Issue Summary Regardless of whether I save a secret token for a tool (function) via the UI or create an additional tool with a secret via the API, the secret is not being stored. After reloading the UI (F5), the secret field is empty. When retrieving the tool using the API (

GET TOOL

), the secret is also missing. Steps to Reproduce 1. Save a secret token for a tool (function) via the UI. 2. Reload the UI (F5) and check the secret field. 3. Create a tool (function) via the API, including a secret token. 4. Retrieve the tool using the API (

GET TOOL

). 5. Observe that the secret is missing in both the UI and API response. Expected Behavior - The secret token should persist after saving and reloading the UI. - The API should return the secret when retrieving the tool. Actual Behavior - The secret token disappears after reloading the UI. - The API response does not include the secret. - The issue also occurs when creating a tool (function) with a secret via the API. Impact This issue prevents me from using Vapi, as our telephone bot relies on three custom tool-functions that communicate with our server via

POST

requests. Due to the missing secret, errors are constantly thrown, making it impossible to proceed. We switched from ElevenLabs to Vapi under the assumption that it was the leading solution, but this issue has been extremely frustrating and a major blocker. Request Please investigate and resolve this issue as soon as possible, as it is preventing us from integrating Vapi into our workflow.

Hey can you send me a call_id?

no problem, even if the problem has more to do with the tools, here is a CallID: “13305230-f35a-4821-8e83-2cd013266fd0”

Hey, we will be having an Office Hour in 20 minutes. Can you hop in and get your query resolved during it?

Hey sorry, I wasn't working anymore. We have a lot of appointments, it's difficult to find a timeslot spontaneously. Could we maybe do it by text chat?

@crea_team I just looked into the call log, and yes we are sending secret along with the tool call. I need your confirmation for the following values whether they are correct or not?

json
      "url": "https://dev.----/ride-request/",
        "secret": "JKKA-------wUI1",
        "timeoutSeconds": 30
      },

Here

----

means hidden data.

Hmm yes, both ist correct @Shubham Bajaj

Hey crea_team, as I have mentioned we are sending the secret to your server url can you please check your in server logs once, you will find out secret field was sent under server property.

@Shubham Bajaj @User @User Okay, we got it right. Thanks for the help. The secret is sent correctly. The body is the problem. We have set up extended debugging with the dev and have now found the problem: What VAPI sends to the server via the tool is so much more data that we don't actually need. The tool is set up so that we only want to pass the key “pickup” with the appropriate string (in this case the street). In the end, the request should look like this:

{ pickup: "Randomstreet 123, Berlin"}

But instead we get a message object sent via the tool with lots of information that we don't need and for which the tool was not set up. This message object then contains the correct key including the string. But we can't rewrite the whole API so that it works with the VAPI tools in the end. With 11labs, only what I have previously set is output, i.e.

{ pickup: "Randomstreet 123, Berlin"}

- and not that:

{
   "message":{
      "timestamp":1739365818467,
      "type":"tool-calls",
      "toolCalls":[
         {
            "id":"call_6X6O2gYDQE79WuNNuqcJIJU7",
            "type":"function",
            "function":{
               "name":"adress_validation",
               "arguments":{
                  "pickup":"Friedhofstraße 1a, Osnabrück"
               }
            }
         }
      ],
      "toolCallList":[
         {
            "id":"call_6X6O2gYDQE79WuNNuqcJIJU7",
            "type":"function",
            "function":{
               "name":"adress_validation",
               "arguments":{
                  "pickup":"Friedhofstraße 1a, Osnabrück"
               }
            }
         }
      ],
      "toolWithToolCallList":[
         {
            "type":"function",
            "function":{
               "name":"adress_validation",
               "async":false,
MORE CODE....

So the question is, how can we make sure that the tools only send what I have actually set beforehand?

Hey Crea_team, as of know we don't have the feature to pick the tool properties so you will need to write a transformer function to transform vapi payload into your required format.

@Shubham Bajaj @User @User okay, is it possible to map this directly within VAPI, or do we need to implement an extra function on our own server to transform the payload?

You have to implement an extra function on your own server to transform the payload.