Assistant webhook: let an outside system run an assistant

Create the webhook

1. As an owner or admin, open Duaer Settings › Organization › Duaer employee portal › Employee assistants and click Create webhook next to the assistant.
2. Copy the URL shown. It is shown only this once; Duaer keeps only its hash, so it cannot be shown again.
3. If it is lost or leaked, click Create webhook again for a new URL; the old one stops working at once. Revoke webhook stops accepting calls.

In their own assistant, employees only see that outside systems can also run it by webhook, managed by admins; they never see the URL.

Request

• Method: POST, to the URL you copied, of the form https://<your Duaer address>/rest/agent-hooks/<token>. The URL itself is the credential: no sign-in or other headers.
• Body (optional): JSON. A string field named text is passed along; otherwise the whole JSON is passed as text. Up to 4,000 characters; the rest is cut.
• What you send reaches the assistant as data, never as instructions.

curl -X POST "https://<your Duaer address>/rest/agent-hooks/<token>" \
  -H "Content-Type: application/json" \
  -d '{"text": "Order 42 was cancelled by the customer"}'

Responses

• 202: accepted. In the background, the assistant runs once for the person who built it and once for each colleague it is shared with; results land on their home pages and in their chat tools as set.
• 404: the token is wrong, or the assistant is off or its webhook was revoked.
• 429: the assistant has used today’s triggered runs (24 per UTC day, together with change triggers), or one IP sent more than 60 calls in a minute.

The response never carries the assistant’s answer; answers go only to the people who may see them.

Security

• Only owners and admins create and revoke webhooks, and both are recorded in the audit log.
• Each run reads with the access of the person it is for; the outside system sees nothing.
• The assistant only reads; a webhook never makes it run actions.
• More in How Duaer protects your company’s data.