Source: https://atomicwork.docs.pageloop.ai/product/enterprise-workflows/actions-and-integrations/use-call-api-actions-in-workflows

# Use Call API actions in workflows

Built-in workflow actions cover the most common operations, but sometimes you need to hit a specific endpoint or pass custom parameters that aren't available as a ready-made action. Call API lets you make direct API calls to your connected integrations from a code script inside a workflow — no tokens, no credential references, no manual auth headers.

If the app you need to call isn't connected through the integrations page, or you need to reach a system that isn't available there, use the [Make an HTTP request](/product/enterprise-workflows/actions-and-integrations/http-request-actions) action with a saved credential instead.

## How Call API works

Call API is available inside the **Execute Code** action. Once an app is connected from the integrations page (**Settings > App store**), your code scripts get access to a typed SDK method for that app:

```javascript
const result = await API.datadog.datadogCallApi({
  method: "GET",
  endpoint: "/api/v1/monitor?page=0&page_size=25",
});
```

The method name follows the app: `API.datadog.datadogCallApi`, `API.azure_ad.azureAddUserToGroup`, and so on. Type `Workflow.` or `API.` in the code editor and press **Cmd+I** (or **Ctrl+I**) to see the available functions and autocomplete them, or click **Insert function**. You can also use the `Workflow.*` namespace — `Workflow.datadogCallApi(...)` resolves to the same function.

> \[!NOTE]
> Call API is used from code scripts only — it does not appear as a separate action in the workflow builder's action picker. To use it, add an **Execute Code** action to your workflow and call the SDK method from your script.

For a broader overview of how Call API fits alongside HTTP requests and the credential store, see the [Calling external systems](/guides/connecting-your-workflows-to-external-systems) guide.

## Parameters

| Field          | Required                   | Notes                                                                                                               |
| -------------- | -------------------------- | ------------------------------------------------------------------------------------------------------------------- |
| **`method`**   | Yes                        | `GET`, `POST`, `PUT`, `DELETE`, or `PATCH`.                                                                         |
| **`endpoint`** | One of `endpoint` or `url` | Path plus query string (e.g. `/api/v1/monitor`). The base URL comes from the connection, so you don't hard-code it. |
| **`url`**      | One of `endpoint` or `url` | Full URL (e.g. `https://atomicwork.okta.com/api/v1/users`). Takes precedence over `endpoint` if both are set.       |
| **`headers`**  | No                         | Merged into the request.                                                                                            |
| **`body`**     | No                         | Request payload.                                                                                                    |

Each integration accepts both `endpoint` and `url`. Use `endpoint` to pass just the path (e.g. `/api/v1/users`) — Atomicwork fills in the base URL from the connection. Use `url` when you need to specify the full address (e.g. `https://atomicwork.okta.com/api/v1/users`). We'd recommend `endpoint` where possible — it avoids hard-coding the base URL, so the call stays correct if your connection's hostname changes.

Both `endpoint` and `url` go through destination safety validation. The difference is only in how the target address is built — not whether it's checked.

## What Atomicwork handles for you

- **Authentication.** The connection's credentials are resolved server-side and applied to the outgoing request. Your script never sees a token, and an auth header you set yourself cannot override the one Atomicwork injects.

- **Token refresh.** For OAuth-based connections, expired tokens are refreshed automatically before the call goes out. You don't need to handle token lifecycle in your code.

- **Destination safety.** Calls are restricted to the hosts that belong to the connected app. For apps with a per-tenant address — Okta, Workday, ServiceNow — calls are further restricted to your own instance. A request to any other host is rejected with a `403`.

## Example: Mute a Datadog monitor during maintenance

Here's a script that mutes a specific monitor and then confirms the mute was applied:

```javascript
// Mute the monitor for the maintenance window
await API.datadog.datadogCallApi({
  method: "POST",
  endpoint: `/api/v1/monitor/${input.monitorId}/mute`,
  body: {
    end: input.maintenanceEndTimestamp,
    scope: input.hostScope,
  },
});

// Confirm the monitor is now muted
const monitor = await API.datadog.datadogCallApi({
  method: "GET",
  endpoint: `/api/v1/monitor/${input.monitorId}`,
});

return {
  monitorId: input.monitorId,
  muted: monitor.body?.options?.silenced != null,
};
```

## Supported apps

Call API is enabled per app, not universally. Most major integrations have it — including Okta, Jira, Slack, Microsoft Graph, GitHub, Workday, ServiceNow, Cloudflare, Datadog, Rippling, Google Workspace, Azure AD, Notion, Linear, and Grafana — but the list grows as new integrations are added.

If the app you need isn't on the integrations page, or doesn't have a Call API method, use the [Make an HTTP request](/product/enterprise-workflows/actions-and-integrations/http-request-actions) action with a saved credential from the [credential store](/product/platform-administration/governance/managing-credentials) instead.

## When to use Call API vs Make an HTTP request

|                           | Call API (from code)                                                                  | Make an HTTP request                                                                                         |
| ------------------------- | ------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ |
| **Best for**              | Apps connected through the integrations page                                          | Systems not available as an integration                                                                      |
| **Authentication**        | Automatic — uses the connection's credentials                                         | Manual — you pick a saved credential or enter auth details                                                   |
| **Token refresh**         | Automatic                                                                             | You manage it                                                                                                |
| **Destination safety**    | Built in — both `endpoint` and `url` are validated against the app's registered hosts | You control the URL. Saved credentials with allowed-host restrictions are enforced server-side at execution. |
| **Where to use it**       | Inside an Execute Code action                                                         | As a standalone workflow action                                                                              |
| **Credential management** | None needed                                                                           | Save credentials in **Settings > Organization > Security > Credential store**                                |

## Troubleshoot common issues

| Error                                       | Why it happens                                                                                                                                 | What to do                                                                                                                                                                                                            |
| ------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **403 Forbidden**                           | The destination safety check rejected the request. The endpoint doesn't match the connected app's registered hosts.                            | Verify the endpoint belongs to the app's host. For per-tenant apps like Okta, confirm it matches your instance URL — calling `dev-12345.okta.com` when your connection is for `company.okta.com` will be rejected.    |
| **401 or 403 despite a working connection** | The integration connection has expired or been revoked, or the connection's OAuth scopes don't include the permissions this endpoint requires. | Go to **Settings > App store**, find the app, and reconnect it. Check the external app's API docs for the scopes or permissions the endpoint requires — you may need to reauthorize with additional scopes.           |
| **Method not found in the code editor**     | The app doesn't have Call API enabled.                                                                                                         | Type `Workflow.` and press **Cmd+I** to check. If the function isn't listed, use [Make an HTTP request](/product/enterprise-workflows/actions-and-integrations/http-request-actions) with a saved credential instead. |
| **429 Too Many Requests**                   | Your tenant has hit the platform's rate limits for request operations.                                                                         | Wait for the interval in the `Retry-After` header before retrying. See [Rate limits](/api-reference) in the API reference for details.                                                                                |

#### Learn more

- [Code actions](/product/enterprise-workflows/actions-and-integrations/code-actions) — setting up Execute Code actions, testing, and using AI Assist

- [HTTP request actions](/product/enterprise-workflows/actions-and-integrations/http-request-actions) — calling systems that aren't connected through the integrations page

- [Managing credentials](/product/platform-administration/governance/managing-credentials) — the credential store and public API tokens

- [Calling external systems](/guides/connecting-your-workflows-to-external-systems) — the complete guide to outbound integrations