AI Actions

What AI Actions are

Most support bots can only answer. AI Actions let your bot act: when a visitor asks for something your systems can do ("cancel my subscription", "change my delivery address"), the bot opens a small card in the chat, collects the details you defined, asks the visitor to confirm, and then Zedinga calls your HTTP endpoint with those details.

The AI never executes anything itself. It only recognizes the intent; the parameters, the confirmation and the API call are handled deterministically by Zedinga's servers. Your endpoint's response body is never shown to the visitor or the AI — the visitor only sees the success or failure message you wrote.

Action cards work on every chat channel: the website widget, the hosted chat page and the inline iframe embed — and in the dashboard's Chat tab, so you can try an action yourself before visitors do.

AI Actions are part of the Business plan and above.

Setting up an action

In your bot's Actions tab, add an action:

1. Name and description — the description is written for the AI: it's how the bot decides a visitor wants this action. Be concrete, e.g. "Cancels the customer's subscription in our billing system."
2. Endpoint — the HTTPS URL and method (POST/PUT/PATCH) on your side. Private and internal addresses are rejected.
3. Headers — e.g. an Authorization key for your API. Values are stored encrypted and never shown again; changing the URL later requires re-entering them (stored credentials never follow an action to a new destination).
4. Parameters — what the visitor fills in on the card (text, email or number; required or optional).
5. JSON body template — what Zedinga sends, with {{parameter}} placeholders. Every placeholder must sit inside a quoted string; values are JSON-escaped so visitor input can never change your payload's structure.
6. Messages — the confirmation summary (supports {{parameter}}), plus the success and failure messages the visitor sees.

Use the test button to fire a signed sample call at your endpoint before going live.

Email verification

Each action can require email verification (on by default). The visitor gets a 6-digit code by email and must enter it before the action runs. When the action has an email parameter, the code is sent to that address — so verification proves the visitor controls the mailbox the action concerns, not just any inbox. The code expires after 10 minutes and allows 5 attempts.

For low-risk actions you can turn verification off; the visitor still has to confirm the summary card explicitly before anything runs.

Verifying requests on your server

Every call carries an X-Zedinga-Signature header: the hex HMAC-SHA256 of the raw request body, keyed with the action's signing secret (reveal it with the eye icon in the Actions tab). Verify it like a webhook:

const crypto = require("crypto");

function verify(rawBody, signature, secret) {
  const expected = crypto
    .createHmac("sha256", secret)
    .update(rawBody)
    .digest("hex");
  return crypto.timingSafeEqual(
    Buffer.from(expected, "hex"),
    Buffer.from(signature, "hex")
  );
}

Respond with a 2xx status for success — anything else (including redirects) is treated as a failure and the visitor sees your failure message. Zedinga waits at most 10 seconds.

Built-in Shopify actions

With a Shopify store connected, the Actions tab gains three built-in operations — no endpoint or coding needed:

• Cancel order — unshipped orders only; cancels and refunds in full to the original payment method automatically.
• Change delivery address — unshipped orders only.
• Request a return — shipped orders only; opens a return request that you approve in Shopify admin. No money moves from chat on shipped orders.

Every run is order-verified: the customer proves the order number and email exactly like the in-chat order lookup, and the 6-digit code goes to the email stored on the order — a leaked receipt is never enough. Fixed safety rules route anything else (already shipped, already refunded, over your amount cap) to your team instead, and the optional self-serve amount cap hands orders above a total you choose to a human automatically.

Enabling a Shopify action checks the store connection's actual permissions; if your store was connected before these were introduced, reconnect it from the Integrations page once.

Monitoring

The Actions tab's execution log lists the last 50 runs with their status, the HTTP code your endpoint returned and the visitor's verified email. Each execution also leaves a short trace line in the conversation transcript, so your team always sees what the bot did.