Skip to main content
The Suppio Agent API lets your backend send a support message with optional image attachments and function tools to one Suppio agent and receive a generated response. Use the API when you want to build Suppio into your own support workflow, route messages through your own app, or decide what to do when Suppio suggests escalation, resolution, or a title.
API keys are secrets. Use them only from trusted backend code. Do not put Suppio API keys in browsers, mobile apps, frontend bundles, or public repositories.

What it is

The Agent API is a server-to-server endpoint:
You send a message and can include base64-encoded images. Suppio answers using the selected agent’s context and returns:
  • outcome: whether the request succeeded or was blocked
  • response: the text answer
  • actions: structured signals your app can act on
  • tool_calls: caller-defined action signals your app can execute
  • usage: credits and tokens consumed

When to use it

Use the API when:
  • you already have a custom chat UI
  • you want to create tickets in your own system after Suppio escalates
  • you want to label or route conversations using suggest_title
  • you need a backend integration instead of the Discord bot, chat widget, or support page

Set it up

1

Create or open an agent

Open the Suppio dashboard, choose your workspace, and open the agent.
2

Add context

Add at least one context source. API keys cannot be created until the agent has context.
3

Open Deploy

Open Deploy and choose API.
4

Generate an API key

Click Generate API Key. Copy the key immediately. Suppio shows the full key only once.
5

Copy the agent ID

Copy the agent ID from the agent page URL. In /dashboard/workspace/{workspaceId}/agent/{agentId}, the {agentId} value is the ID you use in API requests.
6

Call the endpoint from your backend

Send the key as a bearer token to the documented endpoint and include a JSON body with message, optional image attachments, and optional function tools.
7

Return from the sidebar

After the first key is created, API remains in the agent sidebar for key management.

Authentication

Send the API key in the Authorization header.
API keys:
  • start with suppio_live_
  • are scoped to exactly one agent
  • stop working immediately after deletion
  • are shown in full only when created
  • are stored by Suppio as a hash, a display prefix, and the last four characters

Endpoint

Build the URL with the production API host and your agent ID:
For example, if your agent ID is agent_123, use:
You can find the agent ID in the dashboard URL when the agent is open. It is the value after /agent/.

Path parameters

Headers

Request body

Each decoded image can be up to 5 MB, with a 10 MB decoded total per request. The JSON body limit is 16 MB. Base64 encoding increases the transferred size, and Suppio processes the images directly from the request without storing them. Image inputs count toward model input tokens. Those tokens are included in usage.tokens, converted to Suppio credits using the normal model rate, and deducted from the workspace just like text input tokens.

Caller-defined tools

Caller-defined tools are action signals. Suppio adds each tool’s instructions to the agent instructions for that request and exposes its name, description, and parameters as a function tool. When the agent calls one, Suppio records the name and arguments, then continues generating the text response. Suppio does not call your services, run a webhook, or confirm that the external action succeeded. Your backend receives the calls in tool_calls and decides whether to execute them. Use caller-defined tools for actions such as creating a ticket, adding a routing tag, or requesting a callback. They are not synchronous data-retrieval tools because your backend cannot return a tool result during the same request. Tool schemas must use strict mode:
  • The root must be an object schema.
  • Every object, including nested objects, must set additionalProperties to false.
  • Every property must appear in that object’s required array.
  • Represent an optional value with a nullable type, such as "type": ["string", "null"], while keeping the field in required.
The complete tools array can be up to 64 KB. Tool definitions count toward model input usage. Duplicate names, reserved names, unsupported fields, invalid schemas, and definitions over the limits return invalid_tools before the agent runs. The agent can call multiple tools or the same tool more than once. Suppio preserves the calls in invocation order.

Current API limitations

  • Only image attachments are supported. PDFs and other document attachments are not accepted.
  • Caller-defined tools cannot return data to the agent during the same request.
  • Suppio does not mutate your system through the API. Your app decides what to do with returned actions and tool calls.

Example requests

Example success response

Example blocked response

Blocked responses still use HTTP 200 because the request was processed successfully.

Action signals

Suppio returns action signals so your application can decide what to do next.
The user asked for a person or the agent cannot confidently continue.
The request was fully answered or the user indicated the issue is resolved.
The agent identified a short support title that can help your app label or route the conversation.

Handling caller-defined tool calls

Inspect tool_calls and allowlist the names your backend supports before executing anything. Arguments are JSON objects that follow the schema sent with the request.
custom-tool-handler.js
Blocked responses always return an empty tool_calls array.

Handling escalations

The API does not automatically notify staff or create tickets. Your backend should inspect actions and run your own workflow.
escalation-handler.js

Errors

API errors use this shape:

Rate limits

Rate limits are enforced per API key with a one-minute window. The effective limit is the lower of the key’s stored limit and the current workspace plan limit. Authenticated API responses include:
Rate-limited responses also include:
Daily dashboard counters are tracked per UTC day across all API keys for an agent. The daily limit is the plan’s requests-per-minute limit multiplied by 360 minutes.

Key management

  • You can have up to 5 active API keys per agent.
  • You can create up to 5 API keys per day.
  • Rotate keys by creating a new key, updating your backend, then deleting the old key.
  • Deleted keys stop working immediately.
  • The dashboard shows key prefix, last four characters, created time, last used time, total requests, requests today, and active key count.
The generated endpoint reference is available in the API Reference tab.