Skip to main content
SupaCortex
Sign in Book a Demo
Feature

From "where is my order?" to the answer, without a ticket

Documents answer how things work. Your systems know what happened to this customer. Connect any HTTPS API and the assistant looks things up - and, after a clear yes, gets things done - for the person who is signed in.

Book a demo See pricing
  • Any HTTPS API or OpenAPI file
  • Actions always confirmed
  • Every call audited

What are API connectors in SupaCortex?

An API connector lets a project's assistant call your own systems during a chat. You describe endpoints of any HTTPS API as lookups (read something) or actions (change something), give a few example phrases for each, and map the response fields that matter. When a user's question matches, SupaCortex picks the endpoint, asks for anything missing, fills the customer's identity from their verified sign-in, calls the API and answers from the result. Actions always need the user's confirmation, and every call is recorded.

  • Auth: API key, bearer token, basic, HMAC signature or OAuth 2 client credentials.
  • Import an OpenAPI 3 or Swagger 2 file; endpoints arrive disabled for you to review.
  • Identity values come only from the signed token - never from the chat text.
  • Only lookups you mark public-safe run in the public website widget.
  • A Try button tests each endpoint as a chosen user before it goes live.
  • Credentials are encrypted and write-only; they are never shown again.
How it works

Connect an endpoint in four steps

  1. 01

    Point at your API

    A base URL, the authentication it expects and its credentials. Or import your OpenAPI file and pick the operations you want.

  2. 02

    Describe each endpoint

    Lookup or action, path and parameters, three to ten example phrases, and which response fields to show and how.

  3. 03

    Try it

    Run the endpoint with sample values, acting as a chosen customer, and see the mapped result and the rendered reply.

  4. 04

    Switch it on

    Enable it for the project's widget. Every save is kept as a version you can roll back to.

In the widget

A lookup, then an action with a yes in between

The customer is signed in to your app, so the assistant already knows whose orders to look at. It never needs to ask - and never accepts - a customer number.

The admin's transcript shows each call on the reply it served: “looked up Order status (200, 120 ms)”. Response bodies are never stored.

Help · signed in as Asha
What's the status of order 1042?
Order 1042 has shipped with BlueDart; delivery is expected on 3 Nov 2026. Total ₹2,499.00.
It arrived damaged. Raise a ticket.
Create a ticket?
Subject: Order 1042 arrived damaged
Yes, create it Cancel

Illustration of an identified widget session.

In detail

Guard rails you do not have to build

Who is asking is not up for discussion

The most common way an AI assistant leaks data is by believing what it is told. This one does not.

  • Each parameter is marked as coming from the user, the signed-in person, or their company.
  • Person and company values are bound from the verified token at the moment of the call.
  • A missing identity refuses the call rather than running it without one.
  • Public visitors can only reach lookups you have marked public-safe - never actions, never identity-bound data.

Actions wait for a yes

Looking something up is cheap to get wrong. Cancelling an order is not.

  • Actions always pass through a confirmation that shows the endpoint name and the values.
  • "Cancel" or "no" stops it; a missing value is asked for, with choices offered as buttons.
  • The confirmed call carries an idempotency key, so a retry never acts twice.
  • A failure is reported plainly, with the status your API returned.

Safe to point at the internet

SupaCortex calls your API from our servers, so it treats every URL with suspicion.

  • HTTPS and public addresses only; every resolved address is checked at connect time.
  • Redirects are never followed; responses must be JSON and are size-capped.
  • Timeouts per connector (1-30 s) and rate limits per user and per project.
  • Every call is audited with status and latency - never the body, never a credential.
  • The last 50 versions of the definition are kept, with one-click rollback.

Related

Website & In-App Chat Widget

One script tag for your site, a WebView URL for your mobile app - public or signed-in users.

In-Product Assistant for SaaS

An assistant inside your web or mobile app that knows who is asking and can act on their account.

HR & Policy Assistant

Employees get policy answers with the clause cited - and their own leave balance, if you connect HR.

E-Commerce & Retail

Shipping, returns and "where is my order?" - the last one from your own order system.

Search & Answer API

The same brain behind your own tools: scoped API keys, /v1/search and /v1/answer.

Integrations

Every source it learns from and every place it answers, with what is live and what is next.
Frequently asked

Questions people ask before they start

No. You describe your API's endpoints in the Connector tab - or import an OpenAPI 3 or Swagger 2 file and review what it suggests - and SupaCortex calls them. Your API stays exactly as it is. The only code you write is the few lines on your backend that sign the chat widget's token, so the assistant knows who is asking.

No. Values such as the customer id or the user id are marked as coming from the verified identity, and are taken from the signed token, never from what the user typed. "Show me order 1042 for customer C-12" still runs with the asker's own customer id. Public website visitors have no identity, so those endpoints are simply not available to them.

No. Any endpoint marked as an action - create a ticket, cancel a booking, raise a leave request - always shows the user what it is about to do, with the values, and waits for a yes. The confirmed call carries an idempotency key, so a retry never does it twice.

Only the fields you map. You choose which fields of the response matter and how they are labelled; the raw response never reaches the model. With a reply template, the model is not involved at all - the answer is filled in from the mapped fields.

A signed protocol (connector-v1) for products that want a deeper link: identity lookup, company policies and rule checks, data and actions, all HMAC-signed. Our HR products HRStop and HiringBull already implement it, so connecting them is a matter of entering a URL and a secret.

Growth, Business and Enterprise. Growth allows 10 custom endpoints, Business 50, Enterprise unlimited. A chat turn that calls your systems uses 2 AI credits.

Pick the one question your agents look up in another system all day.

Book a 30-minute demo on your own documents. We set up a 14-day trial workspace for you - no credit card, no setup fee.

Book a demo See pricing

Questions first? Email info@greatdevelopers.com or call +91 8585953085.

Still curious? Ask your favorite AI about SupaCortex.

ChatGPT Claude Perplexity Grok