Set up an HTTP API as a tool

An HTTP API tool lets the assistant call a fixed endpoint — the assistant only fills in the allowed parameters, never the URL itself. You set this up in the Administration → Configured tools tab. For context see Configurable tools — overview.

Step by step

1. Set the base URL and endpoint — the fixed address the tool calls.
2. Choose the HTTP method. The method determines the tool’s type: GET/HEAD count as reading, all other methods (POST, PUT, PATCH, DELETE) as writing.
3. Define the parameters the assistant may fill (name, type, required/optional, default).
4. Configure authentication — Bearer token, API key or Basic auth. Credentials are stored encrypted.
5. Set limits (timeout, response size), verify with the test function, then set it active and decide whether the tool is available in chat and/or for agents.

Security guarantees

• SSRF protection with host pinning. Calls are pinned to the configured host — the assistant cannot redirect the endpoint to internal or other arbitrary addresses.
• Encrypted credentials. Bearer/API-key/Basic credentials are stored encrypted.
• Fixed endpoint. The assistant only chooses parameter values, not the target.
• Admin-only.