Denbegnaye agent → your API
Your workflow calls your company’s REST API—for example, to look up a product, check inventory, create a CRM record, or read an order.
Set up an API connection
Preparing your workspace...
A practical integration guide for company admins and developers. Connect an existing REST API to agent workflows, or securely send website events to an active Denbegnaye agent.
Company API integrations
Use an existing API; Denbegnaye does not generate credentials for a third-party website. Create or request an API key from the service that owns the API, then add its API base URL and credentials in your Company dashboard.
Your workflow calls your company’s REST API—for example, to look up a product, check inventory, create a CRM record, or read an order.
Set up an API connectionYour server sends an authenticated event—such as an order or contact form submission—to a Webhook Trigger in an active agent.
Set up a website triggerAsk your website or service provider for their REST API docs and a restricted server-side credential.
A company owner or admin saves the base URL and authentication in Company → Integrations.
Select the saved connection in an HTTP Request node, choose an endpoint, and test with safe data.
Production prerequisites
Deploy supabase/migrations/20261104190000_add_workspace_api_integrations.sql to the Supabase project used by the app. Use your normal Supabase migration workflow or run the migration in the project SQL editor.
Generate one random 32-byte key (64 hexadecimal characters), then set that exact ENCRYPTION_KEY as a server-side environment variable in both the Next.js app and Agent Builder Workers. Restart/redeploy both services. Do not expose it to the browser or commit it.
Set NEXT_PUBLIC_WORKERS_URL in the web app to the public HTTPS base URL of the Agent Builder Workers service (for example https://workers.example.com), then redeploy the web app. This is used to preview webhook endpoints; it is not a secret.
The web app needs SUPABASE_URL and SUPABASE_SERVICE_ROLE_KEY configured in its server environment for the integration API routes. Never use the service-role key in client code.
node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"Keep the same key on both services. Changing it later without re-encrypting saved credentials makes those credentials unreadable.
Outbound API
This lets a workflow call an API your team is authorized to use. It does not crawl website pages or turn a public storefront URL into an API. Use the API host, documentation, and endpoint paths provided by the system owner.
In the website platform or service you want to connect, open its developer/API settings. Create an API key or token that has only the required permissions. If your website is custom-built, ask its developer for the API base URL, endpoint documentation, and an authentication method.
Enter a clear name, the API base URL (for example https://api.example.com/v1), what your agents should use it for, and the auth method. Add credentials in the secure credential fields. Do not paste a product-page URL such as https://example.com/products as the API base URL unless the API provider explicitly documents it as an API endpoint.
Expand the saved connection, enter an endpoint path documented by the API provider, and start with a read-only GET endpoint. The test makes a real HTTP request. POST, PUT, PATCH, and DELETE can change data, so only use them when you understand the endpoint’s effects.
Open a company agent in Agent Builder, add an HTTP Request node, select the saved Company API Connection, choose a method, and enter the relative endpoint path (such as /products). Add JSON headers only when the API requires non-authentication headers, then map request body values from workflow inputs or upstream nodes.
Run the agent and inspect the HTTP node output. Confirm the status code and response fields, handle empty/not-found responses, and avoid sending unnecessary personal or payment data. Keep credentials in Company → Integrations, not in node text, workflow prompts, or frontend code.
Authorization: Bearer …X-API-Key.Connection: Store API
Method: GET
URL: /products/{{input.productId}}
Body: (empty)
Example response:
{
"id": "coffee-001",
"name": "Single-origin coffee",
"available": true
}The selected connection supplies the base URL and authentication. The workflow node stores only the connection ID and endpoint configuration.
Inbound events
An inbound webhook is a server-to-server POST from your website to an agent with a configured Webhook Trigger node. The worker validates the path, method, and shared secret, then queues the workflow and returns an accepted response.
From the Company dashboard, build or open an agent in the target company/workspace.
Set its endpoint path (for example website-events), HTTP method (usually POST), authentication (Bearer or API key), and a strong random secret.
Activate the agent. Its endpoint is https://<your-workers-domain>/api/integrations/webhook/<agent-id>/<path>. Company → Integrations shows an endpoint preview for active company agents.
Send the configured method, JSON body, and matching authentication header from your backend—not from public browser JavaScript.
const response = await fetch(
process.env.DENBEGNAYE_ORDER_WEBHOOK_URL!,
{
method: "POST",
headers: {
"Content-Type": "application/json",
Authorization:
`Bearer ${process.env.DENBEGNAYE_WEBHOOK_SECRET!}`,
"X-Webhook-Event-Id": order.id,
},
body: JSON.stringify({
event: "order.created",
orderId: order.id,
customerEmail: order.customer.email,
total: order.total,
}),
}
);
if (!response.ok) {
throw new Error(`Webhook returned ${response.status}`);
}The endpoint is agent-specific and is not an API key for calling arbitrary Denbegnaye services. Use the configured trigger secret and path for that agent.
Security checklist
Only workspace owners and admins can create, edit, test, or delete saved API connections. Other members can use connections in authorized workflows.
API credentials are encrypted at rest. Configure the same 64-character hexadecimal ENCRYPTION_KEY on the web app and Agent Builder Workers so the worker can decrypt them at execution time.
Keep credentials in server-side Company → Integrations settings. Never commit secrets, place them in NEXT_PUBLIC_* variables, or send them in browser code.
Use HTTPS, restricted credentials, least-privilege scopes, and rotation. Do not send payment-card data or unnecessary personal data in workflow requests or webhook payloads.
Outbound connections are restricted to public API hosts; private/local network targets and redirects are blocked. API responses are limited to 2 MiB and requests time out.
Incoming webhook secrets are configured on the Webhook Trigger node. Treat them as secrets and keep them in your website server’s environment, not source control.
An outbound API test sends a real request to the selected endpoint. Use GET or another harmless endpoint first; write methods may update or delete live data.
Troubleshooting
Set a valid 64-character hexadecimal ENCRYPTION_KEY on both the Next.js web app and Denbegaye-Agent--Workers. They must use the exact same value. Restart/redeploy both services after changing it.
Check the selected auth type, API key header name, credential scope, expiration, and whether the provider expects a different token format. Re-enter credentials if they were rotated.
Check the API base URL and documented path/version. A website product page is not necessarily an API endpoint. Try the provider’s documented health or read-only endpoint.
Use a publicly reachable API host with valid DNS and TLS. Localhost, private network addresses, and redirected hosts are intentionally blocked.
Confirm the agent is active; the agent ID and configured path exactly match; the HTTP method is the same; and the Bearer/API-key secret matches the trigger node.
202 only confirms that the job was queued. Open the agent execution history and inspect node status, credentials, and downstream workflow errors.
Open your Company dashboard to save an API connection, test it, and attach it to a company workflow. You need owner or admin access to manage credentials.
Next.js product UI and API routes for accounts, workflow authoring, billing, and service integrations.
Node.js API and worker processes validate requests, queue jobs, execute workflows, and persist results.
Python services provide document analysis, retrieval, specialist agents, and business outputs.
Project documentation
These references are maintained with the application and describe the actual architecture, workflow setup, and service deployment boundaries.
The workflow API Integration Guide in the repository is marked historical. The company-specific steps on this page describe the current workspace API connection, HTTP Request node, and webhook-trigger flow.
Continue to implementationNeed another place to start?
Return to the product overview and choose a Denbegnaye workspace.