> ## Documentation Index > Fetch the complete documentation index at: https://docs.dubot.ai/llms.txt > Use this file to discover all available pages before exploring further. # Create an action > Define a governed Session API operation or client-side callback Actions are versioned, publishable contracts. Creating or publishing an action does not make it available to an experience until a published Skill capability includes it and that capability is attached to the active agent. Create the contract manually when you already know the operation. If you need to observe an existing product workflow first, use controlled-rollout [Action Discovery](/guides/add-actions-with-extension). Open **Actions**, select **New action**, and choose the execution branch that owns the operation. Session API actions call a reviewed product endpoint. Client-side callbacks run a function registered by the host application. Backend API actions are shown as coming later. The action type picker with Session API and client-side callback options ## Start with the shared contract Give the action a human title, model-facing description, response mask, and execution policy. Choose `auto` or `confirm`. Dubot derives the stable tool key from the title when the action is created. The action also has an enabled state, and MCP availability is a separate opt-in when that channel is in scope. An action configuration with its model-facing description, risk, policy, method, and endpoint ## Choose an execution branch Use this for an authenticated operation in the customer's product API. Define the HTTP method and endpoint, input schema, response mask, risk classification, and `auto` or `confirm` policy. Customer-owned first-party code resolves the published tool key and performs the request with the application's existing authentication. Use this for an operation owned by the current page or host application. Define the callback's title, model-facing description, and policy. After creation, install the matching callback in the host application. Its input schema is observed from the SDK registration and is not entered in the dashboard. The host runs the registered function when the callback is invoked. The browser SDK does not choose an arbitrary Session API destination, and Dubot does not own the customer's credentials. A callback that is not registered by the host is unavailable at runtime. ## Save, review, and publish Choose the action type, complete its required fields, and select **Create**. Check schema evidence, response fields, risk, policy, enabled state, and availability behavior. Install a client-side callback in the host before expecting it to run. Publish the version that should be eligible for runtime use. Add the published action to a Skill capability, then publish that capability. High-risk and destructive choices currently prefill `confirm` in the editor, but the saved execution policy is the runtime control and still requires review. Backend API actions are shown as a future action type and are not part of the current product contract. ## Expected result The published action appears through the intended published Skill and experience. A safe Test call returns only the masked response fields, applies the reviewed confirmation policy, and creates an Activity record for success or failure. Next, [create or update the Skill capability](/guides/create-capability) that will carry the action. See [SDK actions](/sdk/actions) for registration and the execution boundary, and [Troubleshoot the browser SDK](/sdk/troubleshooting#an-action-is-unavailable) when the runtime does not offer it.