Custom GPT API for Business Data and RAG Applications 2026

A configured OpenAI GPT is designed to run inside ChatGPT; it is not a reusable API endpoint for an external application. GPT Actions let that GPT call an external REST API, while developers building their own website, SaaS product, or internal tool generally use OpenAI’s developer API. CustomGPT.ai provides a separate managed RAG API for applications that need business-content ingestion, source-grounded answers, citations, agent management, and production deployment controls.

Choose the right API path

• Use an OpenAI GPT when users will interact with the assistant inside ChatGPT.
• Use GPT Actions when a GPT inside ChatGPT must call your external service.
• Use the OpenAI developer API when you are building a separate application directly on OpenAI models and tools.
• Use the CustomGPT.ai RAG API when your application needs managed business-content ingestion, retrieval, source citations, agent and conversation management, analytics, integrations, and deployment controls.
• Build a custom RAG stack when the retrieval architecture itself is proprietary or requires infrastructure and deployment controls a managed platform does not support.

Primary CTA: Get a CustomGPT.ai API key
Secondary CTA: Open the API quickstart
Developer CTA: Explore the Developer Starter Kit

For source-grounded customer support, enterprise search applications, SaaS copilots, internal knowledge tools, and document-based applications.

Table of contents

1. Is there an API for an OpenAI custom GPT?
2. Custom GPT API, GPT Actions, or OpenAI API?
3. What is the CustomGPT.ai RAG API?
4. CustomGPT.ai API quickstart
5. Complete code examples
6. Authentication and API-key security
7. Endpoint overview
8. Error handling
9. Rate limits, usage, and scaling
10. Streaming responses
11. Conversation management
12. Citations and source verification
13. Data ingestion and refresh
14. Connecting a custom API to an agent
15. Platform comparisons
16. Developer Starter Kit
17. Production architecture
18. API use cases
19. Security and enterprise controls
20. Pricing and cost factors
21. Performance and testing
22. Production proof
23. Common implementation mistakes
24. Frequently asked questions

Is There an API for an OpenAI Custom GPT?

There is no general endpoint that turns a GPT configured in ChatGPT into a reusable external API. OpenAI describes GPTs as purpose-specific versions of ChatGPT that are built and used inside ChatGPT. OpenAI also states that GPTs are not the mechanism for embedding an assistant in an external website or application; developers should use the OpenAI API for that pattern. OpenAI GPTs FAQ

A GPT can still communicate with another system through a GPT Action. In that direction, the GPT is the API client: it uses an OpenAPI schema and configured authentication to call an external service. The GPT itself is not thereby exposed as a public endpoint. OpenAI GPT Actions configuration

The phrase “custom GPT API” is therefore ambiguous. It may refer to a GPT running inside ChatGPT, a GPT Action, OpenAI’s developer API, a managed RAG API such as CustomGPT.ai, or a ground-up retrieval stack.

Technology	Runs where?	API role	Best fit
OpenAI GPT	Inside ChatGPT	Uses ChatGPT capabilities; may call approved external services through Actions	A tailored assistant for ChatGPT users
GPT Action	Inside a GPT in ChatGPT	Lets the GPT call an external REST API described by an OpenAPI schema	Retrieving data or triggering workflows from a GPT
OpenAI developer API	In your application and OpenAI’s developer platform	Gives your application programmatic access to supported models and tools	Custom applications built directly on OpenAI APIs
CustomGPT.ai RAG API	In your application through CustomGPT.ai	Manages agents, business-content sources, conversations, responses, citations, analytics, and related platform functions	Source-grounded business applications and embedded assistants
Fully custom RAG stack	Your infrastructure and selected vendors	You assemble ingestion, retrieval, model orchestration, state, monitoring, and security	Proprietary retrieval architecture or unsupported infrastructure controls

Get an API key or review the CustomGPT.ai API integration options.

Custom GPT API, GPT Actions, or OpenAI API?

Use the integration pattern that matches where the user experience lives and which infrastructure you want to own.

Requirement	OpenAI GPT	GPT Action	OpenAI developer API	CustomGPT.ai API
Used inside ChatGPT	Yes	Yes	No; used in an external application	No; