---
title: "Regenerate direct hash for a webchat widget."
method: POST
path: "/webchat_widgets/{id}/direct_hash_regenerate"
tags: ["Webchat"]
---

# Regenerate direct hash for a webchat widget.

`POST /webchat_widgets/{id}/direct_hash_regenerate`

Regenerates the direct hash used for anonymous visitor authentication on the specified widget. If no direct hash exists, one is created.

## Path parameters

- `id` string, uuid, required

## Response `200`

Direct hash regenerated successfully.

- WebchatManagerWidget — A customer's webchat widget configuration. Also issues a direct hash for anonymous visitor authentication.
  - `id` string, uuid, required — The unique identifier of the widget. Returned from the `POST /widgets` or `GET /widgets` response.
  - `customer_id` string, uuid, required — The unique identifier of the associated customer. Returned from the `GET /customers` response.
  - `name` string, required — Name of the widget.
  - `status` 'active' | 'inactive', required — The status of the widget.
  - `session_flow_id` string, uuid, required — Fires once per Session, at session creation/start (POST /webchat_sessions) -- bin-conversation-manager owns Create+Execute for this Flow's activeflow. Returned from the `POST /flows` or `GET /flows` response.
  - `message_flow_id` string, uuid — Optional. When set, fires an independent, stateless activeflow on EVERY inbound message (mirrors bin-conversation-manager's Account.MessageFlowID/Number.MessageFlowID pattern for LINE/WhatsApp/SMS). Returned from the `POST /flows` or `GET /flows` response.
  - `session_idle_timeout` integer, required — Session idle timeout in seconds before the session is automatically ended.
  - `theme_config` WebchatManagerWidgetThemeConfig — Cosmetic, customer-editable widget appearance settings. All fields are optional; omitted fields fall back to the platform default (blue bubble, no logo, bottom-right, light mode). An explicit color field always wins over the theme_mode-resolved default.
    - `primary_color` string — Hex color code for the widget's primary color.
    - `secondary_color` string — Hex color code for the widget's accent/text-contrast color.
    - `header_background_color` string — Hex color code for the widget header bar's background. Falls back to primary_color (light mode) or a dark surface color (dark mode) when unset.
    - `header_text_color` string — Hex color code for the widget header bar's text.
    - `logo_url` string, uri — HTTPS URL of the logo image displayed in the widget header.
    - `position` 'bottom_right' | 'bottom_left' — Where the floating bubble/panel renders on the customer's page.
    - `theme_mode` 'light' | 'dark' | 'auto' — Controls light/dark/auto rendering of the widget panel.
    - `header_title` string — Widget header text. Defaults to "Chat with us" when unset.
    - `header_subtitle` string — Widget header subtext, shown below header_title. No subtitle row rendered when unset.
    - `connecting_indicator_enabled` boolean, nullable — Whether to show a system message in the panel while the visitor's session is being created. Unset/null falls back to enabled (true); an existing widget's default is preserved by omitting this key rather than sending false.
    - `connecting_indicator_text` string — Text shown while the visitor's session is being created. Defaults to "Connecting…" when unset.
    - `typing_indicator_enabled` boolean, nullable — Whether to show the three-dot "waiting for response" animation after the visitor sends a message. Unset/null falls back to enabled (true). No text-label variant is supported.
    - `border_radius` 'sharp' | 'rounded' | 'pill' — Corner rounding applied to the bubble, panel, message bubbles, input field, and send button as a coordinated set. Defaults to rounded when unset.
    - `font_size` 'compact' | 'default' | 'large' — Base font-size scale applied to the widget's header text and message text. Defaults to default when unset.
  - `direct_hash` string — Hash used by the embed script (data-hash attribute) to authenticate anonymous visitors via POST /auth/boot. The value already includes the "direct." prefix (e.g. "direct.a1b2c3d4e5f6"). Returned on every response (GET, List, Create, Update, direct_hash_regenerate) -- this value is embedded directly in the customer's public website HTML by design, so it is not a traditional secret; hiding it from GET responses would only make it harder for the customer's own admins to retrieve it.
  - `tm_create` string, date-time — Timestamp when the widget was created.
  - `tm_update` string, date-time — Timestamp when the widget was last updated.
  - `tm_delete` string, date-time — Timestamp when the widget was deleted.

## Other responses

- `400` — Invalid request (INVALID_ARGUMENT).
- `401` — Authentication required (UNAUTHENTICATED).
- `403` — Insufficient permission (PERMISSION_DENIED).
- `404` — Resource not found (NOT_FOUND).
- `500` — Internal error (INTERNAL).

---

[API](https://skmtc.net/voipbin/apis/voipbin-api.md) · [All operations](https://skmtc.net/voipbin/apis/voipbin-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/voipbin/voipbin-api/versions/79e779080bcc/schema)