Esta página se publica en inglés y en ucraniano; abajo está la versión en inglés.

Placeholders in tool requests

For developers, in code: every {{…}} a tool may carry — secrets, the user token, the screen's route and params, the lead's fields — where each is valid, how it is encoded, and what happens to an unknown one.

A placeholder is {{name}} in a tool’s URL, headers, query values or body template. It is substituted at the moment the request is built, in one pass, in string values only — never in a key.

Placeholder	Value	Available on	Encoding
`{{secret.<name>}}`	a secret of this tool, decrypted	every call	raw everywhere — Secrets
`{{user}}`	the logged-in visitor’s token, relayed by `Shukai.setUser`	a model call and a proactive tick; empty on Test and on delivery	raw — User identity
`{{screen.route}}`	the matched route pattern of the screen the visitor is on (`/orders/{id}`)	a model call and a proactive tick	percent-encoded in a URL, raw elsewhere
`{{screen.<param>}}`	the value of a placeholder the matched route declares — `{{screen.siteId}}` only if the route has `{siteId}`	the same	percent-encoded in a URL, raw elsewhere
`{{handoff.contact}}` · `.contact_kind` · `.question` · `.comment` · `.page` · `.ref` · `.source` · `.language` · `.id`	the lead’s fields	lead delivery only — Handoff delivery	percent-encoded in a URL, raw elsewhere; control characters stripped

The page’s own URL and its query string are deliberately not exposed as placeholders: owners put ?email= in URLs, and a tool’s request is logged by whoever receives it.

Rules

Unknown placeholder: left standing as the literal {{…}} and sent. The Test button shows the raw request’s result, which is how a typo surfaces.
Absent {{user}} (an anonymous visitor, or Test): resolves to an empty string, and a header whose template is nothing but Bearer {{user}} is dropped rather than sent empty.
Path arguments ({name} with single braces) are a different mechanism: they are the model’s arguments placed by location: path, and they are percent-encoded.
One pass: a substituted value is never scanned for placeholders again, so a visitor’s comment cannot expand into one of your secrets.

Examples

GET https://api.example.com/orders?user={{screen.userId}}&q={query}
Authorization: Bearer {{user}}
X-Api-Key: {{secret.catalogue}}

POST https://crm.example.com/leads
Authorization: Token {{secret.crm}}
{ "email": "{{handoff.contact}}", "message": "{{handoff.question}}",
  "page": "{{handoff.page}}", "lang": "{{handoff.language}}", "ref": "{{handoff.ref}}" }