List customers

ChatGPT MCP connection

Connect ChatGPT to read Ridgetop support conversations, customers, knowledge articles, and internal Development docs. The endpoint uses OAuth sign-in and the signed-in employee’s current workspace permissions. It is available after the Ridgetop MCP OAuth provider has been configured.

Streamable HTTP endpoint

search(query) returns matching record IDs, titles, and Ridgetop links. It searches article and doc titles, summaries, and body text. fetch(id) returns the text of one permitted record. Knowledge articles require knowledge.view, including drafts and internal articles; Development docs require development.view and exclude archived pages. The public API reference on this page is separate from those Development docs. count_conversations counts conversations by assignment, status, and channel. list_conversations uses the same filters and returns up to 50 matching records per page with an exact total and next offset; use fetch(id) for a full conversation transcript. top_email_contacts ranks customer contacts by inbound emails for a selected period, including last calendar week in the workspace timezone. Search and fetch also cover guides and surveys (with guides.view; fetch includes the last 30 days of results) and ideas (with feedback.view; fetch includes demand and linked work), when the plan includes in-app guides. Reports answer questions such as “What's our NPS this month?” or “Which guides are failing?”: list_guides, get_guide_results, list_surveys, get_survey_results, get_survey_breakdown, get_csat_report, list_ideas and get_idea, each offered when the employee has its permission. They return scores and totals, never individual survey answers. With Marketing access, list_marketing_campaigns, get_marketing_campaign_report, list_social_posts, get_social_post_report and get_marketing_calendar answer questions such as “How did last week's newsletter do?”, “Which LinkedIn post brought the most forms?” or “What's planned for November?”; nothing is ever sent or published through MCP. All tools are read-only and require the records:read OAuth scope; conversation counts, lists, and email rankings also require inbox.view.

Workflow webhooks

Webhooks are sent by workflows. People who manage workflows add an https destination under Settings → Connected apps → Webhooks, then add a Send webhook step to any workflow, so the workflow's trigger and conditions decide what is sent and when. Ridgetop sends a POST with a JSON body of { id, type, createdAt, workspaceId, workflow: { id, name }, data }, where type is the workflow's trigger (for example support.survey_answered or support.guide_published) and data holds the event's values by the same names as the workflow's {{variables}}, such as record.title, record.url and guide.name. The headers are Ridgetop-Event, Ridgetop-Delivery (the same as id; use it to ignore repeats) and Ridgetop-Signature. A test sent from Connected apps has the type ping.

Workflows can also receive webhooks: a workflow on the Webhook received trigger has its own URL, documented under Workflows in the API reference, so another app can add contacts, deals and tasks through it.

Answer with any 2xx status within 8 seconds. The step tries once straight away; anything else is retried after 1, 5 and 30 minutes, then 2, 6, 12 and 24 hours, and after 50 failures in a row the destination is turned off. Redirects aren't followed. Nothing is sent about people whose processing is restricted.

Ridgetop-Signature is t=<unix seconds>,v1=<hex>, where v1 is the HMAC-SHA256 of t, a period and the raw body, keyed with the destination's whsec_ secret. Check it against the raw body before parsing, and reject timestamps more than five minutes old.

import { createHmac, timingSafeEqual } from "node:crypto";

export function verifyRidgetopWebhook(rawBody, header, secret) {
  const parts = Object.fromEntries(header.split(",").map((part) => part.split("=")));
  const timestamp = Number(parts.t);
  if (!timestamp || Math.abs(Date.now() / 1000 - timestamp) > 300) return false;
  const expected = createHmac("sha256", secret).update(`${timestamp}.${rawBody}`).digest();
  const given = Buffer.from(parts.v1 ?? "", "hex");
  return given.length === expected.length && timingSafeEqual(given, expected);
}