> For the complete documentation index, see [llms.txt](https://docs.verygoodsecurity.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.verygoodsecurity.com/cmp/platform/vgs-for-merchants-implementation-guide.md).

# VGS for Merchants - Implementation Guide

## Merchant implementation overview

Use this guide to collect, store, enrich, authenticate, and transact with payment data through VGS.

VGS keeps raw card data out of your systems. You work with aliases, card objects, and network tokens instead.

### Introduction

#### What is CMP?

The VGS [Credential Management Platform (CMP)](/cmp/platform/overview.md) manages payment credentials across their lifecycle.

CMP creates a Card Object, or `card_id`, for each card. That object becomes the reference point for Network Tokens, Account Updater, and 3D Secure.

***

### High-level solution architecture

<div data-with-frame="true"><figure><img src="/files/bTQtgO8l10rusA7NhPCp" alt=""><figcaption></figcaption></figure></div>

{% hint style="info" %}
This diagram shows a typical merchant flow with VGS. You collect, store, enrich, authenticate, and route payment data without directly handling raw PAN.
{% endhint %}

***

### Authentication

#### Create a Service Account

The VGS API uses the OAuth 2.0 client credentials flow.

Create a service account and assign the scopes required for cards, accounts, network tokens, and merchants.

For setup details, see [Authentication](/cmp/platform/authentication.md).

This generates your `client_id` and `client_secret`.

{% hint style="warning" %}
Copy the credentials immediately. The `client_secret` is shown only once.
{% endhint %}

#### Generate Access Token

To generate the API Access Token flow, see [Generate Access Token](https://docs.verygoodsecurity.com/cmp/platform/authentication#id-2-generate-access-token).

***

### Collect data

<figure><img src="/files/luxF6r4LYDdY3hqu6anJ" alt=""><figcaption></figcaption></figure>

#### Browser Card capture with VGS Collect

[VGS Collect ](https://docs.verygoodsecurity.com/vault/developer-tools/vgs-collect/index#why-vgs-collect)captures card data in the browser and sends it directly to CMP.

Your backend never receives raw PAN or CVC. It only receives `card_id`, `pan_alias`, and `cvc_alias`.

**Prerequisites**

* Allow these domains in your CSP:
  * `js.verygoodvault.com`
  * `vgs-collect-keeper.apps.verygood.systems`
  * `sandbox.vgsapi.com`
* Create a service account with the `cards-write` scope.
* Generate an access token.
* Initialize VGS Collect for your environment.
* Configure secure fields for PAN, expiration date, and CVC.

{% hint style="info" %}

#### Card creation flow

```
VGS Collect.js
     ↓
Secure fields capture PAN / CVC / expiry
     ↓
form.createCard() sends data directly to CMP
     ↓
CMP returns: card_id + pan_alias + cvc_alias
     ↓
Your backend stores card_id and aliases only
```

{% endhint %}

**Alias behavior**

* `pan_alias` is persistent.
* `cvc_alias` is volatile.
* Both aliases use standard VGS tokenization.
* CMP returns the same `pan_alias` for the same card.

***

#### Receive Card Securely via HTTPS Proxy

If partners send raw card data to you, use a VGS inbound route with a [custom hostname](https://docs.verygoodsecurity.com/vault/http-proxy/inbound-connection/custom-hostnames).

This keeps raw PAN out of your environment.

**How it works**

Partners send card data to a VGS-managed endpoint on your domain, such as `vault.acme.com`.

VGS tokenizes PAN and CVC in transit. Your backend receives aliases only.

{% hint style="info" %}

#### Convert aliases into a CMP card

After your backend receives `pan_alias`, create the card object in CMP:

```json
POST /cards
{
  "pan": "<pan_alias>",
  "expiration_month": "12",
  "expiration_year": "2027"
}
```

CMP returns `card_id` and `pan_alias`.

From there, you can use Network Tokens, Account Updater, and 3DS.
{% endhint %}

***

### Store and enroll cards in CMP

Once you have a `card_id`, you can provision a network token and request cryptograms for payment flows.

