vault_call_api
ActiveTool of WingmanProtocol Agent Gateway
ZERO-EXPOSURE authenticated HTTP call: store an API key/credential in your vault, then call any API and let the gateway inject the secret server-side — it NEVER enters your context. You send method/url/auth (and optional headers/body); the gateway decrypts, injects, calls through its SSRF-guarded fetch, and returns only the response. auth = {type, ref, name?}: type 'bearer' -> Authorization: Bearer; 'header' (+name) -> a named header; 'basic' -> Authorization: Basic of an entry's username+password; 'query' (+name) -> a URL query param. ref names a vault entry ('entry' or 'entry:field', e.g. 'openai_key:key'). Do NOT pass Authorization yourself. CAVEAT: zero-exposure covers OUR outbound path — a hostile API can still echo your credential in its own response body. A redirected POST is followed as GET with the body dropped, and credentials are stripped on a cross-origin redirect. Requires your secret (Bearer).
Parameters schema
{
"type": "object",
"required": [
"handle",
"method",
"url",
"auth"
],
"properties": {
"url": {
"type": "string",
"description": "target URL (https recommended)"
},
"auth": {
"type": "object",
"description": "{type:'bearer'|'header'|'basic'|'query', ref:'entry[:field]', name?}"
},
"body": {
"type": "object",
"description": "optional JSON body (POST/PUT/PATCH)"
},
"handle": {
"type": "string",
"description": "your registered handle"
},
"method": {
"enum": [
"GET",
"POST",
"PUT",
"PATCH",
"DELETE"
],
"type": "string",
"description": "HTTP method"
},
"headers": {
"type": "object",
"description": "optional NON-secret request headers (Authorization is forbidden here — use auth)"
}
},
"additionalProperties": false
}No endpoints wrapped at confidence ≥ 0.50.
Parent server
WingmanProtocol Agent Gateway
https://github.com/WingmanProtocol-Agent-Gateway/wingman-agent-gateway
1/7 registries