This page is for developers. To create actions and get their URL and secret from the dashboard, see Campaign Actions (Dashboard Guide).
{{customData}}) for the next message.
Signing the request
Every request must be signed with the action’s secret using HMAC-SHA256.- Sign the exact bytes you send as the body.
- Requests whose timestamp is more than 5 minutes away from Kakiyo’s clock are rejected, so a captured request cannot be replayed later.
- Keep the secret on your server (environment variable
KAKIYO_ACTION_SECRET). Never call the endpoint from a browser.
Request body
JSON object, max 16 KB. Fields not listed below are rejected.
Send at least one of
linkedinUrl, chatId or prospectId. If you send several, they must identify the same prospect. The prospect is always looked up in the action’s own campaign only.
Code samples
Responses
Every response is JSON and includes arequestId. Log it when a call fails.
status is recorded for a new completion and duplicate when the eventId was already received. A repeated completion without an eventId increases completion.count.
Error codes
What the AI sees
Completed actions are added after the prospect’s custom data in{{customData}}, newest first:
{{customData}} for the AI to see this block.
Security notes
- Each action has its own secret. A URL can only mark prospects of its own campaign.
- Secrets are stored encrypted. Rotating a secret in the dashboard makes the old one fail immediately.
- The
contextyou send is cleaned (one line, no template braces or markup) before the AI sees it, and is clearly labelled as data, not instructions.

