Midleman Dashboard

Setup

Configure your administrative credentials and secure access.

Scan this QR code with your authenticator app (Google Authenticator, Authy, etc.)

Or enter this key manually:

Sign In

Enter your credentials to access the dashboard.

Verification

Enter the 6-digit code from your authenticator app.

Set up 2FA

Scan the QR code with Google Authenticator, Microsoft Authenticator, Authy or 1Password — then enter the 6-digit code to confirm.

Status

Requests

in-flight

Proxies

Webhooks

active fans

Traffic last 24h

Breakdown

Activity

Recent Requests

Time	Type	Method	Path	Status	Duration
Waiting for requests...

Search body

Time	Type	Method	Path	Status	Duration	Size
Loading...

Name	Status	Listeners	Upstream	Transport
Loading...

Opened	Profile	Transport	Peer	Bytes In	Bytes Out	Duration	Close
Loading...

Time	Profile	Dir	Tx	Method / Status	From → To	Call-ID	Peer
Loading...

Domain	Source	Status	Expires	Used by
Loading...

Name	Status	Port	Targets	Auth	In-Flight
Loading...

Test Payload (optional)

No destinations configured

URL	Type	Filter	Retry
No destinations.

Name	Status	Channel	Port	Replies To	Activity
Loading...

Guia de integração — GoContact

Um conector liga um canal digital (WhatsApp Meta, Smooch/Sunshine, ou JSON genérico) a uma sessão de webchat GoContact, e devolve as respostas do agente. Modo GoContact: poll (API tradicional do plugin + polling) ou webchat-api (Webchat API oficial; respostas empurradas para um callback). O canal (Meta/Smooch/generic) é independente do modo. A porta de cada conector está na tabela acima — substitui <host>:<porta> pela porta real (exposta via o teu proxy).

Canal generic — entrada (n8n / o teu sistema → Midleman)

POST para a porta do conector em qualquer path. Auth: se definiste um Verify Token, envia-o em ?token= ou no header X-Forward-Token.

POST http://<host>:<porta>/?token=SEGREDO
Content-Type: application/json

# texto simples:
{ "chatId": "244939609354", "name": "João", "text": "Olá" }

# com ficheiro (o Midleman descarrega e injeta no contact center):
{ "chatId": "244939609354", "name": "João",
  "file": { "url": "https://.../foto.jpg", "filename": "foto.jpg", "mimetype": "image/jpeg" } }

# várias mensagens de uma vez:
{ "messages": [ { "chatId": "c1", "text": "oi" }, { "chatId": "c2", "text": "olá" } ] }

# resposta:
{ "status": "accepted", "messages": 1, "requestId": "..." }

Aliases aceites: chatId=idChat/from · name=displayName · text=message/mensagem. Cada mensagem precisa de text ou file. No n8n usa o nó HTTP Request com método POST e body JSON para este endpoint.

Respostas do agente (Midleman → o teu sistema / cliente)

Para receberes as respostas do agente, ativa Direct reply (Meta/Smooch — entrega direta ao cliente) e/ou configura Webhook Targets (o Midleman faz POST do evento). No canal generic só há webhooks (sem direct reply).

POST <o-teu-webhook>
X-Connector: nome-do-conector

{
  "connector": "nome-do-conector",
  "channel": "generic",
  "event": "agent_message",          // ou "agent_joined" | "chat_closed"
  "chatId": "cliente-244939609354",
  "displayName": "João",
  "message": {
    "uuid": "id-unico", "text": "Em que posso ajudar?",
    "timestamp": 1781700000000, "agentName": "Maria",
    "userType": "AGENT",
    "file": null                      // ou { url, filename, mimetype, size }
  }
}
# chat_closed → message:null + "reason": "agent"|"admin"|"expired"

Responde 2xx para confirmar. agent_message é at-least-once (repete em falha) → deduplica por message.uuid. chat_closed: 3 tentativas, depois DLQ.

Meta WhatsApp / Smooch

Aponta o webhook do provedor para a porta do conector. Meta: usa o Verify Token no handshake (hub.challenge) e aceita o envelope completo, o value "nu", ou um array deles. Smooch: valida por X-Smooch-Signature (webhook secret). Vários conectores podem partilhar o mesmo feed Meta — cada um filtra pelo seu Phone Number Filter (phone_number_id).

# Callback URL a registar na Meta/Smooch:
https://<host>:<porta>/?token=VERIFY_TOKEN

Modo webchat-api (push) — callback & URLs

A GoContact empurra as respostas do agente para o Midleman. Regista este URL no painel da GoContact (o Callback token protege o endpoint):

# Callback (agente → Midleman):
https://<host>:<porta>/gocontact/callback?token=CALLBACK_TOKEN

API Base URL (eu.ds.gocontact.com) faz toda a API (auth, conversas, mensagens). Base URL (a instância, ex. gotaag.ucall.co.ao) serve só os anexos em webchat-api — opcional, só preciso se houver ficheiros. Os loginFields (nome/telefone do cliente) são detetados automaticamente; podes forçar o mapeamento em Login field mapping.

