Webhook / HTTP

Let the agent call your own API endpoints during a call — check an order status, create a ticket, look up a customer record. You control exactly which hosts it can reach, and you can attach secret headers the agent never sees.

Setup

Integrations → Add integration → Webhook.
Set Allowed hosts — comma-separated exact hostnames, e.g. api.yourdomain.com, status.yourdomain.com. The agent can only call these, over HTTPS.
Optionally add Secret headers, one Header: value per line, e.g.
```
Authorization: Bearer sk-…
X-Api-Key: …
```
They’re attached to every request, stored encrypted, and never visible to the agent — your API gets authenticated requests without the model ever holding a credential.
Click Add & discover tools.

Tools

…_http_request — make an HTTPS request to one of the allowed hosts and read the response.

Tips

Build small, purpose-made endpoints for the agent (e.g. GET /agent/order-status?phone=…) rather than exposing your full API — shorter responses make for faster, more reliable calls.
Describe each endpoint in the agent’s instructions: the URL, the parameters, and when to use it.
Your secret headers override anything the model puts in the request, so a confused agent can’t overwrite your auth.