> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://developer.jelliu.co/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://developer.jelliu.co/_mcp/server.

# Retrieve an agent tool

GET https://api.jelliu.co/api/agents/{agentId}/tools/{toolId}

Returns one active tool of the agent. Credentials (`auth_config`) are never returned;
`headers` are returned in full, including `fixed_value`. A deleted tool answers 404.

This endpoint reads only the tool row: it does not check the provider, so use it to inspect
configuration, not to confirm the tool is attached to the live agent.

**Consistency.** Cached per workspace and tool for up to 120 seconds; `PATCH` and `DELETE`
through this API invalidate the entry immediately.

**Access**
- **Required scope:** `read` (or `write`).
- **Rate limit:** General API — 120–600 requests/min per workspace depending on plan. See [Rate limits](/rate-limits).
- **Plan:** Available on every plan.


Reference: https://developer.jelliu.co/api-reference/agent-tools/get-agents-by-agent-id-tools-by-tool-id

## Authentication

- `Authorization` header (bearer token, required) — Workspace API key: `jl_` followed by 64 lowercase hex characters, created by the workspace owner in the dashboard (**Settings → API Keys**) and sent as `Authorization: Bearer jl_...`. The plaintext is shown once, at creation; Jelliu stores only a SHA-256 hash. A workspace can hold up to 25 active keys. | Scope | GET / HEAD | POST / PUT / PATCH / DELETE | Admin-only routes | | --- | --- | --- | --- | | `read` | Yes | No | No | | `write` | Yes | Yes | No | | `full` | Yes | Yes | Yes | Operations restricted to admins or owners reject keys without the `full` scope with `403`, and say so in their description. No key, whatever its scope, can mint or revoke API keys or rotate a webhook secret — that requires a signed-in owner session. A revoked key stops authenticating within about 10 seconds. See [Authentication](/authentication).

## Request

### Path parameters

- `agentId` (string, required) — UUID of the agent that owns the tool.
- `toolId` (string, required) — UUID of the tool, as returned by `POST /api/agents/{agentId}/tools`.

## Response

### 200

The tool.

