> ## Documentation Index
> Fetch the complete documentation index at: https://docs.platform.nora.my/llms.txt
> Use this file to discover all available pages before exploring further.

# Tool block

> Give your Agent the ability to call APIs, run code, or query databases.

A **Tool block** is a capability the Agent can pick during a run. Tools come in two runtime kinds:

* **HTTP** — call an external API.
* **Inline** — run a snippet in JavaScript, Python, or SQL, sandboxed on our runtime.

## The four things every Tool needs

1. **Name** — how the Agent refers to it. Short and verb-y (`refund_charge`, `lookup_order`).
2. **Description** — a one-liner the Agent reads when deciding whether to call it. **This is the most important field.** The Agent won't call a tool it doesn't understand.
3. **Parameters** — typed inputs, each with a name, type, required/optional, and their own descriptions.
4. **Implementation** — the actual call: URL + method for HTTP, or the code body for Inline.

## HTTP tools

Configure:

* **Method** — `GET`, `POST`, `PATCH`, `PUT`, `DELETE`.
* **URL** — supports `{param}` templating for path segments.
* **Headers** — including secrets (see below).
* **Body template** — for `POST`/`PATCH`/`PUT`. Use `{param}` for interpolation.

Response is passed back to the Agent as JSON. If the API returns non-JSON, you can add a small post-processor in the Tool.

## Inline tools

Write a function body in JavaScript, Python, or SQL. Parameters are auto-injected as named variables. The return value is what the Agent sees.

Example (JavaScript):

```javascript theme={null}
// Parameters: order_id (string)
const order = await db.query('SELECT * FROM orders WHERE id = $1', [order_id]);
return { total: order.total_cents / 100, status: order.status };
```

Inline runs in a sandbox with a modest CPU + memory budget and no filesystem or network by default. Whitelist outbound hosts in the Tool's settings if you need them.

## Parameters

Each parameter has:

* **Type** — `string`, `number`, `boolean`, `enum`, `object`, `array`.
* **Description** — one line, read by the Agent when choosing values.
* **Required / optional** — required params are always filled; optional are filled only when the Agent thinks they're useful.
* **Default** — used when the Agent omits an optional param.
* **Enum values** — for `enum` type, list the allowed literal values.

Reorder parameters with drag-handles. Order affects presentation, not semantics.

## Secrets and headers

Any header or body value can be marked **secret**. Secrets are:

* Never shown in the UI after save (they render as `••••`).
* Never included in exported Flow JSON.
* Injected at call time from encrypted workspace storage.

Rotate a secret from the Tool's Inspector — old runs continue to work, new runs use the new value.

## Approvals

Toggle **Require approval before call** for high-risk tools (money movement, destructive DB ops, notifications). Held calls appear in the Approvals queue with the exact arguments the Agent picked.

## Testing a Tool

Every Tool has a **Test** panel. Fill in the parameters, hit Run, and see the raw response. Uses your Draft credentials, so you can iterate safely.