Connect Agiloft to AI Agents: Automate Table Data and File Workflows

You want to connect Agiloft to an AI agent so your system can independently manage contracts, lock records for editing, execute complex action buttons, and attach compliance files based on conversational context. Here is exactly how to do it using Truto's /tools endpoint and SDK, bypassing the need to build and maintain a custom Agiloft REST connector from scratch.

Giving a Large Language Model (LLM) read and write access to your Agiloft Knowledgebase (KB) is a massive engineering undertaking. Agiloft is not a simple, flat REST API - it is a highly configurable, schema-heavy enterprise platform. You either spend months building, hosting, and maintaining a custom connector, or you use a managed infrastructure layer that handles the boilerplate for you. If your team uses ChatGPT, check out our guide on connecting Agiloft to ChatGPT, or if you are building on Anthropic's models, read our guide on connecting Agiloft to Claude. For developers building custom autonomous workflows, you need a programmatic way to fetch these tools and bind them to your agent framework.

This guide breaks down exactly how to fetch AI-ready tools for Agiloft, bind them natively to an LLM using frameworks like LangChain, LangGraph, CrewAI, or the Vercel AI SDK, and execute complex enterprise workflows. For a broader look at the architecture behind this approach, refer to our research on architecting AI agents and the SaaS integration bottleneck.

The Engineering Reality of the Agiloft API

Giving an LLM access to external data sounds simple in a prototype. You write a Node.js function that makes a fetch request and wrap it in an @tool decorator. In production against complex enterprise systems like Agiloft, this approach collapses.

Agiloft's API introduces several specific integration challenges that break standard REST assumptions. If you hardcode these interactions into your agent, you will spend your sprints writing defensive integration code instead of improving your model's reasoning.

Dynamic Choice-Line IDs vs. Static Labels

In most SaaS APIs, updating a status field is as simple as passing a string: {"status": "Active"}. Agiloft operates differently. To update a choice-list value, you cannot reliably pass the text label, because internal IDs change when a Knowledgebase (KB) is copied, promoted from sandbox to production, or when choice lists are recreated.

Your system must execute a runtime lookup (using EWGetChoiceLineId) to fetch the internal ID of a choice-list value before using it in SQL where clauses (via EWSelect) or update operations. If you expose this raw requirement to an LLM, the model will constantly hallucinate the workflow, attempting to pass raw strings and crashing the API request.

Pessimistic Record Locking

Agiloft enforces strict data integrity through explicit pessimistic locking (EWLock). Unlike standard REST APIs that rely on last-write-wins or optimistic concurrency (ETags), Agiloft requires a client to explicitly lock a record before performing multi-step edits, and explicitly unlock it when finished. If your AI agent decides to read a contract, analyze it, and update five fields, it must acquire a lock for the connected user. If another user holds the lock, the API rejects the write. Managing lock state, lock expiration times (governed by the KB's lock_expiration_time variable), and force-unlocks pushes state-management complexity directly into your agent's prompt if not abstracted properly.

Asynchronous Action Buttons

Agiloft allows administrators to configure highly complex "Action Buttons" on records, which might trigger emails, generate PDFs, or fire webhooks. Triggering these via the API (EWActionButton) is strictly asynchronous. The API does not wait for the action to complete; it immediately returns a callback ID. To know if the PDF was generated, the client must poll the EWAsyncStatus endpoint, handling states like 201 (queued), 202 (in progress), and 501 (failed). Teaching an LLM to reliably implement an asynchronous polling loop via raw API requests is notoriously difficult and prone to context exhaustion.

Why a Unified Tool Layer Matters for Agent Safety

Before writing a line of integration code, decide what layer your agent talks to. This choice determines how safe your production system will be.

Direct API tools (one tool per raw Agiloft endpoint) look convenient but they push provider quirks into the LLM's context. The model has to remember that choice lines need runtime lookups, that locking requires a separate PUT request, and that action buttons require polling. Every one of those quirks is a hallucination waiting to happen.

By leveraging Truto's Proxy API and /tools endpoint, you collapse these complexities behind a standardized tool schema. Your agent sees agiloft_choice_lines_lookup_id, agiloft_record_locks_lock, and agiloft_action_buttons_execute with strict JSON schemas. That gives you concrete safety wins:

1. Deterministic input validation. Every tool has a strict JSON schema. Invalid arguments are rejected before they hit Agiloft, meaning a broken tool call fails fast instead of creating corrupt data.
2. Explicit rate limit transparency. Truto does not retry, throttle, or apply backoff on rate limit errors. When the upstream Agiloft API returns an HTTP 429, Truto passes that error directly to the caller. Truto normalizes the upstream rate limit info into standardized headers (ratelimit-limit, ratelimit-remaining, ratelimit-reset) per the IETF spec. The caller (your agent framework) remains responsible for intelligent retry and backoff, ensuring your LLM knows exactly when to pause.
3. Smaller attack surface. The LLM only ever chooses from stable function names with typed parameters, drastically reducing the chance of inventing non-existent SQL fragments or API endpoints.

