Integrations

Plugins

Method	Path	Body	Returns
GET	/plugins		PluginState[]: built-in and custom plugins, connected or not, with their tools
POST	/plugins/{id}/connect	{ "apiKey", "url", "useSaved", "oAuth" }	PluginState, connected, with its tools listed
PUT	/plugins/custom	CustomPluginRequest	PluginState. Adds or edits a custom plugin (connect it afterwards).
PUT	/plugins/{id}/tools	{ "enabled": ["search", "read_page"] }	PluginState. The tools bots may use.
DELETE	/plugins/{id}		204. Disconnects a built-in plugin or removes a custom one.

A custom plugin:

{
  "name": "My MCP server",
  "transport": "Stdio",
  "command": "npx",
  "args": ["-y", "@acme/mcp-server"],
  "env": { "ACME_TOKEN": "..." }
}

For "transport": "Http", give url and headers instead. When editing (with its id), send keepSecrets: true to keep the saved environment variables and headers; their values are never sent back.

Sign-in plugins on a server. If connect fails with pluginSignInUrl set in the error, the sign-in must happen in a browser. The app does it on your PC and calls connect again with the result in oAuth.

Composio apps

Method	Path	Returns
POST	/composio/apps/{slug}/connect	{ connected, url, account, failed }. Open url to sign in to the app (e.g. gmail).
GET	/composio/apps/{slug}	The same, to check whether the sign-in finished
DELETE	/composio/apps/{slug}	204

Logins

Method	Path	Body	Returns
GET	/logins		LoginState[] (never passwords: hasPassword, hasPrivateKey and hasOtp say what's saved)
PUT	/logins	LoginSaveRequest	LoginState. No id creates one.
DELETE	/logins/{id}		204
POST	/logins/{id}/test		{ ok, message }. Connects and signs in from the server.

{
  "name": "Production database",
  "kind": "PostgreSql",
  "host": "db.internal",
  "port": 5432,
  "username": "reporting",
  "database": "app",
  "password": "...",
  "allowChanges": false
}

kind is Website, Ssh, Sftp, Ftp, MySql or PostgreSql. When editing, leave password, privateKey, passphrase and otpSecret out to keep the saved ones. Which bots may use a login is part of each bot's profile (logins).

Quill

Method	Path	Body	Returns
GET	/quill		QuillState[]: connected sites, plus a connection waiting for its code (with an empty id)
POST	/quill/connect	{ "url": "docs.example.com", "name": "Product docs" }	A QuillState with pendingCode and verifyUrl. Open verifyUrl and approve the code; the server finishes connecting by itself.
PUT	/quill/site	{ "siteId", "name", "about" }	204. Names a site and says what's on it.
DELETE	/quill?site={id}		204. Revokes the connection and every bot's key. Without site, cancels a pending connection.
GET	/quill/page?slug=...&site=...		A page for a page card (with its preview link if it's a draft). Without site, each site is tried.

Poll GET /quill every couple of seconds while connecting: the pending entry disappears once the code is approved, and gets an error if it's turned down or expires.

Blotter

Method	Path	Body	Returns
GET	/blotter		BlotterState[], as for Quill
POST	/blotter/connect	{ "url": "board.example.com" }	A BlotterState with pendingCode and verifyUrl
DELETE	/blotter?site={id}		204
POST	/blotter/call	{ "siteId", "method", "path", "body" }	{ status, body }: a request to the site's own API as the server's connection

path is relative to the site's /api/v1/, such as tickets?status=open or tickets/WEB-12/comments. body is a JSON string.

Which bots work on which sites is part of each bot's profile (quillSites, blotterSites).