- `data` (object, required) — A webhook tool as returned by the API. Keys are snake_case (the request bodies use camelCase). `auth_config` is never returned.
  - `id` (string, optional) — Tool id.
  - `tenant_id` (string, optional) — Workspace that owns the tool.
  - `agent_id` (string, optional) — Agent the tool belongs to.
  - `name` (string, optional) — Function name the model sees; unique per agent.
  - `description` (string, optional) — Instruction the model uses to decide when to call the tool.
  - `type` (enum, optional) — Tool kind. Always `webhook`.
    - Allowed values: `webhook`
  - `method` (enum, optional) — HTTP method. Body parameters only travel with POST, PUT and PATCH.
    - Allowed values: `GET`, `POST`, `PUT`, `PATCH`, `DELETE`
  - `url` (string, optional) — Endpoint the provider calls, with `{placeholders}` for path parameters.
  - `headers` (list of object, optional) — Request headers, including their `fixed_value`. Only `fixed` headers are sent.
    - `identifier` (string, required) — Parameter name as sent on the wire (header name, `{placeholder}`, query key or body property).
    - `type` (enum, required) — JSON type the provider sends. A `fixed_value` is coerced to it: `integer` and `number` are parsed, `boolean` is `true` only for the text `true`.
      - Allowed values: `string`, `number`, `integer`, `boolean`, `object`, `array`
    - `description` (string, required) — For `llm_prompt` parameters, the instruction the model follows to extract the value. Not sent to the provider for `fixed` parameters.
    - `value_type` (enum, required) — Who supplies the value. `llm_prompt`: the model fills it from the conversation. `fixed`: the platform injects `fixed_value` and the model never chooses it; a `fixed_value` of the form `{{variable}}` is replaced by that session dynamic variable.
      - Allowed values: `llm_prompt`, `fixed`
    - `fixed_value` (string, optional) — Value for `fixed` parameters: a literal (`agente_ia`, `"true"`) or a dynamic variable such as `{{contact_phone}}`. A `fixed` parameter without a value is treated as model-filled.
    - `required` (boolean, optional, default: true) — Whether the model must supply the value (query and body parameters). `fixed` parameters are never asked of the model regardless of this flag.
    - `enum_values` (list of string, optional) — For `llm_prompt` parameters, the only values the model may send.
  - `path_params` (list of object, optional) — URL placeholder parameters.
    - `identifier` (string, required) — Parameter name as sent on the wire (header name, `{placeholder}`, query key or body property).
    - `type` (enum, required) — JSON type the provider sends. A `fixed_value` is coerced to it: `integer` and `number` are parsed, `boolean` is `true` only for the text `true`.
      - Allowed values: `string`, `number`, `integer`, `boolean`, `object`, `array`
    - `description` (string, required) — For `llm_prompt` parameters, the instruction the model follows to extract the value. Not sent to the provider for `fixed` parameters.
    - `value_type` (enum, required) — Who supplies the value. `llm_prompt`: the model fills it from the conversation. `fixed`: the platform injects `fixed_value` and the model never chooses it; a `fixed_value` of the form `{{variable}}` is replaced by that session dynamic variable.
      - Allowed values: `llm_prompt`, `fixed`
    - `fixed_value` (string, optional) — Value for `fixed` parameters: a literal (`agente_ia`, `"true"`) or a dynamic variable such as `{{contact_phone}}`. A `fixed` parameter without a value is treated as model-filled.
    - `required` (boolean, optional, default: true) — Whether the model must supply the value (query and body parameters). `fixed` parameters are never asked of the model regardless of this flag.
    - `enum_values` (list of string, optional) — For `llm_prompt` parameters, the only values the model may send.
  - `query_params` (list of object, optional) — Query-string parameters.
    - `identifier` (string, required) — Parameter name as sent on the wire (header name, `{placeholder}`, query key or body property).
    - `type` (enum, required) — JSON type the provider sends. A `fixed_value` is coerced to it: `integer` and `number` are parsed, `boolean` is `true` only for the text `true`.
      - Allowed values: `string`, `number`, `integer`, `boolean`, `object`, `array`
    - `description` (string, required) — For `llm_prompt` parameters, the instruction the model follows to extract the value. Not sent to the provider for `fixed` parameters.
    - `value_type` (enum, required) — Who supplies the value. `llm_prompt`: the model fills it from the conversation. `fixed`: the platform injects `fixed_value` and the model never chooses it; a `fixed_value` of the form `{{variable}}` is replaced by that session dynamic variable.
      - Allowed values: `llm_prompt`, `fixed`
    - `fixed_value` (string, optional) — Value for `fixed` parameters: a literal (`agente_ia`, `"true"`) or a dynamic variable such as `{{contact_phone}}`. A `fixed` parameter without a value is treated as model-filled.
    - `required` (boolean, optional, default: true) — Whether the model must supply the value (query and body parameters). `fixed` parameters are never asked of the model regardless of this flag.
    - `enum_values` (list of string, optional) — For `llm_prompt` parameters, the only values the model may send.
  - `body_params` (list of object, optional) — JSON body properties.
    - `identifier` (string, required) — Parameter name as sent on the wire (header name, `{placeholder}`, query key or body property).
    - `type` (enum, required) — JSON type the provider sends. A `fixed_value` is coerced to it: `integer` and `number` are parsed, `boolean` is `true` only for the text `true`.
      - Allowed values: `string`, `number`, `integer`, `boolean`, `object`, `array`
    - `description` (string, required) — For `llm_prompt` parameters, the instruction the model follows to extract the value. Not sent to the provider for `fixed` parameters.
    - `value_type` (enum, required) — Who supplies the value. `llm_prompt`: the model fills it from the conversation. `fixed`: the platform injects `fixed_value` and the model never chooses it; a `fixed_value` of the form `{{variable}}` is replaced by that session dynamic variable.
      - Allowed values: `llm_prompt`, `fixed`
    - `fixed_value` (string, optional) — Value for `fixed` parameters: a literal (`agente_ia`, `"true"`) or a dynamic variable such as `{{contact_phone}}`. A `fixed` parameter without a value is treated as model-filled.
    - `required` (boolean, optional, default: true) — Whether the model must supply the value (query and body parameters). `fixed` parameters are never asked of the model regardless of this flag.
    - `enum_values` (list of string, optional) — For `llm_prompt` parameters, the only values the model may send.
  - `auth_type` (enum, optional) — Declared authentication scheme (credentials are stored separately and never returned).
    - Allowed values: `none`, `bearer`, `basic`, `oauth2_client_credentials`, `oauth2_jwt`, `custom_header`
  - `response_timeout_secs` (integer, optional) — Seconds the provider waits for the response (1–120).
  - `tool_call_sound` (enum, optional) — Sound played on voice while waiting, or `null` for silence.
    - Allowed values: `ringing`, `typing`, `ambient`
  - `tool_call_sound_behavior` (enum, optional) — When the sound plays.
    - Allowed values: `auto`, `always`, `never`
  - `dynamic_variable_assignments` (list of object, optional) — Stored response-to-variable mappings (not currently forwarded to the provider).
    - `variable_name` (string, required) — Dynamic variable to set, without braces.
    - `json_path` (string, required) — Path to the value inside the response body.
    - `description` (string, optional) — Free-text note for your team.
  - `position` (integer, optional) — Sort key for listing and provider order.
  - `created_at` (datetime, optional) — When the tool was created.
  - `updated_at` (datetime, optional) — Last change to the tool.

