List the tool catalogue

GET/api/v1/tools

scope assistants:read

Every tool an assistant on this account can be granted, with its group, sensitivity and default state. The ids here are the keys used in an assistant’s tool_access and gated_tools. A critical tool always raises a human approval, whatever gated_tools says.

Query parameters

Name	Type	Description
`group`optional	`string`	Only tools in this catalogue group

Request

curl "https://your-crm.example.com/api/v1/tools" \
  -H "Authorization: Bearer $RAABTA_API_KEY"

Response · 200 OK

{
  "data": [
    {
      "id": "contacts.search",
      "group": "contacts",
      "group_label": "Contacts",
      "title": "Search contacts",
      "description": "Find a contact by name, phone or email.",
      "sensitivity": "read",
      "autonomous_allowed": true,
      "min_role": "viewer",
      "default_enabled": true
    }
  ]
}

Response

Wrapped in { data: … }

Name	Type	Description
`id`required	`string`	Tool id — the key used in tool_access and gated_tools
`group`required	`string`	Catalogue group id
`group_label`required	`string`	Group name as shown in the dashboard
`title`required	`string`	Short human name
`description`required	`string`	What the tool does
`sensitivity`required	`string (enum)`	A critical tool always raises an approval, whatever gated_tools says`readwritecritical`
`autonomous_allowed`required	`boolean`	May run with no human watching
`min_role`required	`string`	Lowest account role this tool acts on behalf of
`default_enabled`required	`boolean`	State when tool_access names no opinion

Errors

Status	Code	When
400	`bad_request`	The request could not be parsed: malformed JSON, an invalid cursor, or a query parameter of the wrong shape.
400	`validation_error`	The body or query failed validation. `details` lists each failing field with a `path` and a `message`.
401	`unauthorized`	No usable API key: the Authorization header is missing or malformed, or the key is unknown, revoked or expired. The three are deliberately indistinguishable.
403	`forbidden`	The key is valid but lacks the scope this endpoint requires, or the request came from an address outside the key’s IP allowlist. The message says which.
403	`account_suspended`	The account this key belongs to is suspended. Rotating the key will not help; contact support.
429	`rate_limited`	The per-key budget, or the per-IP budget for failed authentication, is exhausted. Honour `Retry-After` before retrying.
500	`internal`	Something failed on our side. Safe to retry with the same Idempotency-Key; quote `request_id` if it persists.