OpenAPI integrations

Supported OpenAPI subset

Stand uses an OpenAPI declaration as a machine-readable contract for a REST API. OpenAPI describes HTTP APIs more broadly; this connector focuses on conventional request-response REST operations that can be represented safely as Stand-in tools.

Import preview checks whether Stand can turn each operation into a tool. It is not a complete OpenAPI conformance validator. An unsupported required input rejects the import, while an unsupported optional input is omitted from the generated tool.

• Learn OpenAPIOfficial introductory documentation and guides from the OpenAPI Initiative.
• OpenAPI SpecificationAuthoritative published specification versions.

Shared connection, explicit Stand-in access

An integration belongs to the organization and is visible to its active reps. Its base URL, authentication, retained OpenAPI declaration, and selected operations are configured once. Multiple instances may use the same provider with different URLs, credentials, or operation sets.

Access is configured separately for each Stand-in. Enabling Use integrations and selecting an instance makes only that instance’s normalized tools available to the Stand-in after the Stand-in is saved.

Import and review an OpenAPI declaration

• Open Stand-ins, find Integrations, and choose New integration.
• Enter a team-facing name, optional description, and the exact public base URL Stand should call.
• Choose no authentication, bearer token, API-key header, or basic authentication. Tokens, API keys, and passwords must contain at least eight characters. Basic-authentication usernames and passwords cannot contain control characters. Keep credentials in the authentication fields rather than the declaration.
• Paste or upload OpenAPI JSON or YAML, then preview the operations against the configured base URL.
• Select only the operations the Stand-in needs and review each operation’s Read or Write mode before creating the integration.
• Expand the saved integration to verify its URL, authentication mode, selected tools, and current Stand-in attachment count.

Edit without replacing the integration

Edit retains the integration identity, current declaration, selected operations, Stand-in attachments, and saved credential unless the rep changes them. Metadata and credentials can be changed without re-importing tools.

Changing the declaration requires another preview so the replacement operation set can be reviewed before save. A changed base URL is validated against the retained tools, and changing the base URL or authentication configuration requires the secret to be entered again. Authentication changes are checked together with every selected or retained tool against the combined outbound-header limit before save. Successful changes refresh active sessions for attached Stand-ins.

Reads, writes, and visitor confirmation

• GET, HEAD, and OPTIONS operations start as Read. They may be configured as Write when the endpoint has side effects.
• POST, PUT, PATCH, and DELETE operations remain Write and cannot be downgraded to Read.
• A Write tool does not execute on its first call. The Stand-in describes the proposed action and asks the visitor for a later reply containing exactly confirm or confirmed.
• The retry uses a short-lived, single-use confirmation bound to the same conversation, operation, arguments, and later visitor message. One visitor confirmation can authorize only one pending action.
• Stand never automatically resends a Write tool after a transport failure because the API may already have completed the action. Failed read-only GET, HEAD, and OPTIONS calls may try another validated address within the same deadline.
• Removing an attachment or deleting or changing an integration prevents later calls from relying only on stale model state.

Use the API as the security boundary

• Stand accepts only public HTTP or HTTPS targets with valid ports from 1 through 65535, revalidates and pins resolved public addresses, and does not follow redirects. Configuration checks use a five-second DNS deadline; runtime DNS shares the eight-second call deadline. Authenticated integrations require HTTPS.
• Credentials are encrypted separately and injected into the outbound request after model input validation. Authentication secrets must contain at least eight characters. They are not included in the model’s tool schema.
• Declarations, tool metadata, and API responses are treated as untrusted content. Direct and commonly encoded credential echoes are redacted before a response is returned to the model.
• The configured API host necessarily receives the credential and operation inputs. Configure only hosts the organization trusts.
• Write confirmation reduces accidental actions; it is not proof of visitor identity or API authorization.

Operational limits

Calls are synchronous. Stand does not follow redirects or orchestrate callback-based or other long-running API workflows. Private, loopback, link-local, metadata, and internal network targets are blocked.

Failure and removal behavior

• Invalid or unsupported declarations fail during preview or save without replacing the existing tools.
• Network, authentication, rate-limit, timeout, content-type, and response-size failures return a bounded tool error rather than exposing raw infrastructure details to the visitor.
• Deleting an integration detaches it from every Stand-in and cannot be undone.
• When the organization no longer has Business access, existing integrations remain listed but cannot be newly attached or used at runtime.

Related features

• Stand-in management and version history — The AI Stand-ins list is the control surface for creating, opening, cloning, enabling, disabling, and deleting Stand-ins. When a Stand-in already has conversation history, replacement-on-edit preserves the old configuration as part of those historical records.
• Attaching knowledge bases to Stand-ins — An attachment makes an organization knowledge base available for private retrieval by one AI Stand-in. The Stand-in searches attached material when it is relevant and falls back to its instructions when no useful source is found.
• Business onboarding and integration support — Business includes hands-on help applying Stand to a website UI and support for one mutually agreed backend API workflow, plus invoicing and purchasing coordination.