External API
Working with External APIs in eMOBIQ AI
eMOBIQ AI enables seamless integration with external APIs, allowing your application to communicate with third-party systems, databases, or services. This functionality empowers developers and system integrators to extend the capabilities of their applications by connecting to external data sources and executing custom logic.
Choosing Your Integration Mode
eMOBIQ AI offers three ways to register an external API. Pick the one that matches your use case before starting:
Standard External API (this page)
Any third-party REST API that needs accuracy and testing
Endpoint-by-endpoint configuration in a Postman-like editor
Non-technical users, prototypes, throwaway demos
Paste plain-text or natural-language API documentation
ERP integrations (Acumatica, Dynamics 365, Sage)
Authenticate with ERP credentials and bulk-import endpoints
The rest of this page covers the Standard External API flow — the most flexible option, with full control over endpoints, authentication, testing, and response shaping.
1. Creating a New API Connection
Let's begin integrating an external API into your eMOBIQ AI environment:
Step-by-Step Instructions:
Add a New API
Select
External APIas the backend connection
Adding a new API
Click on
+ Add a new APIProvide a meaningful name and description for the API connection. These will help identify the purpose and function of the API within your application
Click
Saveto proceed
Configure Domain Settings
Click on
+ Add DomainEnter the Base URL (also known as the root endpoint) that links eMOBIQ AI to the target external API
2. Authentication Setup
Authentication ensures secure access to external APIs. eMOBIQ AI supports five common authentication methods:
If you're unsure which authentication method to use, consult the documentation for the API you're integrating with or reach out to the service provider of the API for guidance
Selecting Authentication Type
Select the appropriate authentication type based on the external API's requirements
Supported Authentication Types:
Basic Auth
API Key
Bearer Token
JWT Bearer
Authentication Credentials
Depending on the type of authentication your API requires, you’ll need to provide the appropriate credentials. Here’s what to enter for each authentication type:
Enter your Username and Password
The system will automatically encode these into a
Base64string and include it in the request headers
Specify the Header Name (e.g.,
x-api-key) and the Key ValueThis adds a static key-value pair to the request headers and is commonly used for lightweight service authentication
Enter the Token string that will be used as the Bearer credential
This token is typically obtained from an authentication server and will be included in the
Authorizationheader like this:Bearer <your_token>
Enter the JWT (JSON Web Token) you want to use for authentication
The JWT is usually generated by an identity provider or authentication service and must be valid at the time of the request
Some systems also allow you to generate or refresh tokens dynamically using pre-request scripts or custom logic
Client ID: The public identifier for your application
Client Secret: The private key used to authenticate your app (optional depending on the grant type)
Token Endpoint: The URL where the system can request an access token
Select the appropriate Grant Type from the options below and fill in the required fields
Supported Grant Types:
Password Credentials
First-party trusted apps that collect the user's username and password directly
Client Credentials
Machine-to-machine or backend services accessing their own resources (no user involved)
Authorization Code
Web apps accessing user data with explicit consent (e.g., Google, Microsoft, Salesforce)
Authorization Code with PKCE
Use when your OAuth provider requires PKCE — adds a cryptographic challenge to prevent code interception
Authorization Code — requires:
Authorization URL, Access Token URL, Client ID, Client Secret, and Callback (Redirect) URL
eMOBIQ AI acts as a confidential client; the token exchange happens server-to-server
Authorization Code with PKCE — requires:
Authorization URL, Access Token URL, Client ID, and Callback URL
Choose SHA-256 (recommended) or Plain as the PKCE mode
Client Secret is not required and is often omitted
For full details on all grant types, see the OAuth 2.0 guide.
Ensure to refresh your access tokens when required:
Get new Access Token,
ensures that the connection remains authenticated and ready for useAuthentication Instructions
After configuring your API authentication method, you can define Authentication Instructions — this tells the AI how to use the credentials when generating the app. This effectively creates a more accurate end result and helps to save cost during the app generation process.