Handover bot → humano (transferir com histórico)

Quando o teu chatbot quer passar o cliente a um agente humano, cria a conversa na GoContact já com o histórico. Só em modo webchat-api. Auth = igual ao inbound (verify token).

POST http://<host>:<porta>/handover?token=SEGREDO
Content-Type: application/json

{
  "chatId": "cliente-244939609354",
  "name": "João",
  "phoneNumberId": "879847985208219",   // routing das respostas na Meta
  "history": [
    { "from": "client", "text": "Quero falar com um humano", "timestamp": 1781700000000 },
    { "from": "bot",    "text": "Claro, vou transferir-te.",  "timestamp": 1781700001000 }
  ]
}

# resposta:
{ "status": "ok", "conversationUuid": "…", "contactId": "…", "historyCount": 2 }

from: "bot" → marcado como BOT; o resto → CLIENT (o agente vê os dois lados). Máx 100 mensagens (fica com as mais recentes), só texto. Depois disto, as mensagens do cliente reutilizam a sessão e as respostas saem pelo provedor configurado.

Anexos (por modo)

poll: qualquer tipo de ficheiro é enviado para o storage da instância GoContact. webchat-api: a API só aceita jpg/png/pdf no upload do cliente — outros tipos (áudio/vídeo) não são suportados pela API. Os anexos do agente (nos dois modos) são servidos pela instância: <Base URL>/storage/webchat-attachments/….

Name	Status	Channel	Port	Replies To	Activity
Loading...

Name	Status	Port	Target URL	Auth Header	Access	Blocked Ext.
Loading...

Filter:

Name	Email / Username	Role	2FA	Created
Loading...

Invitee	Resources	Expires	Sent
Loading...

Name	Client ID	Redirect URIs	Created	Access
Loading...

OIDC Endpoints

Configure in Supabase as a Custom OAuth provider using these URLs (replace with your public domain — JWKS_PORT behind Nginx):

Discovery: —
Authorization: —
Token: —
Userinfo: —
JWKS: —

Response payloads

POST /oauth/token — after the authorization-code exchange

{
  "access_token": "<JWT>",
  "id_token":     "<JWT>",
  "token_type":   "Bearer",
  "expires_in":   86400,
  "scope":        "openid profile email",
  "refresh_token": "<opaque>"
}

access_token and id_token carry the same RS256 JWT — verify via the JWKS endpoint above.

JWT claims — decoded payload of access_token / id_token

{
  "iss":   "<JWT_ISSUER>",
  "sub":   "<uuid-v5 derived from midleman_uid>",
  "aud":   "<oauth_client_id>",
  "iat":   1730000000,
  "exp":   1730086400,
  "midleman_uid":        42,
  "preferred_username":  "jdoe",

  // included when "email" scope is granted
  "email":          "jdoe@example.com",
  "email_verified": true,

  // included when "profile" scope is granted
  "name": "John Doe",

  // included when the authorize request had a nonce
  "nonce": "<client-supplied>"
}

GET /oauth/userinfo — with Authorization: Bearer <access_token>

{
  "sub":                "<uuid>",
  "preferred_username": "jdoe",
  "email":              "jdoe@example.com",
  "email_verified":     true,
  "name":               "John Doe",
  "midleman_uid":       42
}

Refresh: POST /oauth/token — grant_type=refresh_token

{
  "access_token":  "<new JWT>",
  "id_token":      "<new JWT>",
  "token_type":    "Bearer",
  "expires_in":    86400,
  "scope":         "openid profile email",
  "refresh_token": "<rotated opaque>"
}

Refresh tokens are single-use and rotate on every call. The previous token is invalidated.

Errors — RFC 6749 §5.2 shape

{
  "error":             "invalid_grant",
  "error_description": "Authorization code expired or already used"
}

Name	Title	Updated
Loading...

Name	URL	Base DN	Scope	2FA	Status
Loading...

Notes

Scope: admin → dashboard login only; proxy → profile users only; both → both.
2FA: required enforces TOTP on first login; optional allows skipping; disabled ignores it. LDAP admins always require TOTP.
The bind admin password is encrypted with AES-256-GCM using a key derived from the JWT RSA key.
The filter must contain {login}. Default covers uid, mail and sAMAccountName.

When	Local user	Match	LDAP DN	Status
Loading...

Server

Address of the SMTP server that will deliver the mail. Usually provided by your email provider (Gmail, Outlook 365, SendGrid, Mailgun, etc.) or by your organisation's mail server.

