What is GPT-Actions?
GPT-Actions identifies requests made when a GPT connects to an external HTTP API. A GPT builder supplies an OpenAPI schema describing the available endpoints and parameters, and ChatGPT chooses an operation when a user's request calls for it. This is an API integration, not a crawler building a web index.
The request can read current information or ask the external service to perform an operation. Its method, path, and parameters come from the action schema. OpenAI supports unauthenticated actions, API keys, and per-user OAuth, so two GPT-Actions requests may have very different permissions even when they carry the same user-agent token.
Data returned by the endpoint can be used in the user's current ChatGPT interaction. That creates a direct, query-time path from an API to an answer or completed task, but it does not make the endpoint generally discoverable in AI search. A request normally reflects a configured GPT and an active user instruction rather than automated exploration of adjacent URLs.
The entry is explicitly categorized as AI with no training. GPT-Actions traffic is therefore separate from GPTBot, which OpenAI documents for web content that may help train its models. Seeing this token in a log is not evidence that the response entered a training dataset.
GPT-Actions is the stable token recorded for robots.txt, and Cloudflare's bot directory says it respects those rules. The token remains self-reported and can be copied by another client. API authentication, authorization, request validation, and an audit trail provide stronger evidence than the User-Agent header.
OpenAI's production notes for GPT Actions also shape request behavior. They document a 45-second timeout, text-only request and response payloads below 100,000 characters, and no support for arbitrary custom headers. Endpoint owners should design for those limits rather than treating the caller like a full browser.