## Errors

### 400 Bad Request Error

`agentId` or `toolId` is not a UUID.

- `error` (object, required) — The error object. Always has `code` and `message`.
  - `code` (string, required) — Stable machine-readable error code (for example `VALIDATION_FAILED`, `UNAUTHORIZED`, `FORBIDDEN`, `NOT_FOUND`, `BILLING_ERROR`, `COMPLIANCE_BLOCKED`, `RATE_LIMIT_EXCEEDED`, `INTERNAL_ERROR`). Switch on this, not on `message`. See [Errors](/errors).
  - `message` (string, required) — Human-readable explanation. English or Spanish depending on the route; may change without notice.
  - `details` (object or list of object, optional) — Present on `VALIDATION_FAILED` only. Its shape depends on how the route validates: * a field map, either Zod's `flatten()` output (`{ "formErrors": [], "fieldErrors": { "name": ["..."] } }`) or just its `fieldErrors` part (`{ "name": ["..."] }`); * an issue list, where each issue has at least `path`, `message` and `code`. `path` is a dot-separated string on routes that let the schema throw, and an array of keys on routes that forward Zod's raw issues (those also carry Zod's extra issue fields).
    - Field map
      - `formErrors` (list of string, optional)
      - `fieldErrors` (map from string to list of string, optional)
  - `metadata` (map from string to any, optional) — Structured detail exposed for a small allowlist of codes only — for example `BILLING_ERROR` carries `limit`, `current` and `tier` (resource caps) or `tier` and `feature` (feature gates).

### 401 Unauthorized Error

No usable credential. Either the `Authorization` header is missing or is not a well-formed `Bearer jl_…` key, or the key is unknown, revoked or expired. Do not retry with the same key. See [Authentication](/authentication#401-unauthorized).

- `error` (object, required) — The error object. Always has `code` and `message`.
  - `code` (string, required) — Stable machine-readable error code (for example `VALIDATION_FAILED`, `UNAUTHORIZED`, `FORBIDDEN`, `NOT_FOUND`, `BILLING_ERROR`, `COMPLIANCE_BLOCKED`, `RATE_LIMIT_EXCEEDED`, `INTERNAL_ERROR`). Switch on this, not on `message`. See [Errors](/errors).
  - `message` (string, required) — Human-readable explanation. English or Spanish depending on the route; may change without notice.
  - `details` (object or list of object, optional) — Present on `VALIDATION_FAILED` only. Its shape depends on how the route validates: * a field map, either Zod's `flatten()` output (`{ "formErrors": [], "fieldErrors": { "name": ["..."] } }`) or just its `fieldErrors` part (`{ "name": ["..."] }`); * an issue list, where each issue has at least `path`, `message` and `code`. `path` is a dot-separated string on routes that let the schema throw, and an array of keys on routes that forward Zod's raw issues (those also carry Zod's extra issue fields).
    - Field map
      - `formErrors` (list of string, optional)
      - `fieldErrors` (map from string to list of string, optional)
  - `metadata` (map from string to any, optional) — Structured detail exposed for a small allowlist of codes only — for example `BILLING_ERROR` carries `limit`, `current` and `tier` (resource caps) or `tier` and `feature` (feature gates).

### 403 Forbidden Error

The API key lacks the `read` scope, or the workspace is suspended.

