""body"": ""Yes, it is in stock — we ship within 24 hours."" }",
    System.Text.Encoding.UTF8,
    "application/json");

var response = await client.SendAsync(request);
var json = await response.Content.ReadAsStringAsync();

import requests

response = requests.post(
    "https://sandbox-api.biklo.com/v1/threads/711/messages",
    headers={"Authorization": "Bearer bk_test_YOUR_KEY"},
    json={
        "body": "Yes, it is in stock — we ship within 24 hours."
    },
)

data = response.json()

const response = await fetch("https://sandbox-api.biklo.com/v1/threads/711/messages", {
  method: "POST",
  headers: {
    Authorization: "Bearer bk_test_YOUR_KEY",
    "Content-Type": "application/json"
  },
  body: JSON.stringify({
      "body": "Yes, it is in stock — we ship within 24 hours."
  })
});

const data = await response.json();

import java.net.http.*;
import java.net.URI;

var client = HttpClient.newHttpClient();

var request = HttpRequest.newBuilder()
    .uri(URI.create("https://sandbox-api.biklo.com/v1/threads/711/messages"))
    .header("Authorization", "Bearer bk_test_YOUR_KEY")
    .header("Content-Type", "application/json")
    .method("POST", HttpRequest.BodyPublishers.ofString(
        "{ \"body\": \"Yes, it is in stock — we ship within 24 hours.\" }"))
    .build();

var response = client.send(request, HttpResponse.BodyHandlers.ofString());