OpenCoreAgents & Actions

OpenAPI Actions

View as Markdown

OpenAPI Actions turn an approved API specification into tools that an Agent can use. Admins can manage every Action; Curators can create Actions and maintain only the ones they created. Users authorize only prompts shown to them, and the runtime sends requests only for configured operations.

How OpenAPI Actions work

An OpenAPI specification describes the API operations, inputs, and responses that can become tools. OpenCore uses the specification to create an Action, after which an Admin or the Curator who owns it maintains the intended operations. Any user who can edit an Agent may attach an Action that is currently available for selection.

Prepare the specification

The Admin or Curator who owns the Action should use a current, reviewed OpenAPI specification from the API owner. Ensure that it describes only the operations the Agent should use, has clear inputs and responses, and identifies any authentication requirements without embedding secret values.

Admins can import and validate specifications across the deployment. Curators can create Actions and import specifications for them, but can update only Actions they created. Global Curator status does not expand Action ownership. Before importing, verify that the API endpoint and supported operations are appropriate for the deployment’s data and access boundaries.

Add and validate an Action

  1. Sign in as an Admin or Curator and open OpenAPI Actions.
  2. Add the reviewed specification and select the operations needed by the intended Agent workflow.
  3. Complete the protected Action configuration, save it, and attach the Action to an Agent.
  4. Run an approved test request and review the returned result before publishing the Agent.

Admins can upload or change any specification, select operations, and complete protected configuration. Curators can perform those maintenance operations only for Actions they created. This ownership rule is the same for Curators and Global Curators; Actions do not belong to their curated or member groups.

A Curator can attach a currently selectable Action to any Agent they can edit.

The Action owner should update the imported definition when the API contract changes. This maintenance boundary covers modification, deletion, and protected credentials.

Deployment-level model, integration, security, Index Settings, Usage, and organization configuration remain Admin responsibilities. Users cannot add operations or change the Action’s configuration through an Agent conversation.

Configure authentication

Enter API authentication only through the protected Action settings available to the Admin or Action owner. Never include secrets in the OpenAPI document, Agent instructions, user messages, source control, or shared documentation.

The API owner and Action owner are responsible for the connection’s access scope and credential lifecycle; an Admin can also maintain them. A user approval prompt, when present, authorizes that user’s interaction; it does not expose or transfer the Action’s stored authentication material.

Troubleshooting

If an Action cannot be added, verify the specification format, API endpoint, and selected operations with the API owner. If an operation is added but fails at runtime, inspect the reported response and check the configured inputs, API-side permissions, and protected connection settings.

If a user cannot use a working Action, verify the Agent’s sharing scope and any required authorization prompt. Re-run a representative approved request after every configuration change.

  • Manage Agents explains how to attach an OpenAPI Action to an Agent.
  • MCP Actions covers tool servers that use MCP instead of an API specification.
  • Language Models explains how administrators make models available to Agents.