1# Tool — OpenAPI
2 
3Expose a REST API to the agent by attaching its OpenAPI 3.x spec. The platform parses the spec and synthesizes one tool per operation.
4 
5## Toolbox shape (anonymous)
6 
7```json
8{
9  "type": "openapi",
10  "openapi": {
11    "spec": { /* inlined OpenAPI 3.x document */ },
12    "auth": { "type": "anonymous" }
13  }
14}
15```
16 
17## `auth.type` values
18 
19- **`anonymous`** — no credentials sent.
20- **`connection`** with `project_connection_id` — Foundry attaches a static API key (or OAuth tokens) from the named project connection. **`project_connection_id` is required only here.**
21- **`managed_identity`** with `audience` — the project's managed identity calls the target API. **No `project_connection_id` is required**; Foundry uses the project MI and acquires a token for the supplied `audience` (the target service's resource URI). You must grant the project MI the appropriate RBAC role on the target service or the agent receives `401 Unauthorized`.
22 
23## Multi-entry rules
24 
25Multiple `openapi` entries are allowed in one toolbox **only if** each entry's spec defines a distinct `info.title` (the title is the implicit identifier). See [toolbox-reference.md § Multi-Tool Toolbox Constraint](toolbox-reference.md#multi-tool-toolbox-constraint).
26 
27## References
28 
29- [OpenAPI tool documentation](https://learn.microsoft.com/azure/foundry/agents/how-to/tools/openapi)
30- [agent-tools.md](agent-tools.md) — tool index
31- [foundry-tool-catalog.md](foundry-tool-catalog.md) — project connections for the `connection` auth path
32