# INSIDE API INSIDE processes HTTP requests for its screens and integrations using the identity, website access and rules required by each operation. *Release 3.3 · developer, operator, visitor* ## What it is The INSIDE API receives HTTP requests from INSIDE screens and connected systems. Each operation defines the request it accepts and the identity or permissions it needs. A request may return data, a downloadable result or an error. ## Who uses it and why As a developer, you use the supported operations agreed for your integration. Operators and visitors use API-backed features through their normal screens and chat experience, without making HTTP calls themselves. ## Where to find it There is no general API configuration page in **Settings**. Ask Powerfront to confirm the supported operations, credentials and request format for your integration. API development tools are described separately under API discovery and diagnostics. ## How it works For a protected operation, INSIDE identifies the caller using the credentials that operation supports. Depending on the operation, this may be an operator session, an operator access token, visitor identification or a scoped integration token. INSIDE resolves the relevant website and applies the operation's access checks. Selecting a website does not by itself grant permission to use it. Browser requests may also need to satisfy the applicable website or operator domain restrictions. The operation reads its inputs from the supported request format. The framework can read JSON, form values, query values and values included in the request path. Use the format agreed for that operation rather than mixing formats or assuming every operation accepts them all. Responses vary by operation. Some return data directly; others return data together with an application status and error message. Download and report operations can return files. Check the operation's response format as well as the HTTP result. ## Configure it Agree these details with Powerfront before connecting an external system: - The operation and HTTP method to use. - The identity, website access and any token scope it requires. - Input names, types and required values. - The success response, application errors and downloadable results, where applicable. Powerfront can change applicable domain restrictions for you. Use **Settings › Account › Operators** with the **Settings** or **Manager** role to manage operator roles and website access within your delegated permissions. ## Limits and good to know - Being discoverable in development tools does not establish that an operation is a supported public integration contract. - A successful sign-in or valid token does not grant every action or website. - Support for one HTTP method does not establish support for another. Use the method agreed for your operation. - Missing or invalid values do not always produce the same validation response. Supply the required inputs explicitly. - Technical errors may be replaced with a general client message. Powerfront can investigate the underlying failure. - Some operations cache results; there is no single freshness guarantee for all API responses. ## Depends on and works with ### This feature uses - **Configured in** [Roles and permissions](ADM-008.md): Each protected API operation applies its required role checks. - **Configured in** [Website, channel and subsite access](ADM-009.md): Website and action permissions limit the resources an API caller can use. - **Configured in** [My API Keys and access restrictions](SEC-012.md): Integration credentials define permitted scopes and IP restrictions for supported token-authenticated operations. - **Configured in** [Website domain checks for browser requests](SEC-024.md): Applicable browser-origin and request checks can reject otherwise identified calls. - **Works better with** [API request testing and diagnostics](EXT-019.md): Development tools help inspect operations and investigate requests. - **Works better with** [Logout and remembered computers](SEC-004.md): Operator requests can use an active operator session. - **Works better with** [Operator access tokens](SEC-011.md): Integration requests can use an operator access token where supported. - **Related** [Browser API requests](EXT-020.md): Browser API requests attach available session context and handle response errors. ### Used by - **Required by** [Autopilot connections through A2A](AIP-019.md): Agent discovery and task operations use INSIDE's HTTP API. - **Required by** [ACP compatibility for AI agents](AIP-020.md): Compatibility operations use the authenticated HTTP API. - **Required by** [Roles and permissions](ADM-008.md): Role checks apply to protected operator actions in the INSIDE API. - **Required by** [API request testing and diagnostics](EXT-019.md): Suggestions and request execution use the registered INSIDE API operations. - **Required by** [Browser API requests](EXT-020.md): Browser requests call INSIDE API operations, which apply their own input and access rules. - **Required by** [Media callbacks and embedded form results](EXT-021.md): INSIDE's HTTP API receives the specific inbound callbacks. - **Required by** [Operator CLI requests and browser login](EXT-024.md): HTTP requests use INSIDE API operations and their existing validation rules. - **Enhances** [Company Shows with prerecorded videos](RTC-029.md): Authorised integrations can list shows. - **Related** [Operator access tokens](SEC-011.md): Confirm which INSIDE API operations support operator access tokens before integrating. - **Related** [My API Keys and access restrictions](SEC-012.md): Use scoped integration tokens only with INSIDE API operations that support them. - **Related** [Custom scripts managed by Powerfront](EXT-015.md): Custom scripts can expose additional API operations with their own access checks. ## FAQ and troubleshooting ### Why do I get Access denied with valid credentials? Check the operation's required role, selected website, action permissions and token scope. Ask Powerfront to check applicable domain restrictions if those appear correct. ### Why does a call work in INSIDE but fail from my integration? The browser session may supply identity and website context that your integration does not. Confirm the supported integration credentials, method and inputs with Powerfront. ### Does a successful HTTP response always mean the action succeeded? No. Some responses carry an application status or error message. Check the response defined for that operation. ### Why is the error message less detailed than expected? INSIDE can hide technical failure details in client responses. Give Powerfront the action, time and visible error so they can investigate.