---
title: "Create custom tool"
method: POST
path: "/api/custom-tools"
tags: ["custom_tools"]
---

# Create custom tool

`POST /api/custom-tools`

## Request

- Base URL: `https://beta.getsales.io/integrations/v1`
- URL: `https://beta.getsales.io/integrations/v1/api/custom-tools`
- Auth: HTTP bearer and API key in header `Team-SID`

Define a team HTTP tool in one write, validated whole so the executor can trust the row: the request template (https, a literal public host, placeholders {{key}} in the path, query, header values and body strings), the input_schema that declares every placeholder, the output_mapping of names to dot-paths into the response, and the connection the tool authenticates with (provider custom; omit it for a public API). A vendor the platform ships (OpenAI, Hunter...) is a catalog operation, not a custom tool; an API key goes on a provider connection, never into a header. 422 on an undeclared placeholder, a placeholder in the host, a private or non-https target, an auth-shaped header name; 409 on a duplicate name. Then test_custom_tool.

Contract:
- MCP tool `create_custom_tool`, registry package `mcp.integrations/custom_tools`, mount `integrations.providers`.
- Operation `create`, response envelope `create`.
- Flags: none.

## Request body

- CreateCustomToolRequest: Request body of `create_custom_tool`.
  - `name` string, required: Unique within the team, 1..255 chars.
  - `description` string, nullable: Free text, up to 2000 chars.
  - `provider_connection_sid` string, nullable: A provider connection of provider custom this tool authenticates with (in_cn_...); null = a public API, no auth injected.
  - `request` object, required: The request template: method, https URL with a literal host, headers and a JSON body, placeholders {{key}} in the path, query, header values and body strings.
    - `method` 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE', required: The HTTP method.
    - `url` string, required: https URL; scheme and host literal (no placeholders, default port, public DNS), placeholders in the path and query only.
    - `headers` object: Up to 20 headers; values may hold placeholders. Auth-shaped names (authorization, cookie, token, key...) and Content-Type are refused: auth comes from the connection.
    - `body` object, nullable: A JSON template; null on GET and DELETE. String leaves may hold placeholders; a leaf that IS {{key}} renders with the input's native type.
  - `input_schema` object[]: The declared inputs, up to 30; default none.
    - `key` string, required: The placeholder name: lowercase, digits and underscores.
    - `type` 'string' | 'number' | 'boolean', required: string | number | boolean.
    - `required` boolean: true: a call without it fails as invalid_input.
  - `output_mapping` object: name to dot-path (person.title), up to 20 entries; default {} = the raw body.
  - `status` 'on' | 'off': Default on.

## Response `200`

`create` success envelope.

- CreateCustomToolResponse
  - `success` true, required
  - `operation` 'create', required
  - `item` object, required
    - `sid` string, required: Custom tool sid (in_tl_...).
    - `team_sid` string, required: The owning workspace (ts_tm_...).
    - `name` string, required: Unique within the team among live rows; what the tool pickers show.
    - `description` string, nullable, required: Free text, up to 2000 chars.
    - `provider_connection_sid` string, nullable, required: The connection the tool authenticates with (in_cn_...); null = no auth.
    - `request` object, required: The request template.
      - `method` 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE', required: The HTTP method.
      - `url` string, required: https URL; scheme and host literal (no placeholders, default port, public DNS), placeholders in the path and query only.
      - `headers` object: Up to 20 headers; values may hold placeholders. Auth-shaped names (authorization, cookie, token, key...) and Content-Type are refused: auth comes from the connection.
      - `body` object, nullable: A JSON template; null on GET and DELETE. String leaves may hold placeholders; a leaf that IS {{key}} renders with the input's native type.
    - `input_schema` object[], required: The declared inputs (up to 30).
      - `key` string, required: The placeholder name.
      - `type` string, required: string | number | boolean.
      - `required` boolean, required: Whether a call must bind it.
    - `output_mapping` object, required: name to dot-path into the response body (up to 20); {} = the raw body only.
    - `status` 'on' | 'off', required: off = the executor refuses it with a failed row (custom_tool_disabled).
    - `created_by` object, required: Who defined the tool.
      - `actor_type` 'user' | 'support' | 'api_key' | 'system' | 'agent', required
      - `actor_sid` string, nullable, required
      - `team_sid` string, required
      - `actor_name` string, nullable: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job.
      - `oauth_client_sid` string, nullable: The acting OAuth client (id_oc_*); null off the OAuth path.
      - `reason` string, nullable: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise.
      - `permissions` object, required: Internal audit context: the grant set the actor held at write time. Not a contract.
      - `cluster_id` integer, nullable: Internal audit context: the cluster that served the write.
      - `trace_id` string, nullable: Internal audit context: the trace id of the request that wrote the row.
    - `deleted_by` object, nullable, required: Who deleted it; null while live.
      - `actor_type` 'user' | 'support' | 'api_key' | 'system' | 'agent', required
      - `actor_sid` string, nullable, required
      - `team_sid` string, required
      - `actor_name` string, nullable: The OAuth client that acted ("Claude", "n8n"); null for a user, an API key or a system job.
      - `oauth_client_sid` string, nullable: The acting OAuth client (id_oc_*); null off the OAuth path.
      - `reason` string, nullable: Why a system actor wrote the row (snapshot_capture_job, ...); null otherwise.
      - `permissions` object, required: Internal audit context: the grant set the actor held at write time. Not a contract.
      - `cluster_id` integer, nullable: Internal audit context: the cluster that served the write.
      - `trace_id` string, nullable: Internal audit context: the trace id of the request that wrote the row.
    - `created_at` string, required: ISO 8601 UTC.
    - `updated_at` string, required: ISO 8601 UTC.
    - `deleted_at` string, nullable, required: ISO 8601 UTC; null = live.
  - `already_exists` boolean, required
  - `meta` object, required
    - `trace_id` string, required: UUID v7; same 128-bit value as the X-Trace-Id header.
    - `span_id` string, required: 16 hex chars, root span of this request.
    - `timestamp` string, required: ISO 8601 UTC (Y-m-dTH:i:sZ), response time.
    - `duration_ms` integer, required: Server-side wall clock.
    - `team_sid` string, nullable: The team this call ran in (the token team, or the team_sid override). Null when unauthenticated; absent from pre-2026-08-20 backends.
    - `actor_type` string, nullable: user | agent | api_key | system. Null when unauthenticated; absent from pre-2026-08-20 backends.

## Other responses

- `4XX`: MCP error envelope. `error.code` is one of validation_failed, nothing_to_update, not_found, relation_not_found, invalid_transition, limit_exceeded, payment_required, duplicate_rejected, conflict, delete_blocked, unauthorized, forbidden, rate_limited, not_implemented.
- `5XX`: MCP error envelope with `error.code` internal_error or service_unavailable.

---

[API](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-integrations.md) - [All operations](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-integrations/llms.txt) - [OpenAPI document](https://skmtc.dev/getsales/apis/getsales-public-contract-gs-service-integrations/revisions/2e7105d58335?raw)