API servers (OpenAPI)

If your company has its own API with an OpenAPI document, Everdeck can turn its operations into tools for your agents. You choose which operations to enable and the risk tier of each, and agents use them under the same approval rules as every other tool. API servers count toward your plan's MCP and API servers. Company admins manage them on the API servers page.

Import an API

Select Import an API. The import takes four steps, and saving asks you to confirm it's you.

1. Source: upload the OpenAPI document (a .json, .yaml or .yml file of OpenAPI 3.0 or 3.1, up to 5 MB), or give Or its address (a public https address; upload private documents instead). Select Preview.
2. Details: the Name; the Key agents see its operations under, api_<key>_<operation>, which can't be changed later; the Base URL (or a Server from the document); the Authentication; optionally Pagination, so agents can ask for the next page of a list; and Requests per minute, which Everdeck paces calls to stay under.
3. Operations: tick the operations agents may use, up to 100, grouped by tag, with a Search box. Operations Everdeck can't call are shown with the reason.
4. Review: check what you chose, and pick a Test operation: a GET that needs no inputs, run now and from the Test button to check the credentials. Select Create server.

Authentication can be No authentication, API key in a header, API key in the query, Bearer token, Username and password, OAuth client credentials or OAuth sign-in. Secrets are saved encrypted and never shown again; the server's page shows only their last characters.

OAuth sign-in

For OAuth sign-in, register this redirect URI with your OAuth app, then select Sign in on the server's page:

https://everdeck.io/api/api-servers/oauth/callback

Tiers and what agents get

Each operation starts with a tier from its HTTP method: GET at tier 0, POST, PUT and PATCH at tier 3 and DELETE at tier 4. Change it in the Operations table. Untick Untrusted only for operations that return your company's own data; otherwise agents treat what they return as outside content. Enabled controls whether agents can be granted it, and Save pick saves your changes. Enable selected turns several on at once, at tier 3 or higher: lower a tier afterwards, with your second factor, if you trust one.

Agents get an operation only when it's enabled and their charter grants it on the agent's Tools tab. An operation whose input takes an address (a url parameter, for example) counts as tier 3 at least once a session has read outside content, whatever tier you give it: see "Visiting an address raises the tier" in the Approvals guide.

Change the server

• Edit: its name, test operation, pagination and pace.
• Credentials: its base URL and authentication.
• Re-import: upload a new version of the document, or fetch it again from its address, and select Compare to see what's new, changed and removed. Changed operations keep their names, tiers and whether they're enabled; new ones start off unless you tick them; removed ones are turned off.
• Pause and Resume: stop and restart agents' use of it.
• Delete: agents lose its operations at once, and its key is never used again in the company.