Custom API Connections

Custom API connections let you point the agent at any vendor REST API that has no native Junto integration. You register a base URL and a credential, optionally attach the vendor's OpenAPI spec, and the agent can then look up endpoints and make calls from Explore. Every call is approved by a person before it runs.

What You Get

• Any REST API -- pick from a catalog of roughly a thousand apps with known authentication, or add a Custom API with an API key or username and password.
• Two scopes -- a company connection holds a credential for one client (e.g., that client's Zoom account); a personal connection holds your own credential and is usable only in your own Explore chats.
• Endpoint discovery -- attach an OpenAPI 3.x spec and the agent searches it for the right operation before calling.
• Human-approved calls -- the agent shows the exact request in an API call card. Nothing is sent until someone clicks Approve.
• Encrypted credential storage -- credentials are held in an encrypted vault. Junto keeps only the base URL and scope.

Where Connections Live

Location	What you manage there
Settings > Integrations > Custom API connections > Manage	All company connections across your organization
Companies > (select company) > Integrations	Company connections for that one client
My connections > Personal API connections	Your own personal connections

Company connections require the Admin or Owner role to add, test, or delete. Any member can view them. Personal connections are managed only by the member who owns them; no one else, including admins, can see them. Removing a member deletes their personal connections and credentials.

Adding a Connection

1. Click Add connection.
2. On the organization page, choose the Company the connection belongs to.
3. Pick the App. Search the catalog, or choose Custom API (not listed) for any HTTP API with an API key or username and password. Catalog apps fix the authentication type and prefill the name, vendor key, and base URL.
4. Set a Display name (e.g., "Acme Dental – Zoom") and a Vendor key -- a short lowercase slug the agent uses to pick this connection (e.g., zoom). Each company (or each user, for personal connections) can have one connection per vendor key.
5. Enter the Base URL. It must use https and point at a public address. For catalog apps whose URL depends on your tenant (a subdomain, for example), fill in the tenant fields and the base URL is derived for you.
6. Choose Authentication and enter the credential:

Method	Fields	Notes
API key	API key, Header name (default Authorization), Header value template (default Bearer ${apiKey})	Covers bearer tokens and custom headers. Query-string keys are not supported.
Username and password	Username, Password	Sent as HTTP basic authentication.
Sign in with OAuth	None at save time	Catalog apps only. Saving opens the vendor's sign-in to finish connecting.
OAuth client credentials	OAuth client ID, OAuth client secret	Catalog apps only.

7. Click Save connection.

If a vendor rejects the credential at save time, the card shows the vendor's message. OAuth connections that have not finished sign-in show Connection saved, not yet authorized -- click Connect on the card to complete it.

There is no edit button. To change a name or base URL, delete the connection and add it again.

The Connection Card

Each card shows the display name, vendor key, base URL, and a status badge: Connected, Not connected, Needs reconnect, or Disabled.

• Test -- sends a GET to the path in the Test path field (default /) and shows the HTTP status, content type, and the first part of the vendor's response. A passing test clears Needs reconnect on API-key and basic-auth connections.
• Connect -- finishes or repeats OAuth sign-in. OAuth connections recover from Needs reconnect this way.
• Upload spec / Replace spec / Detach spec -- attach an OpenAPI 3.x spec in JSON or YAML, up to 5 MB. The card shows the spec title and operation count. Without a spec the agent relies on its own knowledge of the vendor and confirms with a GET before any write.
• Delete -- removes the connection and discards its stored credential.

Call Classifications

Junto classifies every distinct call the agent makes, or could make from an attached spec, with a plain-language name, an operation kind (read, create, update, delete), a risk level, and topic tags. The classification appears on the approval card so the approver understands the request without reading the raw path.

The connection card summarizes this as, for example, "12 calls known · 2 need review · 1 overridden". Click Classifications to open the full list for the connection. For each call you can see the classifier's verdict and how often the call has run. Where the classifier was not confident, the call is flagged Needs review; click Mark as reviewed to accept the verdict, or Override to set the name, kind, or risk yourself. Reset to classifier returns an overridden call to the automatic verdict. Overrides apply to that connection only and are recorded in the audit log.

How the Agent Uses a Connection

Connections are available in Explore chat only -- not in ticket triage, runbooks, workspaces, or Slack and Teams conversations. Personal connections work only in the owner's own chats.

Connected vendors are named in the agent's tool descriptions, so a request like "check Sentry for errors on Acme's site this week" is enough. The agent lists the matching connection, searches the spec for the operation, and proposes a call.

The API Call Card

Every proposed call appears as a card showing:

• The vendor, and whether it is a Company connection or a Personal connection that runs as the person who connected it.
• The HTTP method, host, and path, plus any Query parameters and Request body.
• A collapsible Headers section. Authentication is added when the call runs and is never shown.
• The call's classification: its plain-language name, operation kind, and risk.
• For anything other than a GET, a caution that the call changes data in the vendor.

Click Approve or Deny. The card then records who decided and when, followed by the response status and body (with a Copy button), or a plain-language error such as a rejected credential, a missing path, a vendor rate limit, or a vendor server error. Values with secret-like names are redacted in displayed responses. Anyone who can read the conversation can see the response.

Approval Required

Every API call requires approval before it runs, including reads. Company connection calls must be approved by a Manager, Admin, or Owner; a Technician's or Operator's request is escalated and waits for one of them. Personal connection calls are confirmed by the requesting user. These approvals cannot be relaxed by tool policies or session grants, and approvers cannot edit the request.

Limits

Limit	Value
Calls per connection	60 per minute
Request timeout	30 seconds
Query string and body	64 KB each
Response shown to the agent	Truncated at 256 KB
Request headers	Accept, Content-Type, X-Request-Id, and vendor X-* headers only
Spec size	5 MB, OpenAPI 3.x

Troubleshooting

• "Base URL must use https" / "must point at a public address" -- Private IPs and localhost are blocked. Use the vendor's public API host.
• "A connection for this vendor already exists" -- Each company or user can hold one connection per vendor key. Delete the old one or use a different key.
• Card shows Needs reconnect -- The vendor rejected the credential. Fix it and run Test (API key or basic auth) or click Connect (OAuth). The agent cannot use the connection until it recovers.
• Agent says the company has no usable connection -- Add one under the company's Integrations tab, or check that the vendor key matches what the agent is looking for.
• "The app catalog is unavailable" -- The catalog lookup failed. Custom API (not listed) still works.
• "Only OpenAPI 3.x specs are supported" / "Spec declares no operations under paths" -- Export a current OpenAPI 3 document from the vendor; Swagger 2.0 files are not accepted.