Use assistants, APIs and webhooks safely

An assistant can help inspect and manage onboarding when the appropriate connection and permissions are enabled. Start with discovery and a read-only request.

A useful first request

Ask the connected assistant to list available workspaces, identify the intended one and list its flows without making changes. For client portal work, inspect the current capabilities and resolve the account before referring to a task or file. See the MCP DigLab manual for general connection guidance.

Keep actions distinct

Creating a draft is different from publishing it. Publishing does not automatically enable public registration. Inviting a person can send email. A message or webhook can disclose client data. Ask for the exact intended operation, recipient and workspace instead of a vague instruction to do everything.

Handle conflicts and retries

Editing tools can require the revision from the original resource read. On a conflict, reread the current content and reconcile your intent. Do not attach a fresh revision to an old overwrite. For uncertain sends, preserve the original idempotency key and inspect the existing result before creating another operation.

Protect credentials and data

Use the connection method shown by your own setup. Do not publish API keys, private reply addresses, signed upload links or client answers in logs and screenshots. For webhooks, verify signatures and keep the receiving destination restricted to its authorized purpose.