# Get a tool

Return one workspace tool and its configuration.

## Endpoint

`GET /api/v1/workspaces/{workspace_id}/tools/{tool_id}`

## Authentication

| Class | Authentication | Minimum role | API key |
| --- | --- | --- | --- |
| dashboard-session-api | Dashboard session cookie; mutations also require X-CX-Request: 1. | member | Not allowed |

## Parameters

| Name | In | Type | Required | Description |
| --- | --- | --- | --- | --- |
| `workspace_id` | path | `string` | Yes | — |
| `tool_id` | path | `string` | Yes | — |

## Request body

This operation has no request body.

## Example

```bash
curl --request GET 'https://operade.ai/api/v1/workspaces/ws_demo/tools/tool_demo' \
  --cookie 'cx_session=YOUR_SESSION_COOKIE'
```

## Responses

| Status | Description | Content |
| --- | --- | --- |
| 4XX | Handled client error | application/json: `ErrorResponse` |
| 200 | Successful Response | application/json: `object` |

### 4XX application/json response schema

| Field path | Type | Reference | Format | Nullable | Required | Enum | Description |
| --- | --- | --- | --- | --- | --- | --- | --- |
| `$` | `object` | ErrorResponse | — | No | Yes | — | — |
| `error` | `object` | ErrorItem | — | No | Yes | — | — |
| `error.code` | `string` | — | — | No | Yes | — | — |
| `error.details` | `object` | — | — | No | No | — | — |
| `error.message` | `string` | — | — | No | Yes | — | — |

### 200 application/json response schema

| Field path | Type | Reference | Format | Nullable | Required | Enum | Description |
| --- | --- | --- | --- | --- | --- | --- | --- |
| `$` | `object` | WebhookTool or GoogleSheetsToolMember or GoogleSheetsToolAdmin | — | No | Yes | — | — |
| `config` | `object` | KonfigWebhook | — | No | Yes | — | — |
| `config.assignments` | `array<Assignment>` | — | — | No | No | — | — |
| `config.assignments[]` | `object` | Assignment | — | No | Yes | — | Petik satu nilai dari balasan tool dan simpan sebagai variabel percakapan. Nama field ikut ElevenLabs (`DynamicVariableAssignment`). `source` mereka cuma punya satu nilai (`response`), jadi tidak ikut disalin — field dengan satu nilai yang mungkin adalah field yang tidak perlu ada. |
| `config.assignments[].dynamic_variable` | `string` | — | — | No | Yes | — | — |
| `config.assignments[].value_path` | `string` | — | — | No | Yes | — | — |
| `config.auth` | `object or null` | Auth | — | Yes | No | — | Rahasianya tidak pernah ditulis di sini — yang disimpan NAMA secret. Brankasnya sudah ada (`core/secrets.py`, AES-256-GCM per workspace), jadi tidak ada sumber daya "auth connection" baru seperti punya ElevenLabs. |
| `config.auth.body_name` | `string or null` | — | — | Yes | No | — | — |
| `config.auth.header_name` | `string or null` | — | — | Yes | No | — | — |
| `config.auth.secret_name` | `string` | — | — | No | Yes | — | — |
| `config.auth.type` | `string` | — | — | No | Yes | "bearer", "basic", "header", "body" | — |
| `config.body_fields` | `object` | — | — | No | No | — | — |
| `config.method` | `string` | — | — | No | No | "GET", "POST", "PUT", "PATCH", "DELETE" | — |
| `config.parameters` | `object` | — | — | No | No | — | — |
| `config.request_headers` | `object` | — | — | No | No | — | — |
| `config.response_mocks` | `array<MockResponse>` | — | — | No | No | — | — |
| `config.response_mocks[]` | `object` | MockResponse | — | No | Yes | — | — |
| `config.response_mocks[].is_error` | `boolean` | — | — | No | No | — | — |
| `config.response_mocks[].mock_result` | `string` | — | — | No | Yes | — | — |
| `config.response_mocks[].parameter_conditions` | `array<ParameterCondition>` | — | — | No | No | — | — |
| `config.response_mocks[].parameter_conditions[]` | `object` | ParameterCondition | — | No | Yes | — | — |
| `config.response_mocks[].parameter_conditions[].eval` | `object` | AnythingEval or ExactEval or RegexEval or LlmEval | — | No | Yes | — | — |
| `config.response_mocks[].parameter_conditions[].path` | `string` | — | — | No | Yes | — | — |
| `config.timeout_secs` | `number` | — | — | No | No | — | — |
| `config.url` | `string` | — | — | No | Yes | — | — |
| `created_at` | `string` | — | date-time | No | Yes | — | — |
| `created_by` | `string` | — | — | No | Yes | — | — |
| `description` | `string` | — | — | No | Yes | — | — |
| `id` | `string` | — | — | No | Yes | — | — |
| `name` | `string` | — | — | No | Yes | — | — |
| `type` | `string` | — | — | No | Yes | "webhook" | — |
| `updated_at` | `string` | — | date-time | No | Yes | — | — |
| `capability_summary` | `string` | — | — | No | Yes | — | — |
| `status` | `string` | — | — | No | Yes | "ready", "unavailable" | — |
| `capability_locked_at` | `string or null` | — | date-time | Yes | Yes | — | — |

### Response example

```json
{
  "id": "string",
  "name": "string",
  "description": "string",
  "type": "webhook",
  "config": {
    "url": "string"
  },
  "created_by": "string",
  "created_at": "2026-01-01T00:00:00Z",
  "updated_at": "2026-01-01T00:00:00Z"
}
```

## Errors

Reviewed common and route-declared errors are summarized here; the list is not exhaustive. Start with the [distributed error index](/docs/reference/api/errors) to find each code's canonical domain page.

| Status | Code | Description |
| --- | --- | --- |
| 401 | `unauthenticated` | Authentication is missing, invalid, or revoked. |
| 403 | `forbidden` | The authenticated caller does not have access to this operation. |
| 404 | `not_found` | The requested workspace resource was not found. |

## Related operations

- [Clone a tool](/docs/api-reference/tools/clone-tool) — `POST /api/v1/workspaces/{workspace_id}/tools/{tool_id}/clone`
- [Create a tool](/docs/api-reference/tools/create-tool) — `POST /api/v1/workspaces/{workspace_id}/tools`
- [Delete a tool](/docs/api-reference/tools/delete-tool) — `DELETE /api/v1/workspaces/{workspace_id}/tools/{tool_id}`