Connections

A connection is one of your team’s own HTTPS APIs, such as your CRM, that research agents can call during a run. Sixtyfour keeps the key encrypted and adds it to each call, so agents never see it. A finding read from the API cites the connection by name.

Connections are enabled per organization. Contact support to turn them on.

Set it up

In the app, open Settings → Agents → Connections and choose Connect an API. Only the base URL and the key are required. Every member can see the team’s connections. Team owners add, change and delete them, and on the default team, organization admins and owners do. Through the API, use an API key for the team:

Request	What it does
`GET /connections`	List the team’s connections, and whether you can change them.
`GET /connections/{name}`	Read one connection.
`PUT /connections/{name}`	Create a connection, or replace its settings. The name can’t change later. Leave out `secret` to keep the saved one.
`DELETE /connections/{name}`	Delete a connection.

Each request may name its team with team_id, in a PUT body or as a query parameter otherwise. A request for a team other than the key’s is refused.

curl -X PUT "https://api.sixtyfour.ai/connections/crm" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"base_url": "https://api.crm.example.com/v2", "secret": "YOUR_READ_ONLY_KEY"}'

The response is the saved connection. The secret never comes back, only its last four characters.

{
  "id": "6f1d3c2a-8b4e-4f7a-9c1d-2e3f4a5b6c7d",
  "name": "crm",
  "description": "",
  "base_url": "https://api.crm.example.com/v2",
  "sign_in": { "type": "bearer", "name": null },
  "allowed_requests": null,
  "secret_last4": "_KEY",
  "created_at": "2026-11-03T18:04:11.512304Z",
  "updated_at": "2026-11-03T18:04:11.512304Z",
  "created": true
}

Field	Description
`base_url`	Required. An `https://` URL on a public host, optionally with a path. Calls go only under it.
`secret`	Required to create. The key, token or password. Reads show only its last four characters.
`description`	Optional. One line on what the API is for, which agents read to decide when to call it.
`sign_in`	Optional. How the key is sent, below. A Bearer token by default.
`username`	For `basic` sign-in only.
`allowed_requests`	Optional. The requests agents may make, such as `"POST /search"`. Left out, the connection is read-only: `GET` and `HEAD` anywhere under the base URL. An empty list is refused.
`create_only`	Optional. `true` refuses the request if the team already has a connection with this name.

`sign_in`	Each call sends
`{"type": "bearer"}`	`Authorization: Bearer <secret>`
`{"type": "header", "name": "X-Api-Key"}`	`X-Api-Key: <secret>`
`{"type": "query", "name": "api_key"}`	`?api_key=<secret>` on each call’s URL
`{"type": "basic"}`	HTTP Basic, with `username` and the secret as the password

Use it in a run

Runs on xhigh, on scout with graph: true, and on high when enabled for your organization can call every connection the team has. To choose which, send connections on POST /people-intelligence-async. Leave it out for all of them, or send [] for none.

curl -X POST "https://api.sixtyfour.ai/people-intelligence-async" \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"lead_info": {"name": "Jane Doe", "company": "Acme"}, "tier": "xhigh", "connections": ["crm"]}'

A finding read from a connection cites it by name, and the result lists the cited connections in connected_sources, each with its connection and connection_id. Atlas and the report show the source as “crm, your connection”. The MCP server’s sixtyfour_atlas_start takes the same connections. The Atlas API’s start and continue endpoints don’t.

Security

The key never reaches agents. Sixtyfour adds it to each call and removes it from each answer before agents read it.
Calls go only under the base URL and make only the requests you allow. They follow no redirects, and agents can’t override the connection’s credential.
Use a read-only key if your API offers one. A path that both reads and writes, such as POST /graphql, needs one. Never allow a login, token or key-management path.
Sixtyfour removes the key wherever it recognizes it, but anything else your API returns, such as a new token made from the key, reaches agents as sent.

Limits

	Limit
Connections per team	10
Name	Lowercase letters, digits and hyphens, up to 63 characters, starting and ending with a letter or digit
Description	200 characters
Secret	8 to 4,096 printable ASCII characters; a Basic password may be any one line
Allowed requests	5, each `GET`, `HEAD` or `POST` and a path of up to 100 characters

Requests to /connections share one rate limit.

Good to know

Changing the host, the sign-in type, or the header or parameter name needs the secret again, so a saved key never goes somewhere it wasn’t given for. A Basic username changes only together with the password. If someone replaces the secret during an edit that keeps it, retry the edit or enter the secret again.
A path matches whole segments: /people allows /people/7, not /peoples.
For a scheme like Authorization: Token abc, use a header sign-in named Authorization and paste Token abc as the secret.
Runs already going use a connection’s saved settings from their next call, including a new key, host or requests. A deleted connection is refused there.
A run that names an unknown connection is refused before it starts or is charged, with the team’s connections listed.
An API key acts with its creator’s current role in the team. See Roles and permissions.

Errors

For error responses (400, 403, etc.), see Handling Errors.

Get Started

Intelligence API

Atlas

Lattice

Search API

Workflows API

Monitors API

Webhooks

Developer Tools

Set it up

Use it in a run

Security

Limits

Good to know

Errors

​Set it up

​Use it in a run

​Security

​Limits

​Good to know

​Errors

Set it up

Use it in a run

Security

Limits

Good to know

Errors