Custom API

Custom API lets an agent call a REST endpoint that you define. In Configure, provide the endpoint URL. Then choose GET, POST, PUT, or DELETE. You can add headers, a request-body template for non-GET requests, and typed string, number, or boolean parameters. When the request needs information that the agent collects during the conversation, use {{parameter}} placeholders in the URL, headers, and body. The configuration screen includes a browser-side test request for quick feedback.

Treat the endpoint and every header as production credentials. After you save, a header whose name looks like a credential shows its value as [REDACTED] in Configure, the REST API, and MCP. A name looks like a credential when it contains authoriz, token, apikey, api-key, api_key, secret, cookie, or password, in any letter case. Leave [REDACTED] in place to keep the stored value. Type a new value to replace it. At runtime, the platform makes sure that required parameters are present and that the destination is safe. Each request has a bounded timeout. The platform does not follow redirects. The platform limits the returned output. A non-success response is still meaningful evidence for the agent. Investigate it. Do not treat it as a success. The configuration test does not replace a check of the deployed runtime path.

Custom API is a high-risk action. When action approval is enabled, widget chat asks the visitor to confirm before the action runs. Read-only requests can be retry-safe. The platform does not automatically retry mutating requests.

Before you expose Custom API to visitors:

• Use a narrowly scoped endpoint.
• Keep secrets out of prompts.
• Test the action with a sandbox API.