- `error` (object, required) — The error object. Always has `code` and `message`.
  - `code` (string, required) — Stable machine-readable error code (for example `VALIDATION_FAILED`, `UNAUTHORIZED`, `FORBIDDEN`, `NOT_FOUND`, `BILLING_ERROR`, `COMPLIANCE_BLOCKED`, `RATE_LIMIT_EXCEEDED`, `INTERNAL_ERROR`). Switch on this, not on `message`. See [Errors](/errors).
  - `message` (string, required) — Human-readable explanation. English or Spanish depending on the route; may change without notice.
  - `details` (object or list of object, optional) — Present on `VALIDATION_FAILED` only. Its shape depends on how the route validates: * a field map, either Zod's `flatten()` output (`{ "formErrors": [], "fieldErrors": { "name": ["..."] } }`) or just its `fieldErrors` part (`{ "name": ["..."] }`); * an issue list, where each issue has at least `path`, `message` and `code`. `path` is a dot-separated string on routes that let the schema throw, and an array of keys on routes that forward Zod's raw issues (those also carry Zod's extra issue fields).
    - Field map
      - `formErrors` (list of string, optional)
      - `fieldErrors` (map from string to list of string, optional)
  - `metadata` (map from string to any, optional) — Structured detail exposed for a small allowlist of codes only — for example `BILLING_ERROR` carries `limit`, `current` and `tier` (resource caps) or `tier` and `feature` (feature gates).

### 404 Not Found Error

No active tool with that id on this agent in this workspace.

- `error` (object, required) — The error object. Always has `code` and `message`.
  - `code` (string, required) — Stable machine-readable error code (for example `VALIDATION_FAILED`, `UNAUTHORIZED`, `FORBIDDEN`, `NOT_FOUND`, `BILLING_ERROR`, `COMPLIANCE_BLOCKED`, `RATE_LIMIT_EXCEEDED`, `INTERNAL_ERROR`). Switch on this, not on `message`. See [Errors](/errors).
  - `message` (string, required) — Human-readable explanation. English or Spanish depending on the route; may change without notice.
  - `details` (object or list of object, optional) — Present on `VALIDATION_FAILED` only. Its shape depends on how the route validates: * a field map, either Zod's `flatten()` output (`{ "formErrors": [], "fieldErrors": { "name": ["..."] } }`) or just its `fieldErrors` part (`{ "name": ["..."] }`); * an issue list, where each issue has at least `path`, `message` and `code`. `path` is a dot-separated string on routes that let the schema throw, and an array of keys on routes that forward Zod's raw issues (those also carry Zod's extra issue fields).
    - Field map
      - `formErrors` (list of string, optional)
      - `fieldErrors` (map from string to list of string, optional)
  - `metadata` (map from string to any, optional) — Structured detail exposed for a small allowlist of codes only — for example `BILLING_ERROR` carries `limit`, `current` and `tier` (resource caps) or `tier` and `feature` (feature gates).

### 429 Too Many Requests Error

Rate limit exceeded for the current 60-second window (`RATE_LIMIT_EXCEEDED`). Wait `Retry-After` seconds, then retry. The `message` differs per limiter; the code does not. See [Rate limits](/rate-limits).

- `error` (object, required) — The error object. Always has `code` and `message`.
  - `code` (string, required) — Stable machine-readable error code (for example `VALIDATION_FAILED`, `UNAUTHORIZED`, `FORBIDDEN`, `NOT_FOUND`, `BILLING_ERROR`, `COMPLIANCE_BLOCKED`, `RATE_LIMIT_EXCEEDED`, `INTERNAL_ERROR`). Switch on this, not on `message`. See [Errors](/errors).
  - `message` (string, required) — Human-readable explanation. English or Spanish depending on the route; may change without notice.
  - `details` (object or list of object, optional) — Present on `VALIDATION_FAILED` only. Its shape depends on how the route validates: * a field map, either Zod's `flatten()` output (`{ "formErrors": [], "fieldErrors": { "name": ["..."] } }`) or just its `fieldErrors` part (`{ "name": ["..."] }`); * an issue list, where each issue has at least `path`, `message` and `code`. `path` is a dot-separated string on routes that let the schema throw, and an array of keys on routes that forward Zod's raw issues (those also carry Zod's extra issue fields).
    - Field map
      - `formErrors` (list of string, optional)
      - `fieldErrors` (map from string to list of string, optional)
  - `metadata` (map from string to any, optional) — Structured detail exposed for a small allowlist of codes only — for example `BILLING_ERROR` carries `limit`, `current` and `tier` (resource caps) or `tier` and `feature` (feature gates).

