Implementing A/B Testing for NICE Cognigy.AI Models via Node.js Webhook Proxy

What You Will Build

• This service intercepts inbound webhook payloads, assigns or reads a tracking cookie, and routes each request to either Variant A or Variant B of a NICE CXone Bot.
• The implementation uses the CXone Bot Webhook API (/api/v2/bots/{botId}/webhook) and the official InfluxDB client for time-series metric persistence.
• All code is written in Node.js 18+ using Express, Axios, and modern async/await patterns.

Prerequisites

• CXone OAuth 2.0 Client Credentials flow with scopes: bot:read bot:write conversation:write
• CXone API version: v2
• Node.js 18 or higher with npm 9+
• External dependencies: express, axios, cookie-parser, @influxdata/influxdb-client, dotenv
• Environment variables: CXONE_ENV, CXONE_CLIENT_ID, CXONE_CLIENT_SECRET, CXONE_BOT_ID_A, CXONE_BOT_ID_B, INFLUX_URL, INFLUX_TOKEN, INFLUX_ORG, INFLUX_BUCKET

Authentication Setup

CXone requires a bearer token for every API call. The following module handles token acquisition, caching, and automatic refresh before expiration.

const axios = require('axios');
const dotenv = require('dotenv');
dotenv.config();

class CXoneAuthManager {
  constructor() {
    this.baseUrl = `https://api.${process.env.CXONE_ENV || 'devtest'}.niceincontact.com`;
    this.clientId = process.env.CXONE_CLIENT_ID;
    this.clientSecret = process.env.CXONE_CLIENT_SECRET;
    this.token = null;
    this.expiresAt = 0;
  }

  async getAccessToken() {
    if (this.token && Date.now() < this.expiresAt - 60000) {
      return this.token;
    }

    try {
      const response = await axios.post(`${this.baseUrl}/api/v2/oauth/token`, {
        grant_type: 'client_credentials',
        client_id: this.clientId,
        client_secret: this.clientSecret,
        scopes: 'bot:read bot:write conversation:write'
      }, {
        headers: { 'Content-Type': 'application/json' }
      });

      this.token = response.data.access_token;
      this.expiresAt = Date.now() + (response.data.expires_in * 1000);
      return this.token;
    } catch (error) {
      if (error.response) {
        console.error(`OAuth error: ${error.response.status} ${error.response.data?.error_description || error.response.statusText}`);
      }
      throw error;
    }
  }
}

module.exports = new CXoneAuthManager();

Implementation

Step 1: Express Server and Cookie-Based Routing Logic

The server initializes Express, attaches the cookie parser, and creates middleware that evaluates the ab_variant cookie. If the cookie is missing, the middleware assigns a variant using a weighted random split, sets the cookie with a 30-day max-age, and attaches the variant to the request object.

const express = require('express');
const cookieParser = require('cookie-parser');
const app = express();

app.use(express.json());
app.use(cookieParser());

const AB_VARIANTS = ['A', 'B'];
const COOKIE_NAME = 'ab_variant';
const COOKIE_MAX_AGE = 30 * 24 * 60 * 60 * 1000; // 30 days in milliseconds

app.use((req, res, next) => {
  const existingCookie = req.cookies[COOKIE_NAME];
  
  if (existingCookie && AB_VARIANTS.includes(existingCookie)) {
    req.variant = existingCookie;
    return next();
  }

  // Weighted 50/50 split
  const assignedVariant = Math.random() < 0.5 ? 'A' : 'B';
  req.variant = assignedVariant;
  
  res.cookie(COOKIE_NAME, assignedVariant, {
    maxAge: COOKIE_MAX_AGE,
    httpOnly: true,
    secure: process.env.NODE_ENV === 'production',
    sameSite: 'lax'
  });

  next();
});

module.exports = app;

Step 2: Webhook Proxy and CXone API Forwarding

This step handles the actual routing. The middleware reads req.variant, selects the corresponding Bot ID from environment variables, and forwards the inbound payload to the CXone webhook endpoint. The code includes a retry mechanism for 429 Too Many Requests responses.

const axios = require('axios');
const authManager = require('./auth');

const CXONE_BASE = 'https://api.{env}.niceincontact.com'; // Replaced dynamically in production
const WEBHOOK_PATH = '/api/v2/bots/{botId}/webhook';

async function forwardToCXone(req, res, variant) {
  const botId = variant === 'A' ? process.env.CXONE_BOT_ID_A : process.env.CXONE_BOT_ID_B;
  const baseUrl = `https://api.${process.env.CXONE_ENV || 'devtest'}.niceincontact.com`;
  const url = `${baseUrl}${WEBHOOK_PATH.replace('{botId}', botId)}`;
  
  const maxRetries = 3;
  let attempt = 0;

  while (attempt < maxRetries) {
    try {
      const token = await authManager.getAccessToken();
      const startTime = Date.now();

      const response = await axios.post(url, req.body, {
        headers: {
          'Authorization': `Bearer ${token}`,
          'Content-Type': 'application/json',
          'Accept': 'application/json'
        },
        timeout: 15000
      });

      const latency = Date.now() - startTime;
      return { status: response.status, latency, data: response.data };

