Part 4: Govern the Agent's Tools with API Management

An agent that writes into customer master data cannot be a black box. Before you build the agent, you set up the governed surface it will use. In this part you'll register an application against the Customer360 MA Mock API in Boomi's API Control Plane, retrieve your MCP credentials, and review the eight tools the API exposes. Those eight tools are what your agent will reason over in Part 5.

The Customer360 MA Mock API is already deployed and registered in the platform as a Model Context Protocol (MCP) tool surface, so the eight operations are visible to Agentstudio out of the box — no per-tool configuration needed.

In this part, you will:

• Register an application in the Agentic Academy API Portal (this is the canonical Boomi pattern for governed API consumption — every customer agent that calls a Control Plane API does this).
• Subscribe to the Customer360 MA Mock API product and copy your AI Agent Key + MCP Address.
• Locate the MCP-registered tool source in Agentstudio so you know exactly which tools you'll attach in Part 5.

Get Access to the Customer360 MA Mock API

Register an application against the Customer360 MA Mock API product. This gets you an AI Agent Key and an MCP Address — the same governance pattern any production Boomi agent uses when it calls an MCP-exposed Control Plane API.

1. Navigate to the Agentic Academy API Portal: https://aiplatformcoe-l6qlay.portal.na.controlplane.boomi.com/academy.

2. In the left navigation, click API Products.

3. Click the Customer360 MA Mock API product card.

4. On the Customer360 MA Mock API overview page, click Get Access.

   The Create Account dialog opens with First Name, Last Name, and Email fields, plus a Login button on the bottom-right.

   • If you don't have a Boomi account, fill in First Name, Last Name, and Email, then click Create Account.
   • If you already have a Boomi account, click Login and sign in via Boomi SSO.

5. Once logged in, you'll return to the Customer360 MA Mock API product page. The left navigation now includes Applications and Users entries, and your name appears at the bottom-left.

Create an Application

Applications are how the API Control Plane scopes credentials and traffic to a specific consumer — every agent in production gets its own application.

1. In the left navigation, click Applications.

2. Click Create New Application.

3. In the Display Name field, enter: [builderInitials] Customer360 MA Analyst

4. Leave the Active toggle ON. Description can be left blank.

5. Click Create New Application to save.

Subscribe to the Customer360 MA Mock API

With your application created, subscribe it to the Customer360 MA Mock API product so it inherits the product's plan, quota, and credentials.

1. In the left navigation, click API Products.

2. Click the Customer360 MA Mock API card.

3. In the product's left sub-navigation, click Plans.

4. On the Academy plan card, click Subscribe!.

5. A New Subscription dialog appears with Step 1 of 2. Walk through the wizard — select your [builderInitials] Customer360 MA Analyst application when prompted — and click Next through to the end to confirm.

   A green toast — "Subscription for Customer360 MA Mock API deployed!" — confirms the subscription is active.

Retrieve Your MCP Credentials

The subscription you just created carries the MCP credentials your tools will use at invocation time.

1. In the left navigation, click Applications.

2. Click your [builderInitials] Customer360 MA Analyst application.

3. In the application's left sub-navigation, click Subscriptions.

   You should see the Customer360 MA Mock API subscription listed with a green Enabled badge and two action buttons: Secrets and Unsubscribe.

4. Click Secrets.

   The Secrets to Access Locations dialog opens.

5. Under MCP Credentials, save both values somewhere accessible:

   • AI Agent Key — the secret your agent passes when calling the MCP bridge.
   • MCP Address — the bridge URL Agentstudio dials into. It has the form https://aiplatformcoe-l6qlay.mcp-bridge.na.controlplane.boomi.com/mcp?name=Customer360MAMockAPI-UsagePlan. Note the mcp-bridge subdomain and ?name= query param — that's how you can tell at a glance this is an MCP endpoint, not a plain REST one.
   Keep secret values out of your work

   Your AI Agent Key is an account-specific secret. Save it for your own use, but do not paste a real key value into the shared MCP source, a screenshot, or this guide.

   Why governance matters here

   Even though this workshop wires the tools through Boomi's MCP bridge for you, the application + subscription you just created is the same control point every production agent flows through:

   • One identity per consumer. Each agent — or each team running an agent — gets its own application, AI Agent Key, and MCP Address. When something misbehaves, you can revoke or rotate at the application level without touching the API itself.
   • Per-product subscriptions and plans. Access is granted by product, with rate limits, quotas, and SLAs attached to the plan. Agents inherit those guardrails automatically.
   • Auditable usage. Every call carries the application's key, so traffic, errors, and cost can be attributed back to a specific agent or team in the Control Plane.
   • One step to MCP. Flipping the Expose as Tool switch on the API product registered all eight operations as MCP-compliant tools in this tenant — no per-tool wiring, no duplicate auth config. That's why the credentials you just retrieved are under MCP Credentials rather than a generic API key + base URL — the same governance you already apply to your REST APIs now applies to your agent tool surface.

   This is the production pattern: APIs governed in the Control Plane, agents consuming them through MCP, with a single audit trail tying the two together.

Access Agentstudio

Now you'll switch to Agentstudio, where the MCP-exposed tool surface is already wired up.

