Skip to main content
This page is for developers. To create actions and get their URL and secret from the dashboard, see Campaign Actions (Dashboard Guide).
Each campaign action has its own endpoint and signing secret. Call it from your server when a prospect completes the action. Kakiyo adds the completion to that prospect’s AI context ({{customData}}) for the next message.
Copy the full URL and the secret from the campaign’s Actions tab.

Signing the request

Every request must be signed with the action’s secret using HMAC-SHA256.
  • Sign the exact bytes you send as the body.
  • Requests whose timestamp is more than 5 minutes away from Kakiyo’s clock are rejected, so a captured request cannot be replayed later.
  • Keep the secret on your server (environment variable KAKIYO_ACTION_SECRET). Never call the endpoint from a browser.

Request body

JSON object, max 16 KB. Fields not listed below are rejected. Send at least one of linkedinUrl, chatId or prospectId. If you send several, they must identify the same prospect. The prospect is always looked up in the action’s own campaign only.

Code samples

Responses

Every response is JSON and includes a requestId. Log it when a call fails.
status is recorded for a new completion and duplicate when the eventId was already received. A repeated completion without an eventId increases completion.count.

Error codes

What the AI sees

Completed actions are added after the prospect’s custom data in {{customData}}, newest first:
The prompt of the campaign must use {{customData}} for the AI to see this block.

Security notes

  • Each action has its own secret. A URL can only mark prospects of its own campaign.
  • Secrets are stored encrypted. Rotating a secret in the dashboard makes the old one fail immediately.
  • The context you send is cleaned (one line, no template braces or markup) before the AI sees it, and is clearly labelled as data, not instructions.
Last modified on November 12, 2026