High-Leverage Agiloft Tools for AI Agents

Instead of overwhelming the LLM with 50 different endpoints, you provide a curated set of high-leverage tools. Truto automatically generates these tools from the underlying Integration schemas.

Here are the hero tools you should bind to your agent when integrating with Agiloft.

Natural Language Record Search (agiloft_records_search)

Instead of forcing the LLM to construct complex SQL WHERE clauses, this tool leverages Agiloft's native NLP search capabilities (EWNLPSearch). It translates natural language directly into search results against tables configured for chat search.

"Find all active NDAs submitted in the last 30 days that are pending legal review."

Pessimistic Record Locking (agiloft_record_locks_lock)

Before an agent makes changes to a high-value record (like a contract or SLA), it must acquire a lock (EWLock PUT). This prevents human users or other automated processes from overwriting the agent's work while the LLM is "thinking" between steps.

"I need to update the commercial terms on contract record 8492. Lock the record first so no one else edits it while I process the changes."

Safe Record Upsert (create_a_agiloft_record_upsert)

This tool (EWUpsert) prevents duplicate record creation. The agent provides a match_query. If no record matches, it creates one. If exactly one matches, it updates it. If multiple match, it fails safely with a 409 Conflict, alerting the agent to refine its query.

"Update the vendor profile for 'Acme Corp'. If a profile doesn't exist, create a new one with the status set to Onboarding."

Execute Action Buttons (agiloft_action_buttons_execute)

Agiloft workflows are often hidden behind action buttons (e.g., "Approve and Send Contract"). This tool (EWActionButton) allows the agent to press those virtual buttons asynchronously.

"The compliance review is complete. Trigger the 'Generate PDF and Email Client' action button on record 1042."

Async Operation Polling (agiloft_async_operations_lookup)

Because action buttons are asynchronous, the agent uses this tool (EWAsyncStatus) to poll the callback ID returned by the previous step, checking if the operation is queued (201), in progress (202), or completed (200).

"Check the status of callback ID 99382 to see if the PDF generation we just triggered has finished."

Upload Attachments (create_a_agiloft_attachment)

Contracts and IT tickets run on files. This tool (EWAttach) allows the agent to programmatically upload a generated file (like a summarized brief or an updated addendum) directly into a specific file field on a record.

"Upload this summarized risk analysis document to the 'Risk Assessments' file field on vendor record 5521."

For a complete list of available Agiloft tools, including schema definitions and authentication handling, view the full inventory on the Agiloft integration page.

Workflows in Action

Connecting these tools transforms your agent from a read-only chatbot into an autonomous enterprise operator. Here is how specific personas utilize these connected tools.

Scenario 1: Legal Ops Contract Remediation

A legal operations manager wants the AI to review a vendor contract, update the metadata in Agiloft, and trigger the approval workflow.

"Find the contract for 'GlobalTech', update the risk tier to 'High', and trigger the legal review workflow."

Agent Execution Trace:

1. agiloft_records_search: Searches for "Contract for GlobalTech" to retrieve the exact record ID.
2. agiloft_record_locks_lock: Secures a lock on the record ID to prevent human interference.
3. update_a_agiloft_record_by_id: Patches the risk_tier field to "High".
4. agiloft_record_locks_unlock: Releases the lock.
5. agiloft_action_buttons_execute: Triggers the "Start Legal Review" action button on the record.
6. agiloft_async_operations_lookup: Polls the callback ID until it returns 200 (Completed), then informs the user.

Scenario 2: Automated IT Asset Offboarding

An IT administrator needs to offboard an employee, which requires logging their assets, attaching an access log, and updating their status.

"Offboard John Doe. Mark his laptop as returned, attach the system access log I just generated, and update his profile status."

Agent Execution Trace:

1. agiloft_records_search: Locates John Doe's employee record and linked asset records.
2. create_a_agiloft_record_upsert: Upserts the laptop asset record to change its state to "Inventory - Returned".
3. create_a_agiloft_attachment: Takes the access log provided in context and PUTs it into the offboarding_documents file field on the employee record.
4. update_a_agiloft_record_by_id: Sets the employee record status to "Offboarded".

Building Multi-Step Workflows

To build these workflows in code, you must fetch the tool definitions from Truto and bind them to your LLM. Truto exposes all methods on the underlying integration as standardized JSON schemas via the /tools endpoint.

