Integration Steps

For common fields, string substitutions, metadata filters, caching, and execution order, see the Agent Steps Overview.

Webhook Call Step

Makes an HTTP request to an external URL. Use this to integrate with external APIs, trigger workflows in other systems, post to messaging platforms, or send data to any HTTP endpoint.

Fields

Prompt-injection scanning: Webhook response bodies are automatically scanned for prompt injection attacks by the Prompt Scanner. If the response is flagged as unsafe, downstream steps that would consume the tainted data are blocked. The scan result appears as an Output Scan pseudo-step in the agent trace.

Use Case Examples

Post to Slack:

URL: https://hooks.slack.com/services/YOUR/WEBHOOK/URL
Method: POST
Content-Type: application/json
Payload:
{
  "text": "Agent {{agent.name}} completed: {{step.summary.output}}"
}

Send to a custom API:

URL: https://api.example.com/ingest
Method: POST
Content-Type: application/json
Headers:
  Authorization: Bearer {{metadata.api_token}}
  X-Source: seclai-agent
Payload:
{
  "agent_id": "{{agent.id}}",
  "run_id": "{{agent.run_id}}",
  "result": {{step.extract_content.output}},
  "processed_at": "{{datetime UTC}}"
}

Trigger an external workflow:

URL: https://automation.example.com/webhooks/{{metadata.workflow_id}}
Method: POST
Content-Type: application/json
Payload:
{
  "event": "content_processed",
  "data": "{{step.final.output}}"
}

Web Fetch Step

Fetches a single web page and returns its content. Use this to bring external page content into an agent run when the URL is known up front.

Fields

Caching: Results are cached for 5 minutes per URL + format — repeated fetches of the same URL with the same format within this window return instantly without an external request, but each step run is still billed at the standard web_fetch rate.

Prompt-injection scanning: Fetched content is automatically scanned for prompt injection attacks by the Prompt Scanner. If the content is flagged as unsafe, downstream steps that would consume the tainted data are blocked. The scan result appears as an Output Scan pseudo-step in the agent trace.

Governance: The resolved URL is screened against step-input governance policies before the fetch executes — blocking policies can prevent the request entirely. The fetched content itself is not governance-screened at this step, but when it flows into a terminal step (display_result, send_email, etc.) output governance policies evaluate it there. Additionally, the downstream prompt_call input scan provides injection-detection enforcement at the LLM boundary.

Step vs. tool: Use this step when the URL is known and you want predictable, auditable fetch behavior. For autonomous, model-driven page fetching, use the seclai_web_tools tool inside a Prompt Call step instead.

Use Case Examples

Fetch a known article and summarize it:

Web Fetch:
  url: {{metadata.article_url}}
  format: markdown
  → Prompt Call: Summarize the following article in 3 bullet points.
    {{input}}
    → Streaming Result

Search → fetch top result → derive insight:

Web Search:
  query: {{agent.input}}
  limit: 5
  → Extract Content (json_path: "$[0].url")
    → Web Fetch:
        url: {{input}}
        format: markdown
        → Insight: What are the three most important takeaways?
          → Display Result

Web Search Step

Searches the web for a query and returns matching pages with titles, descriptions, and short content snippets. Use this to discover relevant pages for a topic before deciding whether to fetch any of them in full.

Fields

Output shape: A JSON array of result objects, each with url, title, description, and content fields. Content snippets are truncated to ~1000 characters.

Prompt-injection scanning: Search results are automatically scanned for prompt injection attacks by the Prompt Scanner. If the content is flagged as unsafe, downstream steps that would consume the tainted data are blocked. The scan result appears as an Output Scan pseudo-step in the agent trace.

Step vs. tool: Use this step when you want a predictable, deterministic search with a fixed query template and downstream processing. For autonomous, model-driven web research, use the seclai_web_tools tool inside a Prompt Call step instead.

Use Case Examples

Search and synthesize from snippets only (no fetch):

Web Search:
  query: latest developments in {{agent.input}}
  limit: 8
  → Prompt Call: Summarize what these snippets say about {{agent.input}}.
    {{input}}
    → Streaming Result

Search → fetch first result → publish:

Web Search:
  query: "{{metadata.topic}} site:example.com"
  limit: 3
  → Extract Content (json_path: "$[0].url")
    → Web Fetch:
        url: {{input}}
        format: markdown
        → Publish Content

Write AWS S3 Object Step

Saves content to an AWS S3 bucket. Use this to archive agent results, store generated reports, export data, or create file backups.

Fields

Use Case Examples

Store a daily report:

Bucket: my-reports-bucket
Key: reports/{{date UTC}}/daily-summary.html
Content Type: text/html
Content: (uses step input — the HTML report from previous step)

Archive agent results as JSON:

Bucket: agent-results
Key: agents/{{agent.id}}/runs/{{agent.run_id}}/output.json
Content Type: application/json
Content: {{step.extract_content.output}}

Organize by metadata:

Bucket: content-exports
Key: {{metadata.category}}/{{metadata.article_id}}/analysis.json
Content Type: application/json

Send Email Step

Sends an email notification. Use this to deliver reports, send alerts, or notify team members about agent results.

Fields

Use Case Examples

Daily report delivery:

Subject: Daily Summary — {{date America/New_York}}
HTML Body:
<h1>Daily Summary</h1>
{{step.report.output}}
<p>Generated by {{agent.name}} at {{time America/New_York}}</p>

Alert notification:

Subject: Alert: {{metadata.alert_type}} detected
HTML Body:
<h2>Alert Details</h2>
<p><strong>Type:</strong> {{metadata.alert_type}}</p>
<p><strong>Source:</strong> {{metadata.source_url}}</p>
<p><strong>Details:</strong></p>
{{step.analysis.output}}
Text Body:
Alert: {{metadata.alert_type}} detected
Source: {{metadata.source_url}}
Details: {{step.analysis.output}}

Call Agent Step

Calls another agent as a sub-agent, running it synchronously and using its output as this step's output. Use this to compose complex workflows from smaller, reusable agents.

Fields

Use Case Examples

Chain agents for multi-stage processing:

A summarization agent calls an analysis agent first, then processes its output:

Step 1: Call Agent (agent_id: "analysis-agent", pass_input: true, pass_metadata: true)
Step 2: Prompt Call — Summarize the analysis output

Fan-out to specialized agents:

Use parallel branches with call_agent steps to run multiple agents on the same input simultaneously:

Branch 1: Call Agent → "sentiment-agent"
Branch 2: Call Agent → "keyword-agent"
Combinator: Merge results from both agents

Important Considerations

• Recursion protection: A maximum call depth is enforced to prevent infinite loops. If an agent calls itself (directly or indirectly), the run will fail once the depth limit is reached.
• Synchronous execution: The called agent runs to completion before the parent continues. Long-running sub-agents will increase the overall run time.
• Credit usage: Each sub-agent run consumes credits independently based on its own steps.

← Back to Agent Steps Overview