Create an action

Define a governed Session API operation or client-side callback

Actions are versioned, publishable contracts. Creating or publishing an action does not make it available to an experience until a published Skill capability includes it and that capability is attached to the active agent.

Create the contract manually when you already know the operation. If you need to observe an existing product workflow first, use controlled-rollout Action Discovery.

Open Actions, select New action, and choose the execution branch that owns the operation. Session API actions call a reviewed product endpoint. Client-side callbacks run a function registered by the host application. Backend API actions are shown as coming later.

Choose the execution branch that owns the operation. Backend API actions are not yet available.

Start with the shared contract

Give the action a human title, model-facing description, response mask, and execution policy. Choose auto or confirm. Dubot derives the stable tool key from the title when the action is created. The action also has an enabled state, and MCP availability is a separate opt-in when that channel is in scope.

Review the description, risk, policy, method, endpoint, schema, and response mask before publishing.

Choose an execution branch

Session API

Use this for an authenticated operation in the customer’s product API. Define the HTTP method and endpoint, input schema, response mask, risk classification, and auto or confirm policy. Customer-owned first-party code resolves the published tool key and performs the request with the application’s existing authentication.

Client-side callback

Use this for an operation owned by the current page or host application. Define the callback’s title, model-facing description, and policy. After creation, install the matching callback in the host application. Its input schema is observed from the SDK registration and is not entered in the dashboard. The host runs the registered function when the callback is invoked.

The browser SDK does not choose an arbitrary Session API destination, and Dubot does not own the customer’s credentials. A callback that is not registered by the host is unavailable at runtime.

Save, review, and publish

1. Create the draft

   Choose the action type, complete its required fields, and select Create.
2. Review and install

   Check schema evidence, response fields, risk, policy, enabled state, and availability behavior. Install a client-side callback in the host before expecting it to run.
3. Publish

   Publish the version that should be eligible for runtime use.
4. Attach through a Skill

   Add the published action to a Skill capability, then publish that capability.

High-risk and destructive choices currently prefill confirm in the editor, but the saved execution policy is the runtime control and still requires review.

Backend API actions are shown as a future action type and are not part of the current product contract.

Expected result

The published action appears through the intended published Skill and experience. A safe Test call returns only the masked response fields, applies the reviewed confirmation policy, and creates an Activity record for success or failure.

Next, create or update the Skill capability that will carry the action. See SDK actions for registration and the execution boundary, and Troubleshoot the browser SDK when the runtime does not offer it.