You can use Truto's SDKs to automatically convert these into native tool formats for LangChain, Vercel AI SDK, or CrewAI.

The Architecture

Here is what the execution loop looks like when your agent encounters an Agiloft task:

sequenceDiagram
    participant App as Your App
    participant Agent as AI Agent (LangChain)
    participant Truto as Truto API
    participant Agiloft as Agiloft API

    App->>Truto: GET /integrated-account/{id}/tools
    Truto-->>App: Return JSON schemas for Agiloft tools
    App->>Agent: .bindTools(agiloftTools)
    
    Note over Agent: User asks: "Lock record 1234"
    Agent->>App: Tool Call: agiloft_record_locks_lock
    App->>Truto: Execute tool via Proxy API
    Truto->>Agiloft: PUT /EWLock
    Agiloft-->>Truto: 200 OK
    Truto-->>App: Normalized success response
    App->>Agent: Tool Result: Lock acquired
    Agent-->>App: Final natural language response

Code Example: Binding Tools in LangChain.js

Using the truto-langchainjs-toolset, you can initialize the tools for a specific connected Agiloft account and bind them to an OpenAI or Anthropic model.

import { ChatOpenAI } from "@langchain/openai";
import { AgentExecutor, createToolCallingAgent } from "langchain/agents";
import { ChatPromptTemplate } from "@langchain/core/prompts";
import { TrutoToolManager } from "@trutohq/truto-langchainjs-toolset";
 
async function runAgiloftAgent(userPrompt: string) {
  // 1. Initialize the Truto Tool Manager with your tenant access token
  const toolManager = new TrutoToolManager({
    accessToken: process.env.TRUTO অ্যাক্সেস_TOKEN!,
  });
 
  // 2. Fetch all tools for the specific Agiloft connected account
  // This hits the GET /integrated-account/<id>/tools endpoint
  const agiloftTools = await toolManager.getTools("agiloft_integrated_account_id");
 
  // 3. Initialize the LLM and bind the tools
  const llm = new ChatOpenAI({ 
    modelName: "gpt-4o",
    temperature: 0 
  });
  
  const prompt = ChatPromptTemplate.fromMessages([
    ["system", "You are a helpful enterprise operations assistant. You manage records, locks, and files in Agiloft. Always lock records before updating them."],
    ["human", "{input}"],
    ["placeholder", "{agent_scratchpad}"],
  ]);
 
  // 4. Create the agent and executor
  const agent = createToolCallingAgent({
    llm,
    tools: agiloftTools,
    prompt,
  });
 
  const agentExecutor = new AgentExecutor({
    agent,
    tools: agiloftTools,
    // Ensure your framework handles rate limits effectively.
    // Truto passes HTTP 429s directly from Agiloft.
    maxIterations: 10,
  });
 
  // 5. Execute the workflow
  try {
    const result = await agentExecutor.invoke({
      input: userPrompt,
    });
    console.log(result.output);
  } catch (error) {
    // Handle HTTP 429 Rate Limits from Agiloft
    if (error.response?.status === 429) {
      const resetTime = error.response.headers['ratelimit-reset'];
      console.error(`Rate limited by Agiloft. Backoff until ${resetTime}`);
      // Implement your custom backoff/retry logic here
    } else {
      console.error("Agent execution failed:", error);
    }
  }
}
 
// Run a multi-step workflow
runAgiloftAgent(
  "Find the NDA for 'Initech', lock the record, update the status to 'Approved', unlock it, and trigger the notification action button."
);

Handling Rate Limits

Enterprise platforms enforce rate limits, and LLMs can easily trigger them by operating at machine speed. As noted in the code block above, Truto does not silently retry or absorb rate limits on your behalf. When the Agiloft API returns an HTTP 429 error, Truto passes that 429 straight back to your application.

Truto normalizes the upstream headers into standard IETF formats (ratelimit-limit, ratelimit-remaining, ratelimit-reset). It is your responsibility to catch these errors in your agent's execution loop, read the reset header, and apply the appropriate sleep or backoff logic before allowing the agent to resume. This prevents your LLM from endlessly hallucinating retries and burning tokens.

Moving Past the Boilerplate

Connecting AI agents to Agiloft requires traversing dynamic field IDs, pessimistic locking protocols, and asynchronous action polling. If you build this manually, your engineering team will spend weeks maintaining API schemas instead of improving agent reasoning.

By routing your agents through a standardized, managed tool layer, you remove the boilerplate. Your LLM interacts with clean, predictable tools, protected by strict JSON validation. This architecture allows you to deploy autonomous, multi-step enterprise workflows safely and reliably.