1. Login to the Boomi Platform: https://platform.boomi.com.

2. Navigate to Agentstudio by selecting the Agentstudio icon in the top right corner.

   note

   This will open Agentstudio in a new window. Make sure pop-ups are enabled in your browser.

Review the Pre-Built MCP Tool Source

We've already done this part for you

The workshop team has pre-registered the Customer360 MA Mock API as an MCP tool source in this tenant, called Customer360 MA Mock API. We did this once, ahead of the workshop, by flipping the API Control Plane's Expose as Tool switch on the product — the platform read its OpenAPI schema and auto-registered all eight operations as MCP-compliant tools. Every workshop participant shares this one tool source.

You don't need to create your own — and you shouldn't, because the source carries a tenant-level MCP-bridge credential that wouldn't be configured correctly if you cloned it. In a real engagement you'd build this once per environment using the same Expose-as-Tool flow; for the workshop, it's ready to use.

This section just walks you through finding it in Agentstudio so the tool names look familiar when you attach them to your agent in Part 5.

1. In Agentstudio, click Tool Sources in the left navigation.

2. Find the Customer360 MA Mock API entry in the source list.

3. Open the source by clicking its name. Confirm the transport is HTTP, the status is ACTIVE, and the Imported Tools tab shows eight tools:

   Tool name	HTTP method	Path
   customer360mamockapi--..._GET--read-artifact	GET	/read-artifact
   customer360mamockapi--..._GET--extract-entity	GET	/extract-entity
   customer360mamockapi--..._GET--extract-hierarchy	GET	/extract-hierarchy
   customer360mamockapi--..._GET--extract-commercial	GET	/extract-commercial
   customer360mamockapi--..._GET--lookup-golden	GET	/lookup-golden
   customer360mamockapi--..._GET--enrich-firmographics	GET	/enrich-firmographics
   customer360mamockapi--..._POST--publish-candidate-to-datahub	POST	/publish-candidate-to-datahub
   customer360mamockapi--..._POST--open-steward-exception	POST	/open-steward-exception

   MCP tool naming

   MCP tool names are auto-generated from the source name + API ID + operation. The prefix (customer360mamockapi--...) tells you which source they came from; the suffix tells you the HTTP method and path. You don't need to memorize the full name — Part 5's build prompt matches on the operation name (read-artifact, extract-entity, etc.).

   Query-param GETs and the OpenAPI-tool fallback

   The six read endpoints take artifact_id as a query parameter, and the MCP bridge does not forward query strings. Because the mock returns the full keyed dataset regardless, the GETs still work — the agent selects the right record by artifact_id in its reasoning (this is why the Part 5 task instructions tell it to select, not assume). If you ever need the query parameter to actually reach the gateway, register those GETs as OpenAPI tools instead of relying on the bridge's parameter mapping; the API's openapi.yaml is the spec to import.

4. Do not edit the source. The headers (including the x-api-key slot the MCP bridge fills at invocation time) are already configured, and changes here would break the tool surface for every participant in the room.

   Trial-account builders: create the source yourself

   If you are reproducing this lab in your own trial (see the appendix), the shared source is not in your tenant. After you register and subscribe, create your own MCP source in Agentstudio → Tool Sources, named [builderInitials] Customer360 MA Mock API, with HTTP transport, pointed at your MCP Address, with the x-agent-key set to your AI Agent Key and the x-api-key declared as a sensitive header with no static value. Confirm it goes ACTIVE with all eight tools imported.

What You've Built

You haven't built tools — the workshop did that ahead of time, exposed via Boomi's MCP tool surface. What you HAVE done:

• Registered an application in API Control Plane against the Customer360 MA Mock API product. Every agent that calls a Boomi Control Plane API does this — it's how API consumption is governed, metered, and traced in production.
• Retrieved an AI Agent Key and MCP Address scoped to your application's subscription. In a production agent these would land in the agent's credential store; for this workshop they flow through the MCP bridge automatically.
• Located the MCP-exposed tool surface in Agentstudio. You now know exactly which eight tool names you'll attach to agent tasks in Part 5.

The eight tools represent the capabilities of the Unstructured Onboarding Analyst — six read/reason operations and two governed writes:

• Read Artifact (/read-artifact) — pull the raw unstructured artifact (contract, CRM note, or support ticket) for a BetaCorp account.
• Extract Entity (/extract-entity) — extract the true legal name, aliases, country, tax id, and contact — including a parent and subsidiary from one document.
• Extract Hierarchy (/extract-hierarchy) — extract parent/subsidiary lineage the structured fields never carried.
• Extract Commercial (/extract-commercial) — extract contract value, payment terms, renewal date, and products.
• Lookup Golden (/lookup-golden) — read-only context on whether Acme already has this entity — never a match decision.
• Enrich Firmographics (/enrich-firmographics) — optionally corroborate identity with mock external firmographics.
• Publish Candidate to DataHub (/publish-candidate-to-datahub) — write the extracted candidate into the DataHub AGENT_CANDIDATE source for deterministic matching.
• Open Steward Exception (/open-steward-exception) — hand an ambiguous or low-confidence identity to a human steward instead of guessing.

In Part 5, you'll bring these tools to life by attaching them to the guardrailed agent that reads what DataHub structurally cannot!