Host

Port

Security

Accept self-signed certificates

Sending credentials

Account used by Midleman to authenticate against the SMTP server. Without it the server will usually reject the message (unless it accepts anonymous relay from your network). For Gmail/Outlook it is typically an app password; for SendGrid/Mailgun it's the service username and API key. Leave both empty if your server does not require authentication.

Username

Password

Leave empty to keep the current password.

Sender identity

What appears in the From: header of outgoing messages. Recipients will see this address as the origin of the message and will reply to it. It must be an address the SMTP server is authorised to send from — otherwise messages may be rejected or flagged as spam.

Email *

Display name

Routing

Enable SMS delivery

Routing mode

All messages go through the primary provider.

Primary provider

Default country code

Used to expand local numbers (without "+") to E.164.

Providers

Credentials are encrypted at rest

WeSender

Angola SMS gateway · api.wesender.co.ao

Api Key (secret)

Leave empty to keep the current key.

Allow special characters (CEspeciais)

Twilio

International SMS · api.twilio.com

Account SID

Auth Token (secret)

Leave empty to keep the current token.

From number

Must be in E.164 and verified in your Twilio account.

#	Domains	Forward	SSL	Status	Actions
Loading…

#	Name	Provider	Domains	Expires	Actions
Loading…

Name	Template	Owner Type	Date Range	Cache	Last Fetch
Loading...

Select a feed to view data

Activity Log

Connecting…

Consumer API

Authenticate with an API Key via header X-API-Key, Authorization: Bearer <key> or query param ?apiKey=<key>.

# Flat route (feed sem grupo)
GET /reports/:name
X-API-Key: <your-api-key>

# Grouped route (feed com group + slug)
GET /reports/:group/:slug
X-API-Key: <your-api-key>

# Detail (requer detail.idField configurado)
GET /reports/:group/:slug/:id
GET /reports/:name/:id

# Streaming áudio
GET /reports/:group/:slug/:id/audio

# Filtros — exact-match
GET /reports/:group/:slug?agentName=João
# Filtros — operadores tipados (?campo__op=valor)
GET /reports/:group/:slug?startDate__gte=2026-01-01&startDate__lte=2026-01-31
GET /reports/:group/:slug?talkTime__gte=60&direction__contains=inbound

# Swagger/OpenAPI
GET /reports/docs?apiKey=<key>          ← global
GET /reports/:group/docs?apiKey=<key>  ← específico do grupo

Name	Label	Base URL	Username
Sem instâncias ainda.

Feed Name *

GoContact Instance *

API Group (optional — namespace, e.g. nossa-seguro) Agrupa feeds em /reports/group/slug

Endpoint Slug (required when group is set) ex: voice, webchat, ticket, callback

Template ID *

Data Type (0 para voz, "sessions" para webchat)

Owner Type *

Owner IDs (comma-separated) All owners

Date Range *

Last N days Fixed dates

days back from today

Auto-refresh (segundos) 0 = apenas manual

API Keys * (one per line — grant access to consumers)

Preenche as credenciais e template acima, depois clica para ver as colunas disponíveis.

Column Mapping Include unmapped columns

Click Fetch Columns Preview to configure which columns to expose and their API names.

If not configured, all columns are included with their original names.

Enable detail route (GET /reports/:name/:id)

Enable audio streaming (GET /reports/:name/:id/audio)

Actor

Action

From

When	Actor	Action	Target	IP
Loading...

—

Setup

Sign In

Verification

Set up 2FA

Dashboard

Activity

Recent Requests

Request Log

Request Detail

TCP / UDP Proxies

TCP / UDP Logs

Certificates

Message

Webhooks

Destinations

Chat Connectors

Guia de integração — GoContact

Guia de integração — Five9

HTTP Proxies

New Certificate

Users

Invite Links

OAuth Clients

OIDC Endpoints

Consent Pages

New page

LDAP / Active Directory

Notes

LDAP Conflicts

Send test email

Notifications

No notification groups yet

No rules defined

Server

Sending credentials

Sender identity

Routing

Prefix routing rules

Providers

WeSender

Twilio

New group

Add recipients

New rule

Send test SMS

Nginx Proxy Manager

No NPM instance connected

Shared Let's Encrypt volume

Add Let's Encrypt Certificate

Add Custom Certificate

NPM Connection

Add Proxy Host

Report Feeds

Data Viewer

Activity Log

Consumer API

GoContact Instances

New GoContact Instance

New Report Feed

Audit Log

Audit entry

New OAuth Client

New Webhook Distributor

Edit destination

New Connector

Active Sessions

New Five9 Connector

Active Five9 Sessions

Failed Deliveries

Pending Retries

New TCP/UDP Proxy

New Proxy

Import from Nginx Proxy Manager

Edit User

Acesso ao client

Manage Users

Resources

Generate Invite Link

New LDAP directory

Confirmação