Actions overview
The six actions a chatbot can take, which run immediately and which are confirmed first, and the guardrails around outbound calls.
Beyond answering questions, a chatbot can do things during a conversation: look up an order, capture a lead, escalate to a person, book an appointment, create a ticket, or call an endpoint you configure.
Actions are enabled per chatbot by an owner or admin — see Configuring an action.
The actions
| Action | What it does | Confirmed first? |
|---|---|---|
capture_lead | Records a lead from the conversation | No |
escalate_to_human | Hands the conversation to the Inbox | No |
lookup_order | Reads an order from an endpoint you configure | No |
book_appointment | Books via Cal.com, Calendly, or a scheduling webhook | Yes |
create_ticket | Creates a ticket via a webhook | Yes |
http_action | A general outbound call to a URL you allow | Yes |
A seventh tool, get_appointment_slots, is derived rather than configured: when booking is enabled on a provider that publishes availability (Cal.com or Calendly), the agent can fetch real open slots before proposing a time. It has no settings of its own and does not appear in the actions list.
Reads run; writes are confirmed
Reads and internal actions run in-loop — the agent calls them mid-answer and folds the result into its reply.
Anything that writes to an external system is proposed first. The agent reads back what it is about to do, and only executes after the visitor explicitly agrees on their next turn. A confirmed action fires exactly once, even if the visitor confirms twice in quick succession.
On the widget you see a live status chip while a tool runs. On voice, the read-back is spoken and the confirmation is verbal.
Guardrails
- Per-bot enable. Nothing runs unless you switched it on for that chatbot.
- Host allowlist. Outbound calls go through a protected fetcher restricted to
the hosts configured for that action; private and internal addresses are refused.
- Encrypted secrets. API keys used by an action live in an encrypted vault
and are never shown to the model. See Credentials.
- Metered and logged. Every run is metered and written to an action-run
audit record, so you can see what the agent did and when.
Where to go next
Last updated