Bots overview

Bots allow you to

Send content into and out of Zulip.
Send content to and from another product.
Automate tasks a human user could do.

A bot that sends content to or from another product is often called an integration.

Pre-made bots

Zulip natively supports integrations with over one hundred products, and with almost a thousand more through Zapier and IFTTT. If you're looking to add an integration with an existing product, see our list of integrations, along with those of Zapier and IFTTT.

Anatomy of a bot

You can think of a bot as a special kind of user, with limited permissions. Each bot has a name, profile picture, email, bot type and API key.

The name and profile picture play the same role they do for human users. They are the most visible attributes of a bot.
The email is used for HTTP Basic authentication.
The bot type determines what the bot can and can't do (see below).
The API key is how the bot identifies itself to Zulip. Anyone with the bot's API key can impersonate the bot.

Bot type

The bot type determines what the bot can do.

Bot type	Permissions	Common uses
Generic	Like a normal user account	Automating tasks, bots that listen to all messages on a channel
Incoming webhook	Limited to only sending messages into Zulip	Automated notifications into Zulip
Outgoing webhook	Generic bot that also receives new messages via HTTP post requests	Third party integrations, most custom bots

A generic bot acts like a normal Zulip user that can only access Zulip via the API. There's a handful of actions bots can't take, including creating other bots.

An outgoing webhook bot can read direct messages where the bot is a participant, and channel messages where the bot is mentioned. When the bot is DM'd or mentioned, it POSTs the message content to a URL of your choice. The POST request format can be in a Zulip format or a Slack-compatible format. This is the preferred bot type for interactive bots built on top of Zulip Botserver.

Use the most limited bot type that supports your integration. Anyone with the bot's API key can do anything the bot can, so giving bots unnecessary permissions can expose your organization to unnecessary risk.

Channel permissions for bots

Bots can be subscribed to channels, and assigned channel permissions just like human users. In private channels with protected history, a bot can only access messages sent after it was subscribed to the channel.

Bots can send messages to any channel that their owner can, inheriting their owner's sending permissions. You can give a bot channel management permissions, just like you would for a human user.

Adding bots

By default, anyone other than guests can add a bot to a Zulip organization, but administrators can restrict bot creation. Any bot that is added is visible and available for anyone to use.

Integrations that act on behalf of users

If you want an integration to impersonate you (e.g., write messages that come from your Zulip account), use your personal API key, rather than a bot's API key. You won't need to create a bot.

If you need a bot to send messages on behalf of multiple users, ask Zulip support or your server administrator to run the manage.py change_user_role can_forge_sender command to give a bot permission to send messages as users in your organization. Bots with the can_forge_sender permission can also see the names of all channels, including private channels. This is important for implementing integrations like the Jabber and IRC mirrors.