Skip to main content
The embed widget emits events at key points in the agent’s lifecycle, letting you react to user actions, track conversation flow, and handle errors in your application. There are two ways to listen to events: inline callbacks passed to embedWidget(), and the on() method on the widget instance.
Data events carry payload only when the parent origin is allowlisted. By default, events that contain conversation data (generationEnded, userMessageSent, threadChanged, etc.) still fire but their payload is stripped to just the event type. To receive the full payload — including the assistant’s message body for live rendering — you must add your parent page’s origin to the playground’s Allowed Parent Origins list. See Receiving Message Data below.

Quick Start


Event Reference

Thread Events

threadChanged

Fires when the active conversation thread changes — for example, when the user selects a different thread from the thread list, or a new thread is created after the first message is sent.

newThread

Fires when the user clicks “New Chat” to start a fresh conversation. At this point no thread has been created on the backend yet — the thread is created once the first message is sent (which then fires threadChanged).

Message Events

userMessageSent

Fires when the user sends a message to the agent.

generationStarted

Fires when the agent begins generating a response.

generationEnded

Fires when the agent finishes generating a response. The messageId is the persisted backend ID that you can use with the Thesys API to fetch the message content. When your parent origin is allowlisted, message contains the full persisted assistant message so you can render the response live in another panel without an additional API call.
All three arguments are undefined unless the embedding page’s origin is on the playground’s Allowed Parent Origins list. See Receiving Message Data.
AssistantMessage shape

Tool Execution Events

These events fire when the agent uses a tool (web search, image search, artifact builder, etc.) during response generation. Internal tools used by the system are excluded — only user-facing tools trigger these events.

toolExecutionStarted

Fires when the agent starts executing a tool.

toolExecutionEnded

Fires when a tool finishes executing. If the tool failed, the error parameter contains the error message.

Error Events

agentError

Fires when an error occurs during message processing or response streaming.

identityTokenError

Fires when a BYOI identity token is invalid or cannot be refreshed. This is separate from the normal token refresh flow — it indicates a persistent authentication failure.

Inline Callbacks

All events can also be passed as callbacks directly to embedWidget(). Callback names use the on prefix with PascalCase:
Both inline callbacks and on() listeners fire for the same event — you can use either or both.

widget.on(event, callback)

Subscribe to events dynamically after the widget is created. Returns an unsubscribe function.
Multiple listeners can be registered for the same event. Each call to on() returns its own independent unsubscribe function.

Receiving Message Data

For security, the published agent does not broadcast conversation data (assistant messages, thread IDs, user messages, tool names, error details) to arbitrary embedders. Without explicit opt-in, every data event still fires — but with its payload stripped to just the event type:
To receive the full payload — including the assistant message for live rendering — add your parent page’s origin to the playground’s Allowed Parent Origins list:
  1. Open your playground in the Thesys Console.
  2. Click Deploy, expand the Embed on your website section.
  3. Under Allowed parent origins, add each origin that should receive full event payloads (for example, https://app.example.com or http://localhost:3000).
  4. Republish the playground.
Once allowlisted, your origin will receive the full payload for every data event. Origins not on the list will continue to receive stripped events. The handshake events (APP_READY, widget open/close/toggle, identity-token refresh) are unaffected and always work.

What counts as a “data event”?

Origins must be exact matches: scheme://host[:port] with no path or trailing slash. https://app.example.com and https://app.example.com:443 are treated as different origins.

Typical Event Flow

Here’s the sequence of events during a normal conversation turn:
For subsequent messages in the same thread:

Direct Iframe Integration

If you’re embedding the agent via a direct iframe instead of the embed widget npm package, you can listen for the same events using the browser’s postMessage API. Each event is sent as a message with a type field prefixed with THESYS_.
For full details on postMessage usage, origin validation, and URL parameters, see the PostMessage Protocol page.

Event Mapping

Example


Example: Analytics Integration