<figure><img src="/files/xkk1v3Z176vXpQvFhokL" alt=""><figcaption></figcaption></figure>

#### Network token provisioning

```http
POST /cards/{card_id}/network-tokens
```

* The card network provisions the token.
* CMP sends a webhook when the token becomes active.
* You can retrieve the token from `GET /cards/{card_id}` in `nt_pan`.

#### Cryptogram generation for CIT

```http
POST /cards/{card_id}/cryptogram
```

* The response includes a single-use cryptogram, network token, and ECI.
* Use that payload to build the `tokenizedCard` request to your PSP.
* Generate a new cryptogram for each transaction.

#### Recurring and MIT transactions

Merchant-initiated transactions do not require a cryptogram.

```http
GET /cards/{card_id}
```

Use the returned `nt_pan` in your PSP request when the token is available.

***

### CMP card management

#### Create card

<mark style="color:blue;">**`POST /cards`**</mark>

Create a new card object in CMP.

Each card receives a persistent `card_id`. CMP uses that object to manage services such as Network Tokens and Account Updater.

For test values, see [Create Card Testing Guide](https://docs.verygoodsecurity.com/cmp/developer-resources/guides/testing/create-card).

API reference: [POST /cards](https://docs.verygoodsecurity.com/cmp/developer-resources/api/card-management#post-cards)

#### Get card

<mark style="color:blue;">**`GET /cards/{card_id}`**</mark>

Retrieve card details by `card_id`.

Use this response to inspect card state, token status, and updater status.

API reference: [GET /cards/{card\_id}](https://docs.verygoodsecurity.com/cmp/developer-resources/api/card-management#get-cards-card_id)

#### Core card testing scenarios

<table data-header-hidden><thead><tr><th width="76.546875"></th><th width="152.0859375"></th><th width="136.15234375"></th><th></th><th></th></tr></thead><tbody><tr><td>#</td><td><strong>API Endpoint</strong></td><td><strong>Test Scenario</strong></td><td><strong>Steps to Verify</strong></td><td><strong>Expected Outcome</strong></td></tr><tr><td>1.1</td><td>POST /cards</td><td>Successful Creation &#x26; Enrollment (Happy Path)</td><td>Use mock card <mark style="color:$success;"><code>5100260000019206</code></mark></td><td><code>201</code> Created. Card object created. AU and NT enrollment successful.</td></tr><tr><td>1.2</td><td>POST /cards</td><td>Creation Success, Enrollment Failure</td><td>Use mock card <mark style="color:$success;background-color:$success;"><code>5100260000009207</code></mark></td><td><code>201</code> Created. Card object created. AU and NT enrollment failed.</td></tr><tr><td>1.3</td><td>POST /cards</td><td>Required Field Validation</td><td>Send a request with a missing required field or invalid value (e.g., month 13).</td><td><code>422</code> Unprocessable Entity.</td></tr><tr><td>1.4</td><td>POST /cards</td><td>Internal Service Error (5xx)</td><td>Use mock card <mark style="color:$success;"><code>5100260000019214</code></mark></td><td><code>500</code> Internal Server Error. Integration handles unexpected server-side errors.</td></tr><tr><td>1.5</td><td>GET /cards/{card_id}</td><td>Successful Retrieval (Active Card)</td><td>Use the card_id from test 1.1.</td><td><code>200</code> OK. Full card object returned, including tokenized ID and metadata.</td></tr><tr><td>1.6</td><td>GET /cards/{card_id}</td><td>Card Not Found</td><td>Use a non-existent or improperly formatted <code>card_id</code>.</td><td><code>404</code> Not Found. Integration handles attempts to access a missing resource.</td></tr></tbody></table>

***

### Network Tokens

#### Provision network token

<mark style="color:blue;">**`POST /cards/{card_id}/network-tokens`**</mark>

Provision a network token for a card.

In sandbox, provisioning starts automatically when you create a card. If a token already exists, CMP skips duplicate provisioning.

API reference: [POST /cards/{card\_id}/network-tokens](https://docs.verygoodsecurity.com/cmp/developer-resources/api/card-management#post-cards-card_id-network-tokens)

#### Request cryptogram

<mark style="color:blue;">**`POST /cards/{card_id}/cryptogram`**</mark>

Generate a cryptogram for a tokenized card.

