Placeholders & values

Any step text, URL, request body or lookup can contain {name} placeholders. When the call reaches the step, each one is replaced with a value for this call — a name your API request sent, the caller's number, the key they pressed two steps ago, a value your server returned.

Hi {name}, your appointment with {doctor} is on {date} at {time}.
https://example.com/hooks/lookup?caller={callerid}&zip={step_2}

Syntax. A name starts with a letter, digit or _, and continues with letters, digits, _ or -: {name}, {appointment_id}, {2fa-code}. Names are case-sensitive. In the editor, type { in a URL or lookup field to pick from the values available there.

Where values come from

Source	Placeholder	Where it is set
Call params	{any_key}	The params object of an API call request. Outbound API calls (and Test call) only.
Variables	{name}	The flow's Variables card: a name and a value, saved with the flow. A Secret variable's value is hidden after saving.
Call values	{callerid} {calleridname} {dnid} {uniqueid}	Set by the phone system: the caller's number and name, the number dialled, and a unique id for the call.
Earlier answers	{step_id}	The keys the caller pressed on an earlier step (an Amount as 22.50), named by that step's internal id ({step_2}). Pick the step by name after typing {.
Saved values	{payment_ref}	A reply field saved by an earlier step's Save a value to Call History. The name is the Save as name in lower case with spaces and punctuation turned into _ — "Payment ref" becomes {payment_ref}; the editor shows it ("Later steps: {payment_ref}").
URL reply params	{any_key}	"params": {…} in the reply of this step's URL. Spoken text of this step only.
The answer being confirmed	{digits} {from} {to}	In a Confirmation message and Re-ask messages only: the answer just entered, and a range's bounds.

Which values each place can use

Not every value can be used everywhere. This is the most common surprise:

Placeholder source	Spoken text	Step URL	Request body	Smartsheet Look up	Profile auth
Call params	✅	✅	✅	✅	—
Variables	✅	✅	✅	✅	✅
Secret variables	—	—	✅	—	✅
Call values ({callerid} …)	—	✅	✅	✅	—
Earlier answers ({step_id})	—	✅	✅	✅	—
Sensitive answers	—	—	✅	—	—
Saved values	✅	✅	✅	✅	—
URL reply params	✅ (this step)	—	—	—	—

"Spoken text" is the step's text-to-speech text, or the text its URL returned. The Confirmation message and Re-ask messages are different: they fill only {digits}, {from} and {to}.

:::note The caller's own keypresses are not spoken back through {step_id} To read an answer back, use Read the answer back on the step that collects it ({digits}), or have your step URL return it as text or params. :::

When two sources have the same name

In spoken text, later sources win: variable → call param → saved value → this step's URL reply params. So a params key in the API request overrides a variable of the same name for that call, and your URL can override both for one step.

In a URL, body or lookup, the order is: a call value, earlier answer or saved value → call param → variable. Name your keys so they do not collide; the editor already refuses a variable named like a step or a call value (callerid, calleridname, dnid, uniqueid, digits, from, to).

When a placeholder has no value

Where	What happens
Spoken text	Left as written; the caller hears the word inside the braces.
Step URL	Left as written — your server receives the literal {name}.
Request body	Replaced with an empty string.
Smartsheet Look up	Treated as "no row found" → the step's Default routing.

A call param stops having a value once the request's ttlSec has passed — see Calling into a Flow. On inbound calls there are no call params at all, so a flow that relies on them should not be reachable from a phone number.

Encoding: values are inserted as-is

:::warning Values in a step URL are not URL-encoded A value is pasted into the URL exactly as it is. A space, &, =, #, ? or / in a value breaks the URL or changes which parameters your server receives — ?name={name} with name = Smith&Co arrives as name=Smith plus a stray Co parameter.

• In URLs, use only URL-safe values (letters, digits, -, _, .), or percent-encode values before you send them in params.

• Better: send identifiers in the URL and everything else in a POST Body. :::

• Form body — each key={placeholder} line is URL-encoded for you.

• JSON body — values are JSON-escaped, so put every placeholder inside quotes: {"id": "{appointment_id}", "answer": "{step_2}"}. The editor refuses to save a JSON body that is not valid JSON, including one with a placeholder outside quotes.

• Spoken text — no encoding; see below.

Call values, earlier answers and saved values you reference in a URL are also added to the end of the query string under their own name, URL-encoded ({callerid} in the URL also appends &callerid=…). Your server can read either; ignore the extra parameter if you do not need it.

Values are spoken as written

Text-to-speech reads a value the way it reads any text:

You send	The caller hears
"4719"	a number: "four thousand seven hundred nineteen"
"4 7 1 9"	one digit at a time
"Tuesday, November 4"	a date, as written

Format dates, times, amounts and codes in your system before sending them. Markup (SSML) is not interpreted.

Call values on API calls

On a call placed with the API, {callerid}, {dnid} and the other call values describe the phone system's outbound leg, not the person you called — do not rely on them. Send the numbers and ids you need in params.

Variables

The Variables card ("Reuse a value in any step as {name}") holds per-flow values: a base URL, an account number, a support phone number. Add variable, then a Name and Value.

• Names follow the placeholder syntax and must be unique, not a step id and not a call-value name.
• A Secret variable is for credentials. Its value is stored encrypted, never shown again in the editor, never spoken, never put in a URL or a lookup, and not copied when the flow is copied or used as an example. It can be used only in a request Body or in a Request Profile's authentication values — e.g. a Bearer token of {api_token}. A Body that uses a secret is sent only over https to the step's own host.