Platforms
Botpress
Pre- and post-processing HTTP steps inside a Botpress workflow.
About 4 minutes hands-on
What this guide does not cover
- Shows the HTTP steps. It does not cover Botpress flow design, NLU training, or channel configuration.
- Store only the guard verdict in Botpress logs, never the raw text — Botpress logs are not a secure store.
How it works
1. Input step — Call
POST /api/guard/input before the user message reaches your AI agent2. Output step — Call
POST /api/guard/output before the AI response goes to the user3. Handle decisions — Block or redirect when the guard returns BLOCK or HUMAN_REVIEW
4. Audit logs — Store only the public guard result (not raw text) in Botpress logs
Environment
Terminal
SOTER_API_KEY=ck_live_your_key_here
# SOTER_BASE_URL is optional if using the SDK — a default is includedBotpress workflow example
TypeScript
1// In your Botpress action or hook
2const inputResult = await fetch(`${process.env.SOTER_BASE_URL}/api/guard/input`, {
3 method: "POST",
4 headers: {
5 "x-api-key": process.env.SOTER_API_KEY,
6 "Content-Type": "application/json",
7 },
8 body: JSON.stringify({ message: userMessage }),
9}).then((r) => r.json());
10
11if (inputResult.action === "BLOCK" || inputResult.action === "HUMAN_REVIEW") {
12 return { reply: "This message was blocked.", blocked: true };
13}
14
15// Pass safeText to your AI agent
16const aiReply = await callBotpressAgent(inputResult.safeText ?? userMessage);
17
18const outputResult = await fetch(`${process.env.SOTER_BASE_URL}/api/guard/output`, {
19 method: "POST",
20 headers: {
21 "x-api-key": process.env.SOTER_API_KEY,
22 "Content-Type": "application/json",
23 },
24 body: JSON.stringify({ aiResponse: aiReply }),
25}).then((r) => r.json());
26
27return {
28 reply: outputResult.safeText ?? outputResult.redactedText ?? aiReply,
29 blocked: outputResult.action === "BLOCK",
30};⚠️
Keep the API key server-side in your Botpress environment variables. Never expose it to the browser.