## Examples

**Response**

```json
{
  "data": {
    "id": "7b0e4f3a-1c2d-4e5f-8a9b-0c1d2e3f4a5b",
    "tenant_id": "2d9f6c1e-3b4a-4c5d-9e8f-7a6b5c4d3e2f",
    "agent_id": "9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d",
    "name": "consultar_pedido",
    "description": "Consulta el estado y la fecha estimada de entrega de un pedido a partir de su número.",
    "type": "webhook",
    "method": "GET",
    "url": "https://api.tiendaandina.co/v1/pedidos/{numero_pedido}",
    "headers": [],
    "path_params": [
      {
        "identifier": "numero_pedido",
        "type": "string",
        "description": "Número del pedido que menciona el cliente, solo dígitos",
        "value_type": "llm_prompt",
        "required": true
      }
    ],
    "query_params": [],
    "body_params": [],
    "auth_type": "none",
    "response_timeout_secs": 20,
    "tool_call_sound": "typing",
    "tool_call_sound_behavior": "auto",
    "dynamic_variable_assignments": [],
    "position": 0,
    "created_at": "2026-09-01T15:04:05.000Z",
    "updated_at": "2026-09-01T15:04:05.000Z"
  }
}
```

**SDK Code**

```python Agent Tools_getAgentsByAgentIdToolsByToolId_example
import requests

url = "https://api.jelliu.co/api/agents/9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d/tools/7b0e4f3a-1c2d-4e5f-8a9b-0c1d2e3f4a5b"

headers = {"Authorization": "Bearer <token>"}

response = requests.get(url, headers=headers)

print(response.json())
```

```javascript Agent Tools_getAgentsByAgentIdToolsByToolId_example
const url = 'https://api.jelliu.co/api/agents/9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d/tools/7b0e4f3a-1c2d-4e5f-8a9b-0c1d2e3f4a5b';
const options = {method: 'GET', headers: {Authorization: 'Bearer <token>'}};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Agent Tools_getAgentsByAgentIdToolsByToolId_example
package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.jelliu.co/api/agents/9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d/tools/7b0e4f3a-1c2d-4e5f-8a9b-0c1d2e3f4a5b"

	req, _ := http.NewRequest("GET", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Agent Tools_getAgentsByAgentIdToolsByToolId_example
require 'uri'
require 'net/http'

url = URI("https://api.jelliu.co/api/agents/9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d/tools/7b0e4f3a-1c2d-4e5f-8a9b-0c1d2e3f4a5b")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Get.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body
```

```java Agent Tools_getAgentsByAgentIdToolsByToolId_example
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.get("https://api.jelliu.co/api/agents/9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d/tools/7b0e4f3a-1c2d-4e5f-8a9b-0c1d2e3f4a5b")
  .header("Authorization", "Bearer <token>")
  .asString();
```

```php Agent Tools_getAgentsByAgentIdToolsByToolId_example
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('GET', 'https://api.jelliu.co/api/agents/9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d/tools/7b0e4f3a-1c2d-4e5f-8a9b-0c1d2e3f4a5b', [
  'headers' => [
    'Authorization' => 'Bearer <token>',
  ],
]);

echo $response->getBody();
```

```csharp Agent Tools_getAgentsByAgentIdToolsByToolId_example
using RestSharp;

var client = new RestClient("https://api.jelliu.co/api/agents/9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d/tools/7b0e4f3a-1c2d-4e5f-8a9b-0c1d2e3f4a5b");
var request = new RestRequest(Method.GET);
request.AddHeader("Authorization", "Bearer <token>");
IRestResponse response = client.Execute(request);
```

```swift Agent Tools_getAgentsByAgentIdToolsByToolId_example
import Foundation

let headers = ["Authorization": "Bearer <token>"]

let request = NSMutableURLRequest(url: NSURL(string: "https://api.jelliu.co/api/agents/9a8b7c6d-5e4f-4a3b-8c2d-1e0f9a8b7c6d/tools/7b0e4f3a-1c2d-4e5f-8a9b-0c1d2e3f4a5b")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "GET"
request.allHTTPHeaderFields = headers

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```