Each integration chooses which of these to offer. Each tool reaches the browser with a name, a title (for example "List products"), a description, the inputs it takes (as a JSON Schema, a standard way to describe data) and hints about whether it changes anything. You can change any tool's description under Configure.
Tools that only read#
These don't save anything.
| Tool | What it does | Input | Result | Options under Configure |
|---|---|---|---|---|
list_products |
Lists your products. | none | { products: [...] } |
Limit it to chosen products |
show_product |
Details of one product. | slug (required): the product's short id, from list_products |
{ product } |
|
compare_products |
Several products side by side. | slugs: a list of at least 2 |
{ products: [...] } |
|
explain_cover |
What a product covers and doesn't. | slug (required) |
{ product, included, excluded, cover_limits, cooling_off_days } |
|
check_availability |
Which products you offer, optionally of one type. | product_type (optional): term, decreasing_term, whole_of_life, critical_illness, income_protection or bundled |
{ available: [{ slug, name, product_type }] } |
|
answer_question |
Answers a question using your AI agent. | question (required); conversation_id (optional: from an earlier answer, to carry on the same conversation) |
{ answer, conversation_id } |
Which live agent answers |
talk_to_a_specialist |
Gives a link where a person can take over. | none | { url } |
A custom web address (the default is your first published mini-site) |
answer_question doesn't change your data, but it does start or continue a conversation in your inbox, and
it runs your AI agent, which uses AI credit.
Tools that save something#
These are marked as changing data, so a careful AI assistant should check with the visitor first.
| Tool | What it does | Input | Result | Options under Configure |
|---|---|---|---|---|
register_interest |
Passes on a visitor's details so your team can follow up. | name, email, phone, message, metadata (extra details as key and value pairs). An email or a phone number is required. |
{ saved, status: "received", contact_id, message } |
Send the lead on to your own CRM |
share_requirements |
Adds what the visitor is looking for to their record. | requirements (required: key and value pairs), plus contact_id (from register_interest) or email |
{ saved, contact_id, details_recorded } |
|
book_callback |
Books a phone call. | name, phone and start (date and time, for example 2026-09-12T14:00:00) are required. email, duration_minutes (default 30) and reason are optional. |
{ booked, start, end, invited, message } |
The calendar to book on (default: your internal diary), a Google Sheet to log bookings to |
Each tool only reads the inputs listed for it.
What it sends and where it goes#
The script sends only what the AI assistant passes to a tool, plus your key. It reads nothing from your page, sets no cookies and stores nothing in the browser.
register_interestfinds the visitor among your contacts (by email, then phone) or adds them. It fills in only blank details, so it never overwrites what you already have. It records their consent for the ways they gave you to contact them, makes them a lead, and adds an entry to their timeline. Anymetadata(up to 10 entries) is saved to their record, marked as coming from an AI assistant and given the lowest level of trust. If you set an outbound CRM on the tool, the lead is sent there too. The assistant is only told that you have the details.share_requirementssavesrequirementsto an existing contact's record, in the same low-trust way. It never creates a contact.book_callbackfinds or adds the contact, books the call (with an invitation when an email is given), records it on their lead, tells your team, and logs it to Google Sheets if you set that up. It only books inside your business hours, in the future, and in a free slot.answer_questionstarts a conversation in your inbox, or carries one on when given aconversation_id, and answers with your AI agent and its usual safety checks.- No tool reads your contacts back. An assistant can't list or look up your contacts.
- Every tool call is logged and shown under Insights > Conversations.
What's public and what's protected#
- The key is public. It is meant to be in your page source, like the key in any embedded widget. It can't do anything on its own.
- Your websites list is the main protection. Every request must come from one of the websites on the integration. If a key leaks and is misused, press Rotate key and update your snippet. The old key stops working straight away.
- Only safe actions. Because a determined person could call the tools outside a browser, the tools only read product information or take in leads and callbacks. Nothing returns your customers' data.
- Unticked tools can't be called. A tool you haven't ticked isn't offered, and a direct call to it is refused.
- Your plan is checked on every request. If your plan stops including agent access, the snippet stops working, even though the integration is still there.
- No visitor login. Tool calls are made on behalf of your firm through the key, not as a signed-in person.
- Rate limit. Up to 300 requests per visitor IP address every 5 minutes.