---
title: Custom API
description: Call any REST API from its OpenAPI (Swagger) spec — pick an operation and its fields are generated for you.
---

Call any web API that publishes an OpenAPI (Swagger) description: paste the spec URL, pick an operation, and fill the fields the node builds for you.

Optional: pick a saved connection in the **Credential** field when the service needs one.

## What it does

The node downloads the OpenAPI document at **OpenAPI spec URL** and lists its operations in **Operation**, shown as `METHOD /path — summary`. Once you pick one, **Parameters** shows a field for each path, query and header parameter, and a single `body` field for a JSON request body. Required fields are marked.

When it runs, it builds the request, sends it to the API's address (the first server listed in the spec, or the spec's own site if none is listed), adds your credential the way the spec asks, and returns the response.

Limits:

* JSON specs only. A YAML spec is refused with a clear message.
* Request bodies are JSON only: form-encoded and file-upload bodies are not generated.
* API key, Basic and Bearer security are supported; OAuth2 sign-in is not.
* References inside the same document are followed; references to other files, and `allOf`/`oneOf` combinations, are not.

## When to use it

* Use a service that has no dedicated node but publishes an OpenAPI spec.
* Get ready-made fields for each endpoint instead of writing URLs and headers by hand.
* Use [Http Request](/nodes/builtin/core/http-request/) instead when the API has no spec, needs a non-JSON body, or you want full control over the request.

## Inputs and settings

* **OpenAPI spec URL** must point at the JSON document itself (often ending in `openapi.json` or `swagger.json`), not at the human-readable documentation page. Click **Grant access** next to the field: it allows both loading the spec and calling the API on that site. You can review it later in **Settings → Site access**; see [Permissions and security](/app/troubleshooting/permissions-security/).
* Fill **Parameters** with fixed values or expressions, for example `status` = `{{ $input.status }}`.

## Outputs

The output is the API's response: parsed JSON when the API returns JSON, otherwise the raw text. An empty success response (204) returns `success: true`. Any error status stops the node with an error.

## Dependencies and credentials

* **Credential** (connection): optional. See [Create a connection](/app/connections/).

Leave **Credential** empty for public APIs. Otherwise, pick the credential type that matches the API's security, as described in the spec:

| Security in the spec | Credential type | How it is sent |
| --- | --- | --- |
| API key in a header | Bearer Token | The key in the named header, for example `X-API-Key`. |
| API key in the query | Bearer Token | The key as the named query parameter, for example `?api_key=…`. |
| HTTP bearer | Bearer Token | `Authorization: Bearer …` |
| HTTP basic | Basic Auth | `Authorization: Basic …` |

See [Create a credential](/app/connections/create/).

## Example workflow

1. A [Schedule](/nodes/builtin/trigger/schedule/) trigger runs every morning.
2. Custom API, **OpenAPI spec URL** `https://petstore3.swagger.io/api/v3/openapi.json` (click **Grant access**), **Operation** `GET /pet/findByStatus`, **Parameters** `status` = `available`.
3. [Limit](/nodes/builtin/datatransformation/limit/) keeps the first 5 results.
4. [Browser Notification](/nodes/extension/browsernotification/) shows how many were found.

## Common issues

* **"The OpenAPI spec could not be read as JSON. Only JSON specs are supported for now."** The URL serves YAML or a web page. Find the JSON version of the spec.
* **"Failed to fetch the OpenAPI spec: 404 Not Found".** The spec URL is wrong, or access to the site was not granted.
* **"Operation "…" was not found in the spec".** The spec changed since you picked the operation. Pick it again.
* **"Custom API Error: 401 Unauthorized" or "403 Forbidden".** The credential is missing, or its type does not match the spec's security (Bearer Token for API key and bearer, Basic Auth for basic).
* **The run is blocked in the web app.** This node runs in the browser extension. Install it, or run the workflow from the extension.

## Related nodes

* [Http Request](/nodes/builtin/core/http-request/): any request, with or without a spec.
* [HTTP Request Tool](/nodes/builtin/ai/aidependencies/tools/http-request/): let an AI agent call an API.
* [JSON](/nodes/builtin/datatransformation/json/): reshape the response.