Use this endpoint for real-time purchase flows. Include the required amount, currency, transaction type, and cryptogram type.

API reference: [POST /cards/{card\_id}/cryptogram](https://docs.verygoodsecurity.com/cmp/developer-resources/api/card-management#post-cards-card_id-cryptogram)

#### Delete network token

<mark style="color:blue;">**`DELETE /cards/{card_id}/network-tokens`**</mark>

Delete the network token associated with a card.

Once deleted:

* The token is no longer usable for payments.
* CMP stops tracking lifecycle updates.
* Cryptogram generation and token-based flows stop working.

API reference: [DELETE /cards/{card\_id}/network-tokens](https://docs.verygoodsecurity.com/cmp/developer-resources/api/card-management#delete-cards-card_id-network-tokens)

***

### Account Updater

#### Subscribe

<mark style="color:blue;">**`POST /cards/{card_id}/card-update-subscriptions`**</mark>

Subscribe a card to [Account Updater](/cmp/products-and-services/account-updater.md).

In sandbox, this happens automatically when you create a card. Duplicate subscriptions are ignored.

API reference: [POST /cards/{card\_id}/card-update-subscriptions](https://docs.verygoodsecurity.com/cmp/developer-resources/api/card-management#post-cards-card_id-card-update-subscriptions)

#### Unsubscribe

<mark style="color:blue;">**`DELETE /cards/{card_id}/card-update-subscriptions`**</mark>

Remove the card from Account Updater tracking.

After unsubscription:

* CMP no longer receives updates for the card.
* The card’s AU object is removed.
* The card is treated as unenrolled.

API reference: [DELETE /cards/{card\_id}/card-update-subscriptions](https://docs.verygoodsecurity.com/cmp/developer-resources/api/card-management#delete-cards-card_id-card-update-subscriptions)

***

### Webhook integration testing

These tests ensure your system correctly receives, verifies, and processes asynchronous update notifications from VGS.

{% hint style="info" %}
For additional test values, see [On-Demand Updates Testing](https://docs.verygoodsecurity.com/cmp/developer-resources/guides/testing/on-demand-updates#test-cards-and-expected-responses). Also see the dedicated webhook guides for [Account Updater](https://docs.verygoodsecurity.com/cmp/developer-resources/guides/testing/account-updater-webhooks) and [Network Tokens](https://docs.verygoodsecurity.com/cmp/developer-resources/guides/testing/network-tokens-webhooks).
{% endhint %}

#### Account Updater webhooks

<table data-header-hidden><thead><tr><th width="76.4140625"></th><th width="173.3125"></th><th width="132.75390625"></th><th width="184.3203125"></th><th></th></tr></thead><tbody><tr><td>#</td><td>Event Type</td><td>Test Scenario</td><td>Steps to Verify</td><td>Expected Outcome</td></tr><tr><td>3.1</td><td><mark style="color:blue;"><strong><code>cmp_card.updated</code></strong></mark></td><td>Card Updated</td><td><p>1. Create a card with mock <mark style="color:$success;"><code>4327390068355738</code></mark> or <mark style="color:$success;"><code>5522351100054522</code></mark></p><p>2. Check your webhook server logs.</p></td><td>Your server receives a webhook and updates the card details (PAN/Expiry) in your database.</td></tr><tr><td>3.2</td><td><mark style="color:blue;"><strong><code>cmp_card.enrolled</code></strong></mark></td><td>Card Enrolled</td><td><p>1. Create a card with mock <mark style="color:$success;"><code>2222690420064582</code></mark></p><p>2. Check your webhook server logs.</p></td><td>Your server receives a webhook and updates the card details (PAN/Expiry) in your database.</td></tr><tr><td>3.3</td><td><mark style="color:blue;"><strong><code>cmp_card.expired</code></strong></mark></td><td>Card Expired</td><td><p>1. Create a card with mock <mark style="color:$success;"><code>2223520127577835</code></mark> or <mark style="color:$success;"><code>5522351100074512</code></mark></p><p>2. Check your webhook server logs.</p></td><td>Your server receives a webhook and updates the card details (PAN/Expiry) in your database.</td></tr><tr><td>3.4</td><td><mark style="color:blue;"><strong><code>cmp_card.updated</code></strong></mark></td><td>Card Closed (updated event)</td><td><p>1. Create a card with mock <mark style="color:$success;"><code>4403933787254356</code></mark></p><p>2. Check your webhook server logs.</p></td><td>Your server receives a webhook and marks the card as inactive/closed in your system.</td></tr><tr><td>3.5</td><td><mark style="color:blue;"><strong><code>cmp_card.closed</code></strong></mark></td><td>Card Closed</td><td><p>1. Create a card with mock <mark style="color:$success;"><code>5120350100064594</code></mark></p><p>2. Check your webhook server logs.</p></td><td>Your server receives a webhook and marks the card as inactive/closed in your system.</td></tr></tbody></table>

