Trusted Gateway

Call an allowlisted HTTPS API.

The agent chooses a saved route ID and supplies data. It never supplies the destination URL or receives the API credential.

Dashboard fields

Field	Meaning
Business API base URL	Public HTTPS origin only, for example https://api.company.com.
Route ID	Stable name the tool sends, for example customer.
HTTP method	The fixed GET, POST, PUT, PATCH or DELETE method.
Allowed path	A fixed template such as /customers/{customer_id}.
Credential	Bearer token or API key, encrypted after save and never returned.

Create the secured tool

from uuid import uuid4

def customer_read(customer_id: str) -> dict:
    """Read one customer through the trusted company API."""
    result = security.execute(
        agent_id="support-agent",
        session_id="support-session",
        action="customer.read",
        arguments={
            "route": "customer",
            "path_params": {"customer_id": customer_id},
            "query": {"include": "status"},
        },
        idempotency_key=f"customer-read-{uuid4()}",
    )
    return result["output"]

POST, PUT and PATCH bodies

Pass JSON with "body": {...}. The HTTP method and path always come from the connector. Caller-supplied destination URLs are not accepted.

Expected response

{"executed": true, "decision": {"decision": "ALLOW"}, "output": {"status": "active"}}

Safety rules

Use a narrowly scoped API credential and never configure a generic proxy route. The business API must still authenticate, authorize and validate every request.