In short
- Real answers from your systems.The agent reads live data from your API, like an order status, instead of guessing from a help page.
- Signed and safe to retry.Every call is signed so your server can prove it came from OneType, and it carries a stable idempotency key.
- Visitors approve changes.Tools that change something ask the visitor in the chat first, and destructive ones always ask.
- No made-up order numbers.An order number or other ID must come from the visitor, the page or an earlier result, never from the model's imagination.
Most chat bots stop at answering. A visitor asks where their order is, and the bot sends them to a tracking page. With API actions, your agent calls your own system, reads the real status and tells them in the same conversation. It feels like talking to someone on your team who has the right screen open.
How it works
An API is the address your own software answers on. With API actions (coming soon), you add a tool: give it a name, describe in plain words when the agent should use it, and enter the method and https address of your endpoint. You describe the inputs it needs, such as an order number, as a small JSON Schema. When a visitor asks something that fits, the agent fills in those inputs, OneType calls your endpoint, and the agent answers from what your API sent back.
- Pick the method: GET, POST, PUT, PATCH or DELETE.
- Put inputs in the path with {parameter}, the rest go in the query or JSON body.
- Add headers, and mark credentials as secret so they are stored sealed and never shown again.
- Say what the tool does to your data: reads, changes something, or destructive.
The agent chains steps on its own
One answer can use several tools. The agent can look up an order, then check a return window, then offer to hand the chat to a person, all in one reply. It can make up to 20 tool calls in a single answer, and an agent can hold up to 100 tools.
Built so your API can trust it
Every call is signed with a per-agent signing secret, using the open Standard Webhooks scheme, so your server can check it really came from OneType. Each call also carries an idempotency key that stays the same on a retry, so your API can ignore duplicates. OneType only calls public internet addresses and never follows redirects.
For personal data, turn on Only for signed-in visitors. The call then includes the verified contact, taken from your own signed identity token, so the model can never choose whose account a lookup is about. Anonymous visitors are refused.
Changes need the visitor's click
A tool that only reads runs straight away. A tool that changes something shows the visitor a question you write, like Cancel order #1234?, and runs only after they click to approve. Destructive tools always ask. IDs such as order numbers or SKUs must come from what the visitor typed, what the page shows, or an earlier tool result. If the model invents one, the call does not run and the agent is told to look it up or ask.
See how visitor approval works
Limits to know
Your endpoint must answer with JSON within 10 seconds, and the agent reads up to 32 KB of it. Each tool has its own calls-per-minute limit, from 1 to 60, 10 by default. If a call fails, the agent is told and carries on, for example by offering a person.