Agent tools

Tools are workspace scoped. Use an API key with tools:read and tools:write for creation, updates and tests. Create secret-bearing connections through the dashboard's Integrations page, then reference the connection ID in the tool configuration.

Endpoint	Purpose
GET /v1/tools?limit=100&after=tool_id	List workspace tools.
POST /v1/tools	Create a tool.
GET /v1/tools/{id}	Get a tool.
PATCH /v1/tools/{id}	Update a catalog tool.
DELETE /v1/tools/{id}	Delete a catalog tool. Published snapshots remain.
POST /v1/tools/{id}/test	Execute with {"arguments": {...}}. This can change external data.

API Request example

{
  "name": "lookup_order",
  "description": "Look up an order after the caller supplies its ID.",
  "input_schema": {
    "type": "object",
    "properties": {"order_id": {"type": "string"}},
    "required": ["order_id"],
    "additionalProperties": false
  },
  "http": {
    "kind": "api_request",
    "method": "GET",
    "url_template": "https://api.example.com/orders/{id}",
    "path_mapping": {"id": "order_id"},
    "connection_id": "eva_connection_example",
    "response_fields": {"status": "order.status"},
    "timeout_seconds": 10
  }
}

Bind the returned tool ID in an EVA or Gemini draft:

{"tools": [{"type": "http", "tool_id": "tool_example"}]}

Publish a new version to snapshot it. Only configured tools are available to the model. Credentials stay in the workspace connection and do not appear in snapshots.

Function contract

Use http.kind: "function", method: "POST", an HTTPS endpoint and an input schema. Function tools use their standard envelope rather than path/query/body mappings. EVA sends:

{
  "version": "1",
  "tool_call_id": "call_example",
  "name": "create_ticket",
  "arguments": {"subject": "Delivery question"},
  "conversation_id": "conv_example"
}

Return a successful HTTP status and JSON containing the same tool_call_id:

{"tool_call_id": "call_example", "result": {"ticket_id": "T-123", "status": "created"}}

A mismatched ID or missing result fails the tool. This is EVA's contract, not a Vapi webhook envelope. Use a saved bearer/header connection to authenticate EVA's requests. Deduplicate your operations by conversation ID plus tool-call ID. EVA does not retry writes automatically. A repeated model request with a new ID is a new invocation. Test requests use an eva_tool_test_… identifier rather than a saved conversation.

Failures and limits

Test responses include success, result, error and duration_ms. In-call results provide a success flag and a normalized error code for the agent to handle. Common codes include timeout, http_status_error, invalid_json_response, invalid_function_response, integration_unavailable, response_field_missing and channel_not_supported. Tool execution metadata is recorded with the call. Never claim an action succeeded based only on the request having been sent.

URLs must be public HTTPS in production. Requests do not follow redirects. JSON input schemas cannot fetch external references. Secret-bearing URL parameters and literal headers are rejected; authentication belongs in the saved connection.