Custom API

Most tools a revenue team runs on have an API long before they have a connector. The Custom API connector is how an agent reaches those: Tulina holds the tool's address and key in its vault, and the agent calls the tool by action name, in the same conversation as the CRM, the inbox and the calendar, on a schedule or on an event.

What is a custom API connector?

It is a connector you describe yourself instead of picking from the catalogue. You give Tulina the API's base URL and how it signs in, paste the key into a form, and the tool becomes callable. Searching for "custom api" mostly returns Microsoft Dataverse and Salesforce commerce documentation, which is a different thing: an API you build inside their platform. This is an API that already exists, reached from an agent.

How do you connect a tool with no connector to Claude and ChatGPT?

1. In the tool, find its API documentation and create a key or token. Note the base URL and how the API wants the key sent.
2. In Tulina, open Connectors and add a Custom API. Enter the base URL and choose the auth mode: bearer token, a key in a header or in a query parameter, basic login, OAuth client credentials, or none.
3. Paste the key into the form. It is stored encrypted in the vault and is never shown to the model. If a key is ever pasted into a chat, revoke it at the tool and create a new one.
4. Add https://mcp.tulina.ai/mcp to Claude or ChatGPT and sign in with your Tulina account. The MCP page has the same link.

An agent can also prepare step 2 for you: it builds a link to the form with everything filled in except the key, and sends it to whoever holds the key.

Actions, variables and what the whole team gets

A raw request works from the first minute. For a tool you will use more than once, an admin turns it into a definition that every member's agent then finds by name:

• Actions. A name, a description the agent reads to choose it, a method, a path with placeholders, and the arguments it takes. Import them from the tool's OpenAPI document instead of typing them; the import is a review step and saves nothing until an admin confirms.
• Variables and headers. An organisation id the tool wants on every call is saved once and filled in for you. A constant non-secret header, such as an API version, is set once.
• Named accounts. Several APIs, or several accounts of one API, each carry their own name, and a request says which one it is for.
• Dry run. Any call can be previewed, showing the method, path, query and body, without being sent.
• Reuse. A definition can be exported without the key and imported into another workspace, where only the key is pasted again.

What you can ask it

"Connect our payroll tool: here is its API documentation." The agent reads the documentation, works out the base URL and sign-in, and returns a pre-filled setup link for whoever holds the key. Nothing secret passes through the chat.

"List the open invoices from the billing tool and flag the ones older than sixty days." With an action saved for invoices, the agent calls it by name, filters the result, and posts the short list to Slack.

"Show me the request you would send to cancel order 4812, but do not send it." The agent runs the action as a dry run and returns the exact method, path and body, so a person checks a write before anything leaves.

The work that runs without a prompt each time is built from these calls and the other connected tools. Enrich contacts with email and phone is an example of a process built on several of them.

Three vendors with no dedicated connector today are written up the same way: Atlassian (Jira and Confluence), Messenger and X, each with what its auth allows and what it does not.

What the Custom API connector can't do

• It calls an API with the key you give it, so the tool's own rights decide what a POST, PUT, PATCH or DELETE does. Give the key the narrowest rights the tool allows.
• Sign-in is one of: bearer, header, query, basic, OAuth client credentials or none. An API that needs a person to approve access in a browser (an authorization-code flow) is not reachable through it.
• Redirects are never followed, so the key cannot travel to another address.
• Private-network and loopback addresses are refused unless the platform operator has declared an exception.
• Header and cookie parameters, form bodies and YAML documents are not imported from OpenAPI; they are listed as skipped, with the reason.
• A tool with no API at all cannot be connected this way.