Your agent drives the browser. OpenMasu (external link) keeps what it decides: what it searched, the posts it found, the score and reason of each one, its drafts and what it published. When the organization links its OpenMasu workspace, each session page of the dashboard shows both halves:
- Left: the view-only live view of the browser.
- Right: the agent's base, embedded and live. Admins can edit it, for example to approve a draft. Everyone else can only view it.
On narrow screens the two halves stack.
Link OpenMasu
You need the admin role of the whole organization and an OpenMasu personal token (bpat_…) limited to one workspace. Viewers only need read access; for admins to edit the base, give the token write access.
- In the dashboard, open Browsers › Settings › OpenMasu.
- Keep the server
https://platform.openmasu.com, paste the token and select Link OpenMasu. If the token reaches more than one workspace, also enter the workspace id. - Select Create the agent's base. It creates the base «Social media agent» from OpenMasu's template in that workspace. Its tables are Sessions, Searches, Candidates, Scores, Drafts, Reviews, Posts, Events and Config. The base is created in the language of the dashboard: in Spanish it is «Agente de redes», with Sesiones, Búsquedas, Candidatos and so on. Your agent understands both. To embed a base you already have, enter its id in Base id instead.
OpenWAF checks the token against OpenMasu before saving it. Then the token is stored encrypted. It is never shown again, not even to admins: the settings and the API show only an 8-character fingerprint. Linking, unlinking and creating the base are recorded in the audit log with that fingerprint.
The session page
Open Browsers › Sessions and select Open next to a running session, or its id.
- The live view is the same signed, view-only link as Live view. It expires after 1 hour. Open in a new tab shows it full size.
- Take control (admins only) asks for confirmation, then opens the live view with keyboard and mouse in a new tab, so you can finish a login, a 2FA prompt or a captcha for the agent. The link lasts 10 minutes, is recorded in the audit log and stays on the page as Open control until it expires. See take control.
- The base loads with a link made for you:
editorif you are an admin,viewerotherwise. The link lasts 15 minutes. When it expires, OpenMasu tells the page, and the page loads a new one without reloading.
Security
- The browser never sees the integration token. Our server asks OpenMasu for a short embed link for each person and returns only that link. The embed token travels in the URL fragment, so it does not reach server logs or the
Refererheader. - Only known servers. The dashboard frames only
https://browsers.openwaf.devandhttps://platform.openmasu.com, and our server only talks to the OpenMasu servers it allows. Any other server is refused when you link it. - Sandboxed frames. Both frames are sandboxed and get no referrer. The page only accepts the expiry message from the linked OpenMasu origin and from that frame.
- Unlink deletes the token on our side. The base and the token stay in OpenMasu: revoke the token there to cut access.
API
All routes are under https://dash.openwaf.dev/v1/orgs/{org}. Linking, unlinking and creating the base need admin; reading the link and getting an embed link need any role of the whole organization.
| Route | What it does |
|---|---|
GET /browsers/openmasu | The link: linked, server_url, workspace_id, base_id, and for admins token_fingerprint, updated_by and updated_at. Never the token. |
PUT /browsers/openmasu | Link or change: {"server_url", "token", "workspace_id"?, "base_id"?}. token is required the first time and when the server changes. Without it the stored one is kept. base_id: "" clears the base. |
DELETE /browsers/openmasu | Unlink and delete the token (204) |
POST /browsers/openmasu/base | Create the agent's base from the template (201); body {"lang": "en"} or "es", English by default |
POST /browsers/openmasu/embed | An embed link: {"url", "expires_at", "role", "base_id", "origin"}. Optional body {"view_id", "ttl_s"} (60 to 900 s, default 900). Cache-Control: no-store. |
printf '%s' "$OPENMASU_TOKEN" | jq -Rs '{server_url: "https://platform.openmasu.com", token: .}' |
curl -sS -X PUT "https://dash.openwaf.dev/v1/orgs/$OPENWAF_ORG/browsers/openmasu" \
-H "Authorization: Bearer $OPENWAF_TOKEN" -H "X-Change-Reason: link the agent's base" \
-H "Content-Type: application/json" --data-binary @-| Status | code | When |
|---|---|---|
| 409 | openmasu_not_linked | The organization has not linked OpenMasu |
| 409 | openmasu_no_base | Linked, but without a base yet |
| 409 | openmasu_base_exists | The base was already created |
| 422 | invalid | Server not allowed, token rejected by OpenMasu, or workspace or base out of the token's reach; field names it |
| 502 | openmasu_error | OpenMasu did not answer, or rejected the stored token (revoked or expired): link again with a new one |
| 503 | unavailable | The service cannot store tokens right now |
CLI
The token is read from standard input, never from an argument:
printf '%s' "$OPENMASU_TOKEN" | openwaf-cloud ctl browsers openmasu link \
--server https://platform.openmasu.com --token-stdin --reason "link the agent's base" --yes
openwaf-cloud ctl browsers openmasu create-base --lang en --reason "agent's base" --yes
openwaf-cloud ctl browsers openmasu status
openwaf-cloud ctl browsers openmasu unlink --reason "…" --yesThere are no MCP tools for the link: the token is a secret, like the provider credentials of Egress.