Fields
Every
{{placeholder}} in the URL or body must be a declared param; saving fails otherwise.
Example
AGET order lookup:
Keep the response to what the agent needs
Some APIs answer with more than the agent should see: an access token, internal ids, or details of other customers. List Response fields and the agent gets only those values, by path into the JSON:Example: build a visitor their own trial agent
If you sell to businesses, such as an agency or a software company, your agent can build a visitor a working agent from their website in the middle of a chat, and give them a link where they try it and claim it free. The action calls the Wiredesk API:data.claim_url in its result. The full recipe, with the limits, is in Agent-first onboarding.
API keys
Add the key under Authentication while setting up the action, rather than pasting it into the URL: choose Add a new key… under API key and enter a label and the secret. It is stored encrypted, never shown again, and never given to the agent — it is only attached to the request. Saved keys can be reused by other actions. They are listed under API keys on Actions › Connections, by label and last four characters, where you can delete them. If your API expects the key somewhere other than a header, put{{credential}} in the request body and the saved key is filled in there. It is never allowed in the URL.
Deleting a key stops every action that uses it until you attach a new one.
Limits
- Timeout: 5 seconds on a phone call, 30 seconds on chat and WhatsApp, and 15 seconds on email. On a call, the agent says a short holding line before calling.
- Response size: the agent reads the first 1,500 characters of the response on a call and the first 4,000 on chat and email. Return a small JSON object with just what the agent needs, or list response fields.
- Redirects are not followed. Point the URL at the final address.
- Addresses: the URL must be
https, use a hostname rather than an IP address, and not point at a private network orlocalhost. This is checked again against the actual URL after parameters are filled in. - Only the parameters you declared are filled in. The agent cannot add others.
Designing the endpoint
- Return errors the agent can say out loud:
{"error": "No order 10482 — check the number on the confirmation email."}. - Treat every parameter as untrusted input from the public. The agent fills them from what a customer typed or said.
- Scope the credential to read-only access on what the action needs.
Checking it works
Every call appears in the Action log under Inbox → Extra fields, with the tool name,ok or failed, how long it took, and a link to the conversation. failed means the request did not complete — a timeout, a redirect, a refused address. A response with an error status such as 404 still shows as ok, because your endpoint answered; read the conversation to see what the agent made of it.
Ask your agent a question that should trigger the action, then look there.