The direct message template feature (action="create_pm") used not to work on our instance. It displayed a private message composer, but once one would hit “send”, it turned the message into a—usually public—topic!
I’ve added a quickfix in a fork by copying some fragments from discourse/discourse:
I think what did the trick was adding the archetypeId: "private_message". I would, however, think that the bug actually is that it’s possible to open a composer that lures users into thinking they are composing a private message and then making it public without warning.