Skip to content
QDNALearn AI
FR

Lesson 16 · Advanced · 15 min

Custom GPT Actions and APIs: OpenAPI Schemas and Webhooks

Connect custom GPTs to enterprise APIs: OpenAPI specs, JSON schemas, authentication methods, and triggering automated external workflows.

By QDNA · Published on · Updated on

Goal
You will interface a Custom GPT with an external API by authoring an OpenAPI specification and configuring API key or OAuth security.
Skills
Frame
Step-by-step screenshot of Custom GPT Actions: (1) OpenAPI schema editor, (2) secure auth settings, (3) testing external API call with HTTP 200 OK.
Illustration generated by AI
In brief.

Actions evolve conversational Custom GPTs into enterprise-connected agents. By documenting APIs using the OpenAPI 3.0 standard, you empower ChatGPT to query relational databases in real time, create helpdesk tickets, and send corporate notifications. Security depends upon hardened authentication protocols and mandatory human-in-the-loop confirmation gates.

  1. 1How OpenAPI Actions operate using JSON Schema specifications

    How OpenAPI Actions operate using JSON Schema specifications provides ChatGPT with programmatic hands to interact with external business services. When a user requests live operational data, the model reads the OpenAPI specification, identifies the correct path, constructs a JSON payload, and issues an HTTP request.

    Upon receiving the JSON response payload, ChatGPT isolates relevant attributes and returns an executive response in natural language. To ensure data safety, OpenAI mandates that users explicitly approve outgoing requests before external communication occurs.

    Schema Component Technical Function Concrete Example Common Failure Mode
    servers Base destination API URL https://api.company.com/v1 Omitting required secure https transport
    paths Specific target route /tickets/search Case mismatch or missing leading slash
    parameters Input variables passed to endpoint query, user_id, status Omitting explicit type designations
    responses Expected return JSON schema HTTP 200 payload definition Incomplete schema preventing response parsing
    Diagram of Custom GPT actions: user prompt, action call via OpenAPI schema, secure JSON request to external API, and final synthesized reply.Diagram of Custom GPT actions: user prompt, action call via OpenAPI schema, secure JSON request to external API, and final synthesized reply.
    Diagram of Custom GPT actionsDiagram generated by AI and reviewed

  2. 2Connecting a GPT to an internal IT helpdesk ticketing system

    Connecting a GPT to an internal IT helpdesk ticketing system allows staff to audit ticket resolutions directly without cluttering helpdesk staff channels.

    An employee asks: 'What is the current status of my laptop replacement request?'.

    Minimal OpenAPI 3.0 schema snippet (YAML).

    openapi: 3.0.0
info:
  title: Corporate Helpdesk API
  version: 1.0.0
servers:
  - url: https://support.novatech-sas.exemple.fr/api
paths:
  /tickets:
    get:
      operationId: findTicketsByEmail
      summary: Retrieve support tickets assigned to employee
      parameters:
        - name: email
          in: query
          required: true
          schema:
            type: string
      responses:
        '200':
          description: List of matching support tickets
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    id:
                      type: integer
                    status:
                      type: string
                    summary:
                      type: string

    What changes. The GPT queries the helpdesk service live, stating: 'Your ticket #1482 is currently marked in dispatch transit by IT logistics'.

  3. 3Author and test a simple data retrieval API Action schema

    Author and test a simple data retrieval API Action schema to learn the foundation of building functional bridges between LLMs and line-of-business platforms aligned with Model Context Protocol (MCP) standards.

    To practice safely without exposing internal production systems, here is an internal directory API specification (fictional company NovaTech Ltd):

    [Internal Directory API Specification - NovaTech Ltd (Sandbox Environment)]
GET https://directory.novatech-sas.exemple.fr/api/staff?name={name}
Sample JSON response:
[
  {"id": 412, "name": "Sophie Martin", "department": "Customer Experience & Operations", "email": "s.martin@exemple.fr", "office": "B-204"}
]

    The "Load exercise" button in the composer pre-fills the objective with the weak starting prompt:

    "Query the internal API to display open ticket status."

    From this starting point, complete the prompt with the composer to design the directory assistant. Define the role, specify the read-only OpenAPI endpoint (GET /staff), require targeted field extraction (name, department, office), and embed the foundational MCP security rule: all state-mutating actions (POST, DELETE) strictly require explicit human-in-the-loop authorization before execution.

    Paste your specification into the 'Actions' section of the GPT editor and click 'Test' in the preview pane.

    Self-evaluation rubric: (a) OpenAPI schema validates without syntax errors; (b) GET endpoint is recognized without destructive parameters; (c) the preview test executes cleanly against the mock endpoint.

    Open the prompt composer

  4. 4Exposing write endpoints without enforcing mandatory human confirmation

    Exposing write endpoints without enforcing mandatory human confirmation can trigger unintended database mutations or deletions in production.

    If you expose a DELETE endpoint to remove records, a misunderstood ambiguous prompt or model hallucination could irrevocably erase a strategic account.

    Correction: restrict autonomous actions to read-only queries (GET). For any data mutations (POST, DELETE), configure API middleware requiring explicit verification tokens or sandbox routing.

    Rule to remember: never grant automated destructive write permissions to an AI without mandatory human authorization gates in the loop.

  5. 5Quiz

    Three questions, instant feedback. Each option comes with an explanation.

    1. Which standard format is used to declare Actions in Custom GPTs?

    2. Why does ChatGPT prompt users with 'Always allow / Allow' before invoking an Action?

    3. Which HTTP methods are typically used for operations that create or modify remote data?

  6. 6Proof of mastery

    Draft a minimal OpenAPI 3.0 specification snippet for a status retrieval endpoint and document its integration role.

    Advanced badgeThis lesson counts towards the Advanced badgeSee the four badges

    Criteria

Going further

Review glossary definitions for api action and json schema. Advance to lesson 17: Chaining ChatGPT workflows and prompt pipelines. To inspect technical API payloads, explore OpenAI Playground and fine parameter tuning.

Frequently asked questions

What is an Action in a Custom GPT?

An Action enables ChatGPT to call external web APIs to retrieve live business data (GET) or trigger business transactions (POST, PUT, DELETE).

What format is required to define Custom GPT Actions?

OpenAI requires an OpenAPI 3.0 specification formatted in YAML or JSON, defining URLs, parameters, payloads, and response objects.

How do you secure access to internal company APIs?

Actions support API Key authentication (custom header or Bearer token) and OAuth 2.0 flows to authenticate individual user accounts securely.

Sources