---
title: "Create tool"
method: POST
path: "/v1/senders/{senderId}/agent/tools"
tags: ["Agent Tools"]
---

# Create tool

`POST /v1/senders/{senderId}/agent/tools`

## Request

- Base URL: `https://api.zavu.dev`
- URL: `https://api.zavu.dev/v1/senders/{senderId}/agent/tools`
- Auth: HTTP bearer

Create a new tool for an agent. Tools allow the agent to call external webhooks.

## Path parameters

- `senderId` string, required

## Request body

- ToolCreateRequest
  - `name` string, required
  - `description` string, required
  - `parameters` ToolParameters, required
    - `type` 'object', required
    - `properties` object, required
    - `required` string[], required
  - `webhookUrl` string, uri, required: Must be HTTPS.
  - `webhookSecret` string: Signing secret for the webhook. Optional: Zavu generates one when omitted and returns it on this response only. Supply your own if you already have a secret you want reused.
  - `enabled` boolean

## Response `201`

Tool created.

- ToolResponse
  - `tool` AgentTool, required
    - `id` string, required
    - `agentId` string, required
    - `name` string, required
    - `description` string, required: Description for the LLM to understand when to use this tool.
    - `parameters` ToolParameters, required
      - `type` 'object', required
      - `properties` object, required
      - `required` string[], required
    - `webhookUrl` string, uri, required: HTTPS URL to call when the tool is executed.
    - `enabled` boolean, required
    - `createdAt` string, date-time, required
    - `updatedAt` string, date-time, required
    - `webhookSecret` string: Signing secret for this tool's webhook. **Returned only when the tool is created**, never on a later read. Zavu generates one if you do not supply it, and signs every call to this tool with it: `X-Zavu-Signature: <hex>`, the HMAC-SHA256 of the request body. Verify it before trusting the call. Lost it? Rotate with `POST /v1/senders/{senderId}/agent/tools/{toolId}/webhook/secret`.

## Other responses

- `400`: Invalid request.
- `401`: Unauthorized.
- `404`: Agent not found.
- `409`: `conflict`: the agent already has a tool with this name. Tool names are unique per agent, because a flow's `tool` step and the model both call a tool by name.

## Changes

> 80 revisions in range; 1 not diffed.

- **2026-08-07** `358ec4c351c6`: 1 info
  - added the optional property `tool/webhookSecret` to the response with the `201` status

[Operation history](https://skmtc.dev/zavudev/apis/zavu-unified-messaging-layer-api/changes/v1/senders/:senderId/agent/tools/post.md)

---

[API](https://skmtc.dev/zavudev/apis/zavu-unified-messaging-layer-api.md) - [All operations](https://skmtc.dev/zavudev/apis/zavu-unified-messaging-layer-api/llms.txt) - [OpenAPI document](https://skmtc.dev/zavudev/apis/zavu-unified-messaging-layer-api/revisions/75bc777b0ffb?raw)