Actions

#Creating actions

Create actions from Chatbot Settings → Actions. Each action needs:

• Name — A short identifier the AI uses to decide when to call it (e.g. "lookup order")
• Description — Explains to the AI when this action should be used
• Endpoint URL — The HTTPS URL to call
• HTTP Method — GET, POST, PUT, PATCH, or DELETE
• Custom Headers — Authorization tokens or other headers

#Parameters

Actions can accept parameters that are passed to your endpoint. Each parameter has a name, type, and source.

Parameter types

• string — Free-form text
• number — Numeric value
• boolean — True or false
• enum — One of a predefined set of values

Parameter sources

• customer — Collected by the AI from the conversation (e.g. "What's your order number?")
• context — Extracted from the conversation context automatically
• system — Injected server-side (e.g. the customer ID) — never exposed to the user

#Request format

How parameters are sent depends on the HTTP method:

• GET, DELETE — Parameters are appended as query strings
• POST, PUT, PATCH — Parameters are sent in a JSON body

Example: POST request

1
2
3
4
5
6
7
POST https://api.acme.com/actions/create-ticket

{
  "subject": "Billing question",
  "priority": "high",
  "customerId": "cus_12345"
}

Example: GET request

1
2
GET https://api.acme.com/actions/order-status
  ?orderId=4521

#Customer confirmation

Enable Requires Confirmation on an action to make the chatbot ask the customer for approval before executing. This is useful for destructive or sensitive operations like cancelling an order or updating account details.

When confirmation is required, the AI will present the action and collected parameters to the customer and wait for explicit approval before making the API call.

#Testing

Each action has a Test button that lets you fire it with sample argument values. The test result shows:

• HTTP status code and response time
• The response body from your endpoint
• Any errors (timeouts, connection failures, invalid URLs)

#Security

• HTTPS only — Action endpoints must use HTTPS (HTTP is rejected)
• Private IPs blocked — Localhost, private IP ranges, and metadata endpoints are rejected
• Timeout — Requests time out after 10 seconds by default (configurable 1-30s)
• Response truncation — Responses over 4,000 characters are truncated to prevent token explosion in the AI context
• Server-side execution — All API calls happen server-to-server from CustomerHero's infrastructure, never from the browser