INSIDE API
INSIDE processes HTTP requests for its screens and integrations using the identity, website access and rules required by each operation.
What it is
The INSIDE API receives HTTP requests from INSIDE screens and connected systems. Each operation defines the request it accepts and the identity or permissions it needs. A request may return data, a downloadable result or an error.
Who uses it and why
As a developer, you use the supported operations agreed for your integration. Operators and visitors use API-backed features through their normal screens and chat experience, without making HTTP calls themselves.
Where to find it
There is no general API configuration page in Settings. Ask Powerfront to confirm the supported operations, credentials and request format for your integration. API development tools are described separately under API discovery and diagnostics.
How it works
For a protected operation, INSIDE identifies the caller using the credentials that operation supports. Depending on the operation, this may be an operator session, an operator access token, visitor identification or a scoped integration token.
INSIDE resolves the relevant website and applies the operation's access checks. Selecting a website does not by itself grant permission to use it. Browser requests may also need to satisfy the applicable website or operator domain restrictions.
The operation reads its inputs from the supported request format. The framework can read JSON, form values, query values and values included in the request path. Use the format agreed for that operation rather than mixing formats or assuming every operation accepts them all.
Responses vary by operation. Some return data directly; others return data together with an application status and error message. Download and report operations can return files. Check the operation's response format as well as the HTTP result.
Configure it
Agree these details with Powerfront before connecting an external system:
- The operation and HTTP method to use.
- The identity, website access and any token scope it requires.
- Input names, types and required values.
- The success response, application errors and downloadable results, where applicable.
Powerfront can change applicable domain restrictions for you. Use Settings › Account › Operators with the Settings or Manager role to manage operator roles and website access within your delegated permissions.
Limits and good to know
- Being discoverable in development tools does not establish that an operation is a supported public integration contract.
- A successful sign-in or valid token does not grant every action or website.
- Support for one HTTP method does not establish support for another. Use the method agreed for your operation.
- Missing or invalid values do not always produce the same validation response. Supply the required inputs explicitly.
- Technical errors may be replaced with a general client message. Powerfront can investigate the underlying failure.
- Some operations cache results; there is no single freshness guarantee for all API responses.
Depends on and works with
+3 more · used by
- Browser API requestsRequires
Browser requests call INSIDE API operations, which apply their own input and access rules.
- Media callbacks and embedded form resultsRequires
INSIDE's HTTP API receives the specific inbound callbacks.
- Operator CLI requests and browser loginRequires
HTTP requests use INSIDE API operations and their existing validation rules.
View all connections as a list
This feature uses
- API request testing and diagnosticsEnhances
Development tools help inspect operations and investigate requests.
- Browser API requestsRelated
Browser API requests attach available session context and handle response errors.
- Logout and remembered computersEnhances
Operator requests can use an active operator session.
- Roles and permissionsConfigured by
Each protected API operation applies its required role checks.
- Website, channel and subsite accessConfigured by
Website and action permissions limit the resources an API caller can use.
- Operator access tokensEnhances
Integration requests can use an operator access token where supported.
- My API Keys and access restrictionsConfigured by
Integration credentials define permitted scopes and IP restrictions for supported token-authenticated operations.
- Website domain checks for browser requestsConfigured by
Applicable browser-origin and request checks can reject otherwise identified calls.
Used by
- Autopilot connections through A2ARequires
Agent discovery and task operations use INSIDE's HTTP API.
- ACP compatibility for AI agentsRequires
Compatibility operations use the authenticated HTTP API.
- Company Shows with prerecorded videosEnhances
Authorised integrations can list shows.
- Roles and permissionsRequires
Role checks apply to protected operator actions in the INSIDE API.
- Operator access tokensRelated
Confirm which INSIDE API operations support operator access tokens before integrating.
- My API Keys and access restrictionsRelated
Use scoped integration tokens only with INSIDE API operations that support them.
- Custom scripts managed by PowerfrontRelated
Custom scripts can expose additional API operations with their own access checks.
- API request testing and diagnosticsRequires
Suggestions and request execution use the registered INSIDE API operations.
- Browser API requestsRequires
Browser requests call INSIDE API operations, which apply their own input and access rules.
- Media callbacks and embedded form resultsRequires
INSIDE's HTTP API receives the specific inbound callbacks.
- Operator CLI requests and browser loginRequires
HTTP requests use INSIDE API operations and their existing validation rules.
FAQ and troubleshooting
Why do I get Access denied with valid credentials?
Check the operation's required role, selected website, action permissions and token scope. Ask Powerfront to check applicable domain restrictions if those appear correct.
Why does a call work in INSIDE but fail from my integration?
The browser session may supply identity and website context that your integration does not. Confirm the supported integration credentials, method and inputs with Powerfront.
Does a successful HTTP response always mean the action succeeded?
No. Some responses carry an application status or error message. Check the response defined for that operation.
Why is the error message less detailed than expected?
INSIDE can hide technical failure details in client responses. Give Powerfront the action, time and visible error so they can investigate.