Connect your system to uBumi

1. Create an API key

There is nothing to request from uBumi — you generate this yourself. Any long random string, kept in your environment and never in source control.

node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"

# .env
UBUMI_KEY=3f9a…

2. Add a health endpoint

uBumi calls this once, when connecting, and refuses to store a key it could not verify. It only has to return JSON and a 200.

app.get('/api/ubumi/health', (req, res) => {
  if (req.get('authorization') !== `Bearer ${process.env.UBUMI_KEY}`)
    return res.status(401).json({ error: 'bad key' });
  res.json({ ok: true });
});

3. Add the data endpoints

One per question the business wants its AI team to be able to ask. Return plain JSON, and include what a person would need to act: a name, a way to reach them, the amount, the date. Keep each response under 512 KB.

app.get('/api/ubumi/clients', async (req, res) => {
  if (req.get('authorization') !== `Bearer ${process.env.UBUMI_KEY}`)
    return res.status(401).json({ error: 'bad key' });

  const rows = await db.query(
    `SELECT id, name, email, phone, amount_due, due_date
       FROM loans WHERE due_date < now() + interval '7 days' LIMIT 200`
  );
  res.json({ clients: rows });
});

4. Mount them before the catch-all

This is the one that catches nearly everyone. If your single-page app's catch-all is registered first, Express answers /api/… with index.html and your endpoint is never reached. The symptom is a 200 that returns a web page.

app.use('/api/ubumi', ubumiRoutes);              // ← API first
app.get('*', (req, res) => res.sendFile(indexHtml)); // ← catch-all last

5. Test it before handing it over

If these two do not behave exactly like this, uBumi will not connect.

# must return JSON, not HTML
curl -s -H "Authorization: Bearer $UBUMI_KEY" \
  https://yourdomain.com/api/ubumi/health

# must return 401
curl -s -o /dev/null -w "%{http_code}\n" \
  https://yourdomain.com/api/ubumi/health

Requirements

Why a connection gets refused

These are the messages the business owner sees, so a complaint maps straight to a cause.

If you already publish an OpenAPI document

The owner can paste its address and the endpoint list fills itself in. uBumi imports GET operations only, and skips any path containing {braces}, because it has no way to guess the value. The summary field matters more than you would expect: it is how an AI employee decides whether an endpoint is worth reading.

What to send back

Send the key by something other than email — a password manager, or let the business owner paste it into their own workspace so it passes through fewer hands. Write the endpoint description in plain words: it is the sentence an AI employee reads when deciding what to call, and a path on its own tells it nothing.