Config API

The public endpoint that serves tool definitions to the snippet.

Endpoint

GET /api/sites/:publicId/config

:publicId is the public identifier from your site's snippet block. It's safe to expose in HTML and doesn't grant write access.

Query parameters

Response

{
  "siteId": "uuid",
  "tools": [
    {
      "id": "uuid",
      "name": "addToCart",
      "description": "Add a product to the shopping cart",
      "inputSchema": { "type": "object", "properties": {} },
      "executeJs": "return window.__aigentablyDemo.addToCartUI(args.productId, args.quantity)",
      "exposedTo": []
    }
  ],
  "pollInterval": 300
}

• tools: only enabled tools matching the ?path= pattern are returned
• exposedTo: origins in the page's frame tree this tool is visible to, passed straight through to registerTool()'s options. It scopes which documents can see the tool, not which agent is allowed to call it; an empty array means every document in the frame tree.
• pollInterval: seconds between re-fetches (default: 300)

Caching

The endpoint uses ETag-based caching. The snippet sends If-None-Match on subsequent requests. If nothing has changed, the server returns 304 Not Modified and the snippet skips re-registration.

Cache-Control is set to public, max-age=60. Tool changes appear within 60 seconds.

Rate limiting

Requests are rate-limited per site. The snippet's polling interval keeps well within the limit under normal usage. Exceeded: 429 Too Many Requests.

CORS

The endpoint is open to all origins (Access-Control-Allow-Origin: *). This is intentional, as the snippet runs on third-party sites.

Error responses