Sign in
latestOpenAPI 3.1.0raw.githubusercontent.com2026-08-141070460.9 KB

9b9326fe08a5

Others

Create a browser action

Creates a single-use link to one of the project's trusted origins that, when opened, makes the Hexclave SDK on that page perform an action in the browser: signing in as a given user (impersonation) or showing the clickmap overlay. Requires server or higher access.

post/browser-actions

Request body

type'impersonation' | 'clickmap-overlay' required

The action the SDK performs after the link is opened. impersonation signs the browser in as user_id; clickmap-overlay mounts the clickmap overlay.

originstring required

The project's trusted origin where the link opens. The action can only be consumed by a request whose Origin header matches this value.

expires_in_millisinteger

How long the single-use link remains redeemable, in milliseconds.

session_expires_in_millisinteger

Lifetime of the impersonation session, measured from link creation. Ignored for clickmap-overlay actions.

user_idstring

ID of the user to impersonate. Required when type is impersonation and ignored for clickmap-overlay.

Example request

{
  "type": "impersonation",
  "origin": "https://app.example.com",
  "expires_in_millis": 300000,
  "session_expires_in_millis": 7200000,
  "user_id": "user_123"
}

Response

Successful response

idstring required

Opaque, single-use browser action ID.

urlstring required

URL at the requested trusted origin containing the browser action ID. Open it in the target browser to perform the action.

expires_at_millisnumber required

Unix timestamp in milliseconds after which the browser action can no longer be consumed.

Example response

{
  "id": "browser_action_code",
  "url": "https://app.example.com/?hexclave_action_id=browser_action_code",
  "expires_at_millis": 1800000000000
}