docs(agents): explain JSON escaping in webhook body templates

agents/build/dynamic-variables.mdx

@@ -33,7 +33,7 @@
 and they are on the {{plan}} plan. Greet them by name.
 ```
 
 Pass values as a flat object of strings, numbers, or booleans. Variable names must match `[A-Za-z][A-Za-z0-9_]*` (no hyphens or dots; the dotted `system.*` names are reserved for [system variables](#system-variables)), string values are capped at 100,000 characters, and a request can carry at most 500 variables totaling 1 MiB as UTF-8 JSON. Violations reject session creation with `422`:
 
 <CodeGroup>
 ```bash API (curl)
@@ -121,7 +121,7 @@
 ```
 
 <Tip>
 In `agentId` mode, values arrive from the end user's browser. Treat them as untrusted input, and use `sessionToken` mode when personalization must come from data only your backend knows.
 </Tip>
 
 ### Custom variables in webhook tools
@@ -132,17 +132,18 @@
 https://ehr.example.com/patients/{{patient_id}}/appointments?clinic={{clinic_id}}
 ```
 
-- In the URL the value is URL-encoded, like argument values. In header values and the body template it is inserted as is. Numbers render as written, booleans as `true` or `false`.
+- In the URL the value is URL-encoded, like argument values. In header values it is inserted as is. Numbers render as written, booleans as `true` or `false`.
+- In a JSON body, a value inside a string is JSON-escaped, like argument values. See [Values in a JSON body](/agents/build/webhook-tools#values-in-a-json-body).
 - When the tool declares an argument with the same name as a custom variable, the argument wins: that placeholder is filled from what the agent supplies.
 - A placeholder with no value renders as an empty string in the request, unlike in the prompt, where it stays visible.
 
 <Warning>
 On a [public agent](/agents/deploy/public-agents) the browser supplies custom values, so anyone can start a session with any `patient_id`. When a templated value identifies a person, don't let it authorize access to their data on its own: create sessions from your backend (`sessionToken` mode), or let the inbound call webhook supply it on phone calls.
 </Warning>
 
 ## System variables
 
 The platform fills a handful of `{{system.*}}` placeholders itself, on every session. You cannot supply or override them: the names you pass in `dynamic_variables` cannot contain a dot, so the two namespaces never collide.
 
 | Variable | Value | Notes |
 |---|---|---|
@@ -198,12 +199,12 @@
 A reference to a system variable that does not exist (`{{system.foo}}`) is rejected with `422` when you save the configuration or the tool, and when you send it in session overrides. The error lists the available names.
 
 <Note>
 There is no `system.session_id`. The configuration is rendered before the session receives its id, so the id cannot be templated into it. Read it from the `POST /v1/agent/sessions` [response](/agents/deploy/authenticated-sessions), the SDK's `connect` event, or the `session` object in [webhooks](/agents/monitor/webhooks).
 </Note>
 
 ## World context
 
 The agent knows the current date and time without any variable. The platform states the date and the session's timezone at the start of every session and refreshes the time on every turn, so "tomorrow morning" or "next Tuesday" resolve correctly even in a long conversation. You don't need a custom `{{today}}` or `{{now}}`, and there is no `system.now`: variables render once, when the session is created, so a templated time would be stale from the first reply onward. When you want the date or timezone as text in a template, for example in a webhook tool URL, use the [`system.today` and `system.timezone`](#system-variables) system variables.
 
 See [Time & timezone](/agents/build/time-timezone) for how the timezone is resolved and how to turn the injection off for a session (`world_context: false`).
 

agents/build/webhook-tools.mdx

@@ -51,6 +51,30 @@
 }
 ```
 
+### Values in a JSON body
+
+When the body is JSON, what happens to a value depends on where its placeholder sits:
+
+- **Inside a JSON string**, like `"note": "{{note}}"`: the value is JSON-escaped. Quotes, backslashes, and line breaks in it can't break the body.
+- **Outside a string**, like `"count": {{count}}`: the value is inserted as is. Use this to send a number, a boolean, or a whole object.
+
+```json Body template
+{
+  "note": "{{note}}",
+  "count": {{count}}
+}
+```
+
+If the agent passes `She said "call me back"` as `note`, the request body contains `"note": "She said \"call me back\""`.
+
+The same rule covers arguments, dynamic variables, and requests from the **Test** tab.
+
+The body counts as JSON when its content type is `application/json` (the default) or a `+json` type such as `application/vnd.api+json`. A `Content-Type` header on the tool takes priority over the content type setting. Bodies of any other content type are filled in as is.
+
+<Note>
+A placeholder outside a string is not checked. If its value isn't valid JSON in that spot, the body isn't either. Put text values in quotes.
+</Note>
+
 ## Authentication headers
 
 Each header has a kind that identifies what it carries:
@@ -166,7 +190,7 @@
 { "ticket_id": "T-1042", "expected_reply": "within 24 hours" }
 ```
 
 Ticket numbers get spoken aloud: short, pronounceable IDs survive text-to-speech far better than UUIDs.
 
 <Note>
   An in-call ticket depends on the model choosing to escalate. For a safety net

api-reference/openapi.json

@@ -66,6 +66,19 @@
                       "title": "Finished At",
                       "type": "string"
                     },
+                    "anchor_day": {
+                      "anyOf": [
+                        {
+                          "type": "integer"
+                        },
+                        {
+                          "type": "null"
+                        }
+                      ],
+                      "default": null,
+                      "description": "UTC day of month used for credit refreshes; clamp to the month's last day. Missing/null falls back to updated_at's UTC day.",
+                      "title": "Anchor Day"
+                    },
                     "stripe_subscription_id": {
                       "anyOf": [
                         {
@@ -24699,6 +24712,11 @@
             ],
             "default": null,
             "title": "Channel"
+          },
+          "world_context": {
+            "default": false,
+            "title": "World Context",
+            "type": "boolean"
           }
         },
         "required": [