Web Messaging bot init failing when injecting Node middleware for guest variables

PureCloudPlatformAPIV2 documentation indicates that the guest variable injection endpoint expects a specific payload structure, but our current implementation is consistently returning a 400 Bad Request during the Web Messaging bot initialization flow. We are attempting to intercept the session before the routing engine evaluates it by running a Node.js middleware that queries our internal GraphQL endpoint, retrieves the customer profile, and pushes the resulting attributes back to the guest session via the Guest API. The routing rules are configured to automatically pick up the VIP flag once these variables are populated.

The middleware is hosted on an Express server managing the /api/webchat/proxy route. Here is the exact implementation we are working with:

app.post('/webchat/proxy', async (req, res) => {
 const sessionId = req.body.sessionId;
 try {
 const profile = await fetchGraphQL('/profiles', req.body.identity);
 await fetch(`https://myorg.mypurecloud.com/api/v2/conversations/messaging/guests/${sessionId}/variables`, {
  method: 'PUT',
  headers: { 'Authorization': `Bearer ${token}`, 'Content-Type': 'application/json' },
  body: JSON.stringify({ guestVariables: { is_vip: profile.tier === 'platinum', loyalty_score: profile.points } })
 });
 } catch (err) {
 console.error('Guest var injection failed', err);
 }
 res.status(200).json(req.body);
});

The GraphQL resolution completes in under 200ms, so latency on that side is not the bottleneck. The issue isolates to the PUT request against the /api/v2/conversations/messaging/guests/${sessionId}/variables endpoint. The platform returns the following error payload:

{
 "code": "bad_request",
 "message": "Invalid guest variable format. Expected array of key-value pairs.",
 "status": 400,
 "messageParameters": {}
}

EmbeddableClientAppSDK initialization imposes a rigid timing window here. The bot framework expects a 200 response before handing off control to the routing engine. If the middleware blocks on the GraphQL call or the subsequent API call, the entire initialization sequence aborts. We currently have a fallback that bypasses the API call entirely, but that defeats the purpose since the VIP routing rule never triggers. The proxy consistently times out at exactly 5 seconds, dropping the session.

Here is a methodical breakdown of what has been attempted and the resulting failures:

• Reshaped the request body to strictly match the GuestVariable schema definition.
• Converted the payload to a list/array format based on the error message.
• Switched the HTTP verb from PUT to POST to see if the endpoint handles bulk updates differently.
• Cross-referenced the official platform documentation for the messaging guest variables endpoint, which only provides examples using a flat object structure.
• Verified the OAuth token possesses the messaging:guest:write scope and confirmed it remains valid for approximately 35 minutes during execution.
• Intercepted a successful manual variable update originating from the desktop client, which utilizes a PATCH request with a completely different payload structure (expected, given the desktop client operates on a separate SDK layer).

None of these adjustments have resolved the 400 response. The bot initialization continues to timeout waiting for the proxy to resolve.

Can anyone provide the exact JSON shape the Guest API requires for bulk variable injection during this specific flow? Alternatively, is there a more reliable hook or event listener we should be tapping into prior to the bot’s routing decision to avoid this 5-second timeout constraint?