    } catch (error) {
      attempt++;
      const isRateLimited = error.response?.status === 429;
      const isServerError = error.response?.status >= 500;
      const latency = Date.now() - (error.config?.adapter?.options?.startTime || Date.now());

      if ((isRateLimited || isServerError) && attempt < maxRetries) {
        const backoff = Math.pow(2, attempt) * 1000;
        console.warn(`Retry ${attempt}/${maxRetries} for variant ${variant} after ${error.response?.status || 'unknown'} error. Waiting ${backoff}ms.`);
        await new Promise(resolve => setTimeout(resolve, backoff));
        continue;
      }

      return { 
        status: error.response?.status || 500, 
        latency: latency, 
        error: error.response?.data || error.message 
      };
    }
  }
}

module.exports = { forwardToCXone };

Step 3: Time-Series Metrics Logging

Performance data must be persisted for statistical analysis. This module initializes the InfluxDB v2/v3 client and provides a function to write latency, status, and variant tags to a dedicated bucket.

const { InfluxDB, Point } = require('@influxdata/influxdb-client');
const dotenv = require('dotenv');
dotenv.config();

const influxClient = new InfluxDB({
  url: process.env.INFLUX_URL,
  token: process.env.INFLUX_TOKEN
});

const writeApi = influxClient.getWriteApi(
  process.env.INFLUX_ORG,
  process.env.INFLUX_BUCKET,
  'ns'
);

writeApi.useDefaultTags({
  service: 'cognigy-ab-proxy',
  environment: process.env.NODE_ENV || 'development'
});

async function logMetrics(variant, status, latency, conversationId = null) {
  const point = new Point('webhook_performance')
    .tag('variant', variant)
    .tag('status_category', status >= 400 ? 'error' : 'success')
    .intField('http_status', status)
    .floatField('latency_ms', latency)
    .stringField('conversation_id', conversationId || 'unknown');

  writeApi.writePoint(point);
  
  try {
    await writeApi.flush();
  } catch (err) {
    console.error('Failed to flush metrics to InfluxDB:', err.message);
  }
}

async function shutdownInflux() {
  await writeApi.close();
}

module.exports = { logMetrics, shutdownInflux };

Step 4: Request Handler and Response Pipeline

The final middleware ties routing, forwarding, and metrics together. It captures the start time, executes the proxy call, logs the result, and returns a standardized HTTP response to the original caller.

const { forwardToCXone } = require('./proxy');
const { logMetrics, shutdownInflux } = require('./metrics');

app.post('/webhook/inbound', async (req, res) => {
  const startTime = Date.now();
  const variant = req.variant;
  const conversationId = req.body?.conversationId || req.body?.externalId;

  const result = await forwardToCXone(req, res, variant);
  const latency = result.latency || (Date.now() - startTime);

  await logMetrics(variant, result.status, latency, conversationId);

  if (result.error) {
    return res.status(result.status).json({
      success: false,
      variant,
      error: result.error,
      latency_ms: latency
    });
  }

  return res.status(result.status).json({
    success: true,
    variant,
    data: result.data,
    latency_ms: latency
  });
});

process.on('SIGTERM', async () => {
  console.log('SIGTERM received. Shutting down gracefully...');
  await shutdownInflux();
  process.exit(0);
});

Complete Working Example

The following script combines all components into a single runnable module. Replace the placeholder environment variables with your CXone and InfluxDB credentials before execution.

require('dotenv').config();
const express = require('express');
const axios = require('axios');
const cookieParser = require('cookie-parser');
const { InfluxDB, Point } = require('@influxdata/influxdb-client');

// Configuration
const CXONE_ENV = process.env.CXONE_ENV || 'devtest';
const CXONE_BASE = `https://api.${CXONE_ENV}.niceincontact.com`;
const AB_VARIANTS = ['A', 'B'];
const COOKIE_NAME = 'ab_variant';
const COOKIE_MAX_AGE = 30 * 24 * 60 * 60 * 1000;

// InfluxDB Setup
const influxClient = new InfluxDB({ url: process.env.INFLUX_URL, token: process.env.INFLUX_TOKEN });
const writeApi = influxClient.getWriteApi(process.env.INFLUX_ORG, process.env.INFLUX_BUCKET, 'ns');
writeApi.useDefaultTags({ service: 'cognigy-ab-proxy' });

// OAuth Token Manager
class AuthManager {
  constructor() {
    this.token = null;
    this.expiresAt = 0;
  }
  async getToken() {
    if (this.token && Date.now() < this.expiresAt - 60000) return this.token;
    const res = await axios.post(`${CXONE_BASE}/api/v2/oauth/token`, {
      grant_type: 'client_credentials',
      client_id: process.env.CXONE_CLIENT_ID,
      client_secret: process.env.CXONE_CLIENT_SECRET,
      scopes: 'bot:read bot:write conversation:write'
    }, { headers: { 'Content-Type': 'application/json' } });
    this.token = res.data.access_token;
    this.expiresAt = Date.now() + (res.data.expires_in * 1000);
    return this.token;
  }
}
const auth = new AuthManager();

// Metrics Logger
async function logMetrics(variant, status, latency, convId) {
  const point = new Point('webhook_performance')
    .tag('variant', variant)
    .tag('status', status >= 400 ? 'error' : 'success')
    .intField('http_status', status)
    .floatField('latency_ms', latency)
    .stringField('conversation_id', convId || 'unknown');
  writeApi.writePoint(point);
  await writeApi.flush().catch(e => console.error('InfluxDB flush failed:', e.message));
}

// Express App
const app = express();
app.use(express.json());
app.use(cookieParser());

app.use((req, res, next) => {
  const cookie = req.cookies[COOKIE_NAME];
  if (cookie && AB_VARIANTS.includes(cookie)) {
    req.variant = cookie;
    return next();
  }
  req.variant = Math.random() < 0.5 ? 'A' : 'B';
  res.cookie(COOKIE_NAME, req.variant, { maxAge: COOKIE_MAX_AGE, httpOnly: true, secure: process.env.NODE_ENV === 'production', sameSite: 'lax' });
  next();
});

app.post('/webhook/inbound', async (req, res) => {
  const startTime = Date.now();
  const variant = req.variant;
  const botId = variant === 'A' ? process.env.CXONE_BOT_ID_A : process.env.CXONE_BOT_ID_B;
  const url = `${CXONE_BASE}/api/v2/bots/${botId}/webhook`;
  const convId = req.body?.conversationId || req.body?.externalId;
  const maxRetries = 3;
  let attempt = 0;

  while (attempt < maxRetries) {
    try {
      const token = await auth.getToken();
      const proxyRes = await axios.post(url, req.body, {
        headers: { 'Authorization': `Bearer ${token}`, 'Content-Type': 'application/json' },
        timeout: 15000
      });
      const latency = Date.now() - startTime;
      await logMetrics(variant, proxyRes.status, latency, convId);
      return res.status(proxyRes.status).json({ success: true, variant, data: proxyRes.data, latency_ms: latency });
    } catch (err) {
      attempt++;
      const status = err.response?.status;
      const latency = Date.now() - startTime;
      if ((status === 429 || (status >= 500 && status < 600)) && attempt < maxRetries) {
        await new Promise(r => setTimeout(r, Math.pow(2, attempt) * 1000));
        continue;
      }
      await logMetrics(variant, status || 500, latency, convId);
      return res.status(status || 500).json({ success: false, variant, error: err.response?.data || err.message, latency_ms: latency });
    }
  }
});

app.listen(process.env.PORT || 3000, () => {
  console.log(`A/B Webhook Proxy running on port ${process.env.PORT || 3000}`);
});

process.on('SIGTERM', async () => {
  await writeApi.close();
  process.exit(0);
});

Common Errors & Debugging

Error: 401 Unauthorized

• Cause: The OAuth token has expired, the client credentials are incorrect, or the token is not attached to the request header.
• Fix: Verify CXONE_CLIENT_ID and CXONE_CLIENT_SECRET match your CXone application settings. Ensure the Authorization: Bearer <token> header is present. The AuthManager class automatically refreshes tokens when expires_at is within 60 seconds of the current timestamp.

Error: 403 Forbidden

• Cause: The registered OAuth application lacks the required scopes, or the token was issued for a different environment (e.g., using a devtest token against prod).
• Fix: Navigate to your CXone application configuration and ensure bot:read, bot:write, and conversation:write are explicitly granted. Regenerate the token after scope changes.

Error: 429 Too Many Requests

• Cause: CXone enforces per-client rate limits on the Bot Webhook endpoint. High-volume inbound traffic triggers throttling.
• Fix: The implementation includes exponential backoff retry logic. If 429 errors persist, implement request batching on the client side or request a rate limit increase from NICE support. Monitor the retry logs to adjust the backoff multiplier.

Error: 502 Bad Gateway / 503 Service Unavailable

• Cause: CXone platform maintenance, transient network timeouts, or the target Bot ID is inactive.
• Fix: Verify the Bot exists and is published in the CXone console. The retry loop handles transient 5xx errors. If the Bot is unpublished, CXone returns 404. Ensure CXONE_BOT_ID_A and CXONE_BOT_ID_B reference valid, active bot identifiers.

Error: InfluxDB Write Failure

• Cause: Invalid bucket name, expired API token, or network restriction blocking outbound traffic to the InfluxDB cluster.
• Fix: Validate INFLUX_ORG and INFLUX_BUCKET exactly match your InfluxDB dashboard. Check that INFLUX_TOKEN has write permissions for the specified bucket. The flush() call is wrapped in a try-catch to prevent webhook processing from failing due to metrics pipeline issues.

Official References

• NICE CXone Bot Webhook API Documentation
• NICE CXone OAuth 2.0 Authentication Guide
• InfluxDB Client for JavaScript Documentation
• Express.js Cookie Middleware Reference