#### Network Token webhooks

<table data-header-hidden><thead><tr><th width="74.76953125"></th><th width="174.2734375"></th><th width="132.96875"></th><th width="185.09375"></th><th></th></tr></thead><tbody><tr><td>#</td><td><strong>Event Type</strong></td><td><strong>Test Scenario</strong></td><td><strong>Steps to Verify</strong></td><td><strong>Expected Outcome</strong></td></tr><tr><td>3.6</td><td><mark style="color:blue;"><strong><code>cmp_network_token.updated</code></strong></mark></td><td>Token Provisioned</td><td><p>1. Create a card with mock <mark style="color:$success;"><code>2222690420064582</code></mark></p><p>2. Check your webhook server logs.</p></td><td>Your server receives a webhook (state ACTIVE) and updates your system to reflect an active Network Token.</td></tr><tr><td>3.7</td><td><mark style="color:blue;"><strong><code>cmp_network_token.updated</code></strong></mark></td><td>Token Provisioned</td><td><p>1. Create a card with mock <mark style="color:$success;"><code>5120350100064594</code></mark></p><p>2. Check your webhook server logs.</p></td><td>Your server receives a webhook (state ACTIVE) and updates your system to reflect an active Network Token.</td></tr><tr><td>3.8</td><td><mark style="color:blue;"><strong><code>cmp_network_token.updated</code></strong></mark></td><td>Token Failed</td><td><p>1. Create a card with mock <mark style="color:$success;"><code>2222690420064582</code></mark></p><p>2. Check your webhook server logs.</p></td><td>Your server receives a webhook (state FAILED) and updates your system to reflect a failed Network Token.</td></tr><tr><td>3.9</td><td><mark style="color:blue;"><strong><code>cmp_network_token.updated</code></strong></mark></td><td>Token Suspended/Deleted</td><td><p>1. Create a card with mock <mark style="color:$success;"><code>5100260000009223</code></mark></p><p>2. Check your webhook server logs.</p></td><td>Your server receives a webhook (state DELETED) and marks the token as inactive in your system.</td></tr></tbody></table>

#### Webhook acknowledgment

<table data-header-hidden><thead><tr><th width="74.78515625"></th><th></th><th></th><th></th></tr></thead><tbody><tr><td>#</td><td>Event Type</td><td>Steps to Verify</td><td>Expected Outcome</td></tr><tr><td>3.10</td><td>Any webhook payload</td><td>Receive any webhook payload from VGS.</td><td>Your server immediately responds with a <code>200</code> OK HTTP status code to prevent VGS from retrying the notification.</td></tr></tbody></table>

{% hint style="warning" %}
Always respond with a 200 OK immediately upon receiving a webhook. VGS will retry delivery if it does not receive a timely acknowledgment.
{% endhint %}

***

### Card validation and authentication

<figure><img src="/files/alec3MQ6UvdhYMYurF6p" alt=""><figcaption></figcaption></figure>

### 3D Secure

Use CMP to run 3DS data-only checks or full step-up authentication with issuers.

#### 3DS initialization

<mark style="color:blue;">**`POST /cards/{card_id}/3ds/initialize`**</mark>

1. Call the [3DS initialize endpoint](https://docs.verygoodsecurity.com/cmp/developer-resources/api/3d-secure-3ds#post-cards-card_id-3ds-initialize), which may return an iframe for device fingerprinting. If no iframe is returned, initialization is not required, and authentication can proceed immediately.
2. Render the iframe on the front end as soon as it is received from VGS. It can also be loaded as an invisible or background frame while the cardholder waits, so the client does not pause for processing.
3. Once you submit the form in the iframe, the device-fingerprinting process begins.
4. Start a 10-second timer after receiving the iframe from VGS, and wait until you receive either the asynchronous device fingerprinting response from VGS or the timer expires (whichever happens first) before sending the authentication request to VGS.

{% hint style="info" %}
The iframe can be rendered in the background so the cardholder experience is not interrupted.
{% endhint %}

#### 3DS authentication

<mark style="color:blue;">**`POST /cards/{card_id}/3ds/authenticate`**</mark>

Call the [3DS authenticate endpoint](https://docs.verygoodsecurity.com/cmp/developer-resources/api/3d-secure-3ds#post-cards-card_id-3ds-authenticate) at purchase time.

Send the required `type` parameter to choose the 3DS flow:

* [Data-only](https://docs.verygoodsecurity.com/cmp/products-and-services/3ds/3ds-frictionless-flow) - Frictionless flow; the result is returned synchronously.
* [Challenge](https://docs.verygoodsecurity.com/cmp/products-and-services/3ds/3ds-challenge-flow) - A user challenge is triggered, and the final result is delivered via the configured webhook notification.

API reference: [3D Secure API](https://docs.verygoodsecurity.com/cmp/developer-resources/api/3d-secure-3ds)

***

### Payments with Network Token

#### Provision network token

<mark style="color:blue;">**`POST /cards/{card_id}/network-tokens`**</mark>

Provision a network token for a card.

In sandbox, provisioning starts automatically when you create a card. If a token already exists, CMP skips duplicate provisioning.

API reference: [POST /cards/{card\_id}/network-tokens](https://docs.verygoodsecurity.com/cmp/developer-resources/api/card-management#post-cards-card_id-network-tokens)

#### Request cryptogram

<mark style="color:blue;">**`POST /cards/{card_id}/cryptogram`**</mark>

Generate a cryptogram for a tokenized card.

Use this endpoint for real-time purchase flows. Include the required amount, currency, transaction type, and cryptogram type.

API reference: [POST /cards/{card\_id}/cryptogram](https://docs.verygoodsecurity.com/cmp/developer-resources/api/card-management#post-cards-card_id-cryptogram)

### Payments with PAN Alias (via HTTPS Proxies)

If a network token is unavailable, send `pan_alias` and `cvc_alias` through a VGS [outbound route ](https://docs.verygoodsecurity.com/vault/http-proxy/outbound-connection)to your PSP.

**When to use fallback**

* `nt_status` is `NT_SUSPENDED`, `NT_DELETED`, or not active.
* The cryptogram request fails or times out.
* The card network does not support network tokens for that BIN.

**Fallback flow**

```
Merchant backend
     ↓
Build a payment request with pan_alias + cvc_alias
     ↓
POST to PSP through the VGS outbound route
     ↓
VGS reveals pan_alias → raw PAN
VGS reveals cvc_alias → raw CVC
     ↓
PSP receives raw PAN + CVC
```

> Fallback logic belongs in your application layer. Keep the outbound route focused on secure reveal and forwarding.

**Outbound route configuration**

* Set your PSP as the route upstream.
* Add a reveal filter for `pan_alias`.
* Add a reveal filter for `cvc_alias`.
* Load the outbound route YAML in the VGS Dashboard.

***

### Production go-live checklist

Before going live, complete each section below to ensure your production environment is fully configured and validated.

#### Production service account

Generate a new service account in your production organization for CMP.

**Validate access to the live API**

* [ ] Check the list of [VGS Live IPs](https://docs.verygoodsecurity.com/enterprise-platform/developer-resources/vgs-ip-addresses)
* [ ] Connect your system to the Live API at [https://vgsapi.com](https://docs.verygoodsecurity.com/cmp/developer-resources/api)

**Access scopes**

* [ ] Assign all necessary [OAuth 2.0 scopes](https://docs.verygoodsecurity.com/cmp/platform/authentication#id-1-generate-service-account) — cards, accounts, network tokens, and merchants.

**Authentication validation**

* [ ] Confirm your backend can successfully generate a production access token.

***

#### Environment configuration for webhooks

Ensure your webhook notifications are configured in the VGS Dashboard with the correct endpoint URL. Configure distinct production webhook endpoints separate from your sandbox.

For setup instructions, see [Webhook Notifications](https://docs.verygoodsecurity.com/enterprise-platform/developer-resources/webhook-notifications).

**Account Updater webhook events**

Subscribe to all [Account Updater webhook events](https://docs.verygoodsecurity.com/cmp/developer-resources/notifications#cmp-account-updater-events):

<table><thead><tr><th width="345.28125">Event</th><th></th><th>When It Occurs</th></tr></thead><tbody><tr><td><code>cmp_au_card.enrolled</code></td><td>Card successfully enrolled in Account Updater</td><td>After a card is enrolled for automatic updates through the AU service.</td></tr><tr><td><code>cmp_au_card.updated</code></td><td>Account number change message</td><td>New account creation, lost/stolen card, card upgrades/downgrades, or portfolio changes.</td></tr><tr><td><code>cmp_au_card.expired</code></td><td>Expiration date change event</td><td>Card expires but retains the same PAN and a new expiration date is issued.</td></tr><tr><td><code>cmp_au_card.closed</code></td><td>Closed account advice</td><td>Issuer reports closure of the cardholder's account.</td></tr><tr><td><code>cmp_au_card.non_participating</code></td><td>Non-participating BIN event</td><td>Cards linked to these BINs will not receive updates through Account Updater.</td></tr><tr><td><code>cmp_au_card.contact_cardholder_advice</code></td><td>Contact cardholder advice</td><td>Issuer indicates something has changed and the merchant should have the customer re-enter the credential.</td></tr><tr><td><code>cmp_au_card.unknown</code></td><td>Account not found from a participating BIN</td><td>Card is eligible for automatic updates, but no match was found.</td></tr><tr><td><code>cmp_au_card.enrollment.failed</code></td><td>AU enrollment failed</td><td>Card fails to enroll in AU (e.g., merchant-not-found errors).</td></tr></tbody></table>

**Network Token webhook events**

Subscribe to all [Network Token events](https://docs.verygoodsecurity.com/cmp/api-dev/network-token-events#network-tokens-webhooks):

<table><thead><tr><th width="278.31640625">Event</th><th>Description</th><th>When It Occurs</th></tr></thead><tbody><tr><td><code>cmp_network_token.updated</code></td><td>Network status changing — generic update event</td><td>Card networks push lifecycle updates.</td></tr><tr><td><code>cmp_network_token.suspended</code></td><td>Network token suspended by the network</td><td>Card network suspends the token (e.g., fraud, issuer action).</td></tr><tr><td><code>cmp_network_token.activated</code></td><td>Network token activated</td><td>Previously suspended token is reactivated.</td></tr><tr><td><code>cmp_network_token.deleted</code></td><td>Network token deleted</td><td>Token deleted by customer request or network action.</td></tr></tbody></table>

**General webhook requirements**

* [ ] Webhook Acknowledgment: Ensure your server responds with a 200 OK to prevent retries. See the [webhook management guide](https://docs.verygoodsecurity.com/enterprise-platform/developer-resources/webhook-notifications#manage-webhooks).
* [ ] Service Activation: Verify CMP, Network Tokens, and Account Updater are enabled for your production vault.

***

#### Core testing scenarios for live validation

* [ ] Card Creation: Call [POST /cards](https://docs.verygoodsecurity.com/cmp/developer-resources/api/cards#post-cards) to register a new card and confirm the card\_id and pan\_alias.
* [ ] Card Retrieval: Use [GET /cards/{card\_id}](https://docs.verygoodsecurity.com/cmp/developer-resources/api/cards#get-cards-card_id) to verify the full card object and metadata.
* [ ] Network Token Provisioning: Verify that eligible cards successfully initiate enrollment. Validate by listening to the webhook or using Get Cards.
* [ ] Cryptogram Fetching: Confirm POST /cards/{card\_id}/cryptogram returns a valid cryptogram.

***


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.verygoodsecurity.com/cmp/platform/vgs-for-merchants-implementation-guide.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.