zoxaAI
Homepage

HTTP API Tool

Configure tools that make HTTP requests to external APIs during voice calls, allowing your agent to fetch data, submit forms, and trigger actions in real time.

What you'll learn

  • How to configure an HTTP API tool with method, URL, parameters, and authentication
  • How the LLM extracts parameter values from the conversation
  • How parameters are sent (body vs query string) based on HTTP method
  • How to set up authentication using credentials

The HTTP API tool lets your agent call any external REST API during a conversation. When the LLM decides to use the tool, the platform sends an HTTP request with the parameters the LLM extracted from the conversation and returns the response to the LLM so it can continue talking.


How It Works

Caller: "Can you book me an appointment for Tuesday at 3pm?"
    |
    v
LLM recognizes "Book Appointment" tool matches this intent
    |
    v
LLM extracts: date = "Tuesday", time = "3:00 PM"
    |
    v
Platform sends: POST https://api.example.com/appointments
                Body: {"date": "Tuesday", "time": "3:00 PM"}
    |
    v
API responds: {"status": "confirmed", "id": "APT-1234"}
    |
    v
LLM says: "Your appointment is confirmed for Tuesday at 3pm.
           Your confirmation number is APT-1234."

The LLM never sees your tool's internal configuration (URL, headers, credentials). It only sees the tool name, description, and parameter definitions.


Configuration Reference

The HTTP API tool editor is organized into three tabs: Settings, Authentication, and Parameters.

Settings Tab

FieldTypeConstraintsDefaultDescription
namestringMax 255 chars--A descriptive name the LLM sees when deciding which tool to call. Use action-oriented names like "Book Appointment" or "Get Weather".
descriptionstring----Explains to the LLM what this tool does and when to use it. This is the primary signal for tool selection.
methodstringGET, POST, PUT, PATCH, DELETE--The HTTP method to use for the request.
urlstringMust be a valid URL--The full URL of the API endpoint (e.g., https://api.example.com/appointments).
timeout_msinteger1000 -- 30000 ms5000Maximum time to wait for the API to respond. If exceeded, the tool call fails and the LLM is informed.

Custom Message (Hold Message)

The custom messages are spoken (or played as audio) before the tool executes. Use them for hold messages like "Let me check that for you, one moment."

FieldTypeDefaultDescription
customMessagesstring[][]Text variants the agent speaks before executing the tool — ONE per invocation, picked per customMessagesOrder. Max 5 entries; blanks are dropped.
customMessagesOrder"random" / "in-order""random"How the spoken variant is picked: Random = any variant each time; In order = top to bottom within a call, then repeats.
customMessageType"none", "text" or "audio""none"none = the tool runs silently. text speaks one of the customMessages variants (requires at least one); audio plays a pre-recorded file (requires a recording).
customMessageRecordingIdstring or nullnullRecording ID; required when customMessageType is "audio".

Custom messages are optional. If none are set, the tool executes silently in the background while the LLM continues processing. For API calls that take more than 1-2 seconds, a hold message improves the caller's experience — and multiple variants keep back-to-back calls from sounding identical.


Authentication Tab

Authentication is handled through Credentials -- reusable, encrypted authentication configurations stored separately from the tool. Select an existing credential or create a new one directly from the tool editor.

FieldTypeDescription
credential_uuidstring or nullReference to a stored credential. Leave empty for endpoints that require no authentication.

Credential Types

When creating a credential, you choose one of these types:

TypeValueWhat It SendsExample
Bearer Tokenbearer_tokenAuthorization: Bearer <token> headerOAuth access tokens, JWT tokens
API Keyapi_keyA custom header with your API keyX-API-Key: sk-abc123
Basic Authbasic_authAuthorization: Basic <base64(username:password)> headerUsername/password authentication
Custom Headercustom_headerAny arbitrary header name and valueX-Custom-Auth: my-secret-value

Credentials are encrypted at rest and scoped to your organization. They are never exposed to the LLM, never sent to the caller, and never logged. Only the platform's HTTP execution layer accesses them to attach authentication headers.


Parameters Tab

Parameters define what information the LLM needs to extract from the conversation to call the tool. Each parameter becomes a field in the function schema the LLM sees.

FieldTypeDescription
namestringParameter name, used as the key in the request body or query string.
typestringData type: "string", "number", "boolean", or "integer".
descriptionstringTells the LLM what this parameter represents and how to extract it from the conversation.
requiredbooleanWhether the LLM must provide this parameter. Default: true.

How Parameters Are Sent

The HTTP method determines where parameters are placed in the request:

MethodParameter LocationContent-Type
POSTJSON request bodyapplication/json
PUTJSON request bodyapplication/json
PATCHJSON request bodyapplication/json
GETURL query parameters--
DELETEURL query parameters--

Writing Effective Parameter Descriptions

The LLM extracts parameter values from the conversation based on each parameter's name and description. Be specific:

ParameterBad descriptionGood description
date"The date""The date the caller wants the appointment, in YYYY-MM-DD format. If the caller says a relative date like 'tomorrow', convert it to the actual date."
email"Email address""The caller's email address. Ask for it if not mentioned in the conversation."
quantity"How many""The number of items the caller wants to order. Must be a positive integer."

Custom Headers

Static key-value pairs added to every request. Use for content types, API versions, or other fixed headers. These are separate from authentication headers.

FieldTypeDescription
headersobjectStatic key-value pairs, e.g., {"X-API-Version": "2024-01", "Accept": "application/json"}.

Example: Booking API Tool

Here is a complete example of an HTTP API tool that books appointments.

Tool Configuration

Settings:

  • Name: Book Appointment
  • Description: Use this tool when the caller wants to book, reschedule, or cancel an appointment. Extract the date, time, and service type from the conversation.
  • Method: POST
  • URL: https://api.example.com/v1/appointments
  • Timeout: 5000 ms
  • Custom Message: Let me book that for you, one moment.

Authentication:

  • Credential: A Bearer Token credential with your API token.

Parameters:

NameTypeRequiredDescription
customer_namestringYesThe caller's full name
datestringYesThe appointment date in YYYY-MM-DD format
timestringYesThe appointment time in HH:MM format (24-hour)
servicestringNoThe type of service requested (e.g., "haircut", "consultation")

What the Platform Sends

curl -X POST "https://api.example.com/v1/appointments" \
  -H "Authorization: Bearer your-api-token-here" \
  -H "Content-Type: application/json" \
  -d '{
    "customer_name": "John Smith",
    "date": "2026-05-25",
    "time": "15:00",
    "service": "consultation"
  }'

What the LLM Receives Back

{
  "status": "confirmed",
  "appointment_id": "APT-2026-1234",
  "date": "2026-05-25",
  "time": "15:00",
  "service": "consultation",
  "provider": "Dr. Sarah Chen"
}

The LLM then responds to the caller:

"Your consultation appointment is confirmed for May 25th at 3 PM with Dr. Sarah Chen. Your confirmation number is APT-2026-1234."


Example: Weather Lookup Tool (GET)

Settings:

  • Name: Get Weather
  • Description: Use this tool when the caller asks about the weather in a specific location. Returns current temperature and conditions.
  • Method: GET
  • URL: https://api.weatherapi.com/v1/current.json
  • Timeout: 5000 ms

Authentication:

  • Credential: An API Key credential with header name key and your WeatherAPI key.

Parameters:

NameTypeRequiredDescription
qstringYesThe city or location the caller is asking about

Equivalent curl (GET parameters become query string):

curl -X GET "https://api.weatherapi.com/v1/current.json?q=London" \
  -H "key: your-api-key-here"

Response Handling

The full HTTP response body is returned to the LLM as the tool result. The LLM interprets the response and incorporates relevant information into its next spoken message. There is no need to configure response parsing -- the LLM handles JSON, XML, and plain text responses natively.

Error Handling

ScenarioWhat Happens
Timeout exceededThe LLM receives an error message and can inform the caller (e.g., "I'm sorry, I wasn't able to look that up right now.")
Non-2xx HTTP statusThe LLM receives the error response body and can handle it gracefully
Network errorThe LLM receives a connection error message
Invalid URLThe tool call fails before execution

Keep timeout values realistic. Voice calls are real-time -- if your API consistently takes more than 3-5 seconds to respond, the caller will experience an awkward silence (unless you configure a custom hold message). For slow APIs, always set a custom message.


Tool Definition Schema

The full JSON schema for an HTTP API tool definition, as stored in the definition field:

{
  "schema_version": 1,
  "type": "function",
  "config": {
    "method": "POST",
    "url": "https://api.example.com/endpoint",
    "timeout_ms": 5000,
    "headers": {
      "X-Custom-Header": "value"
    },
    "credential_uuid": "cred-uuid-here-or-null",
    "parameters": [
      {
        "name": "param_name",
        "type": "string",
        "description": "What this parameter represents",
        "required": true
      }
    ],
    "customMessages": ["Let me check that for you.", "One moment please."],
    "customMessageType": "text",
    "customMessageRecordingId": null
  }
}

Best Practices

  1. Use specific tool descriptions -- the LLM decides which tool to call based on the description. Vague descriptions lead to incorrect tool selection.
  2. Set realistic timeouts -- default is 5 seconds. Increase for slow APIs, but always pair with a custom hold message.
  3. Mark optional parameters as non-required -- this lets the LLM call the tool even when the caller doesn't mention every field.
  4. Use credentials for authentication -- never put API keys in custom headers or the URL. Credentials are encrypted and never exposed to the LLM.
  5. Test your endpoint independently -- before configuring the tool, verify the API works with a curl command. The tool sends exactly the same request.

On this page