Home / Docs / API Execution

API ExecutionCopy link to this section

By default, the in-product agent (onboarding and support) interacts with your product the same way a user does: clicking buttons, filling forms, navigating screens. API execution adds a second mode. When an endpoint is enabled, the agent can call it directly to complete an action faster, or to handle a workflow that is awkward through the UI alone.

API execution is optional and off by default. Most teams never need it. This page covers when to enable it, what the controls do, and what changes at the execution layer. It does not apply to the demo agent, which drives your product in a browser on Floe's servers and never calls your APIs.

Browser actions vs API actionsCopy link to this section

Browser actions are the default. The agent clicks, types, scrolls, and navigates like a human user, so your product's own validation, permissions, and error handling apply automatically. If a button is disabled, the agent can't click it. If a form field rejects bad input, the agent sees the error and adjusts.

API actions bypass the UI. The agent calls your product's endpoints directly, which is faster for bulk operations or actions buried deep in nested menus. It also means your UI-level guardrails don't apply; the controls below replace them.

For most onboarding flows, browser actions are all you need. The agent walking through the product the way a real user would is the point. API execution matters when something would take 30 clicks — importing a batch of records, configuring a series of integrations.

When to enable API executionCopy link to this section

Enable it when:

  • Onboarding flows need setup that has no UI, or that is far faster through an API
  • You want the agent to seed data before walking the user through a screen

Leave it off when:

  • Your product's UI already covers everything the agent needs to do
  • You want the agent to demonstrate the real user experience, not a shortcut
  • You haven't reviewed which endpoints are safe for automated access

The controlsCopy link to this section

Open Onboarding Agent → Capabilities for the site. The Direct API Execution card holds everything.

What the agent enforces

  • The per-endpoint toggle. Every endpoint Floe has discovered for the site is listed with its own switch, all off by default. The agent only ever calls an endpoint whose switch is on. This is the gate: if three endpoints are on, those three are callable and nothing else is.
  • Same origin, as the signed-in user. Calls are made from the user's own browser, with their existing session, and only to your product's own origin; the SDK refuses cross-origin requests. The agent can never do more than the logged-in user could do by hand, and API execution sends no stored product credential with the request.
  • Confirmation. An endpoint whose execution scope is Supervised makes the agent ask the user before calling it. Full Access skips that question.

What the card offers but the runtime does not apply yet

  • Read Only is accepted as a scope, but it does not currently block write methods: an enabled endpoint can be called with whatever method it was discovered with. Treat it as Full Access until this changes.
  • Authentication. Service account stores a key encrypted at rest and OAuth delegation is selectable, but every call today uses the signed-in user's session regardless. Neither option adds a credential to the request.
  • The master switch reveals the controls in the dashboard. It does not switch off endpoints you already enabled; turn those off individually.

Because the per-endpoint toggle is the only hard gate, enable only endpoints you would be comfortable letting the signed-in user call by hand, and choose Supervised for anything that writes.

FAQCopy link to this section

Does enabling API execution require me to share API credentials? No. Calls run in the user's browser under their existing login, and API execution sends no stored product credential with the request. The service-account field on the card stores a key encrypted at rest, but the runtime does not use it today.

Can the agent call endpoints I haven't explicitly enabled? No. The per-endpoint toggle is a hard gate.

What happens if an API call fails? The agent falls back to browser actions and attempts the same task through the UI. If both fail, it tells the user and moves on.

Does this apply to the demo agent? No. The demo agent runs in Floe's own browser against your demo environment and has no API execution. This page is about the in-product onboarding and support agent embedded on your pages.