Auth Instructions allows you to:
Specify how authentication should be applied in requests (e.g., which headers, tokens, or query params to include)
Customise the behaviour of each API depending on the level of control you need
Help the AI correctly authorise requests to secured endpoints, without manual adjustments
While this step is optional, providing clear authentication instructions improves reliability and reduces ambiguity in how the AI should structure API calls
Best Practice: Use authentication instructions to align your API call structure with the external service’s expected format (especially useful for APIs with non-standard auth headers or dynamic tokens)
3. Defining API Functions
Once the domain and authentication are configured, you can define specific functions (or endpoints) to interact with the external API
Create a New Function:
Function Details
Supported HTTP methods include GET, POST, PUT, PATCH, and DELETE
A descriptive name for the function
The relative path of the API endpoint (e.g., /api/v1/users)
Request Configuration
Query parameters appended to the URL
Metadata sent with the request (e.g., content type, authorization headers)
Data sent in the body of the request, particularly useful for POST, PUT, and PATCH methods
Describe how the AI should interpret and utilize this function. Think of this as a functional specification for the AI engine to understand how to execute or reference this API during runtime
4. Testing the API
Before integrating the API into your application, it’s essential to verify that it works correctly
Test
Use the Test button to send a request to the external API
Return Message
A successful test will return a 200 or 201 status code, indicating that the connection and function execution was successful. Otherwise, try resolving the errors that appear
Examination
Examine the returned data to ensure it matches expectations and contains the necessary fields for downstream processing
5. Refining the API Response
Sometimes, not all data returned by an API is required by your application. You can edit the response to improve performance and clarity.
Editing the response can either be done through a checklist (Formatted) or through the text editor (Raw)
If certain fields aren’t used, click Edit to remove them to ensure the AI doesn't use it, this is essential in helping the project be generated quicker and ensuring that only usable API information is available when creating the app
Use the edit function to filter or transform the JSON structure returned by the API
Select or deselect via the checkboxes
This helps simplify complex responses and align them with the format expected by your frontend components or internal logic
6. Importing APIs Using Schemas
For larger or more structured integrations, eMOBIQ AI supports importing API definitions using schema files
Upload a schema file (such as OpenAPI 3.0 Schema) that describes the API endpoints and data structures
Fill out the schema form manually to define the API structure directly in the platform and click generate
Functions will be populated according to the schema
This approach is ideal for APIs that don't provide downloadable schema files but still need formal documentation
Note: Using schemas help streamline the integration process, ensuring consistency and reducing manual configuration errors
7. Manage Cookies
When calling external APIs — particularly those that use OAuth or session-based authentication — the API provider may set cookies as part of the authentication handshake, or require certain cookies to be present before allowing a request through. The Manage Cookies panel gives you visibility into those cookies and lets you manually add any that are missing.
Cookies are managed entirely within your own browser — they stay on your device and are never transmitted to eMOBIQ servers. Because of this, cookies are browser-specific: switching to a different browser means you'll need to re-add them there.
The panel is split into two sections:
Domain (left)
Lists all domains that have cookies in your current browser session, grouped by the API provider domain (e.g., login.microsoftonline.com, github.com). A search bar lets you filter by domain name. Each domain shows a count of how many cookies it holds.
Cookies (right)
Displays the Key and Value of every cookie set by the selected domain. An Add form at the bottom lets you manually inject cookies for that domain.
Viewing cookies by domain
Open the Manage Cookies panel
Use the Search domain bar to filter, or scroll to find the API provider domain
Click a domain — its cookies appear in the right panel as a Key / Value list
Adding a cookie
Select the target domain from the left panel
Scroll to the Add section at the bottom of the right panel
Enter the cookie Key and Value and confirm — the cookie will be sent with subsequent API calls to that domain
Conclusion
By leveraging the robust API management features of eMOBIQ AI, you can securely and efficiently integrate external services into your applications. Whether you're retrieving data, submitting forms, or triggering backend processes, eMOBIQ AI provides a flexible and scalable framework for building intelligent, connected systems.
Last updated