smartsupp: audit vs current vendor docs (2026-04-16)

[productdevbook]

Summary

Wrapper covers visitor identification and basic show/hide, but misses several documented commands (chat:open/chat:close, chat:message, chat:send, group, language), the on() event subscription surface (message_sent, message_received, messenger_close), the async smartsupp.vid property, and a number of _smartsupp.* config keys.

Gaps found

Missing API surface

• smartsupp('chat:open') — programmatically open the messenger panel (not just show the launcher) — http://docs.smartsupp.com/chat-box/javascript-api/methods/
• smartsupp('chat:close') — programmatically close the messenger panel — http://docs.smartsupp.com/chat-box/javascript-api/methods/
• smartsupp('chat:message', text) — pre-fill the composer without sending — http://docs.smartsupp.com/chat-box/javascript-api/methods/
• smartsupp('chat:send', text) — send a pre-composed message — http://docs.smartsupp.com/chat-box/javascript-api/methods/
• smartsupp('group', '<GROUP_ID>') — agent/group routing, not exposed via wrapper — http://docs.smartsupp.com/chat-box/javascript-api/methods/
• smartsupp('language', code) — runtime locale switch (we accept locale in pageView but no-op) — https://docs.smartsupp.com/chat-box/localization/
• smartsupp.vid async property — visitor id accessor; could power getIdentity() / a getVisitorId() helper — http://docs.smartsupp.com/chat-box/javascript-api/properties/

Events not bridged

• smartsupp('on', 'message_sent', fn) — outbound message hook — http://docs.smartsupp.com/chat-box/javascript-api/events/
• smartsupp('on', 'message_received', fn) — inbound message hook (would back onUnreadCountChange-style API noted in AGENTS.md) — http://docs.smartsupp.com/chat-box/javascript-api/events/
• smartsupp('on', 'messenger_close', fn) — panel close hook — http://docs.smartsupp.com/chat-box/javascript-api/events/

Config options not exposed

• _smartsupp.cookieDomain — cross-subdomain session sharing — http://docs.smartsupp.com/chat-box/configuration/
• _smartsupp.hideMobileWidget — mobile-only hide — http://docs.smartsupp.com/chat-box/configuration/
• _smartsupp.orientation ("left"/"right") — http://docs.smartsupp.com/chat-box/configuration/
• _smartsupp.offsetX / _smartsupp.offsetY — pixel offset — http://docs.smartsupp.com/chat-box/configuration/
• _smartsupp.color — brand color — http://docs.smartsupp.com/chat-box/configuration/
• _smartsupp.privacyNoticeEnabled / privacyNoticeUrl / privacyNoticeCheckRequired — consent UI — http://docs.smartsupp.com/chat-box/configuration/
• _smartsupp.ratingEnabled — http://docs.smartsupp.com/chat-box/configuration/
• _smartsupp.gaKey / _smartsupp.gaOptions — GA4 routing — https://docs.smartsupp.com/chat-box/google-analytics/
• Initial language / group as load-time options (currently no way to set without calling commands post-ready) — http://docs.smartsupp.com/chat-box/javascript-api/methods/

Auth modes

• No identity verification / signed-user / HMAC mode is documented by Smartsupp as of this audit — visitor identification page explicitly shows plain name/email/phone/variables only, no signature parameter — https://docs.smartsupp.com/chat-box/visitor-identification/

Deprecations in our current code

• track() writes the event into variables keyed by event name, which permanently overwrites prior variables of the same name and is not what Smartsupp's variables slot is for. With chat:send/message_sent now on the radar, reconsider mapping track() to a no-op (or to a custom variables namespace) and document the limitation — https://docs.smartsupp.com/chat-box/visitor-identification/
• shutdown() sends smartsupp('logout') but logout is not listed on the public Methods page — verify it still exists or replace with destroy()-only semantics — http://docs.smartsupp.com/chat-box/javascript-api/methods/

Intentionally out of scope

• REST API / dashboard endpoints under https://docs.smartsupp.com/rest-api/
• Mobile SDK (iOS/Android) under https://docs.smartsupp.com/mobile-sdk/
• Multi-region / data-center selection — not documented by Smartsupp (single global endpoint www.smartsuppchat.com/loader.js)

Sources

• https://docs.smartsupp.com
• http://docs.smartsupp.com/chat-box/javascript-api/methods/
• http://docs.smartsupp.com/chat-box/javascript-api/events/
• http://docs.smartsupp.com/chat-box/javascript-api/properties/
• http://docs.smartsupp.com/chat-box/configuration/
• https://docs.smartsupp.com/chat-box/visitor-identification/
• https://docs.smartsupp.com/chat-box/localization/
• https://docs.smartsupp.com/chat-box/google-analytics/

[productdevbook]

All audit findings shipped in 3c44fe3:

Methods (6 + 1 getter): open, close, prefillMessage (chat:message), sendMessage (chat:send), setGroup, setLanguage, sync getVisitorId().

Event bridge: on(event, handler) for messageSent / messageReceived / messengerClose.

Typed config (SmartsuppLoadOptions): language, group at load time; plus cookieDomain, hideMobileWidget, orientation, offsetX/Y, color, privacyNoticeEnabled/Url/CheckRequired, ratingEnabled, gaKey, gaOptions.

Test coverage: test/smartsupp.browser.test.ts (5 cases). Bundle stays within default 6KB. Closing.

Auth: vendor documents no identity verification mode; wrapper correctly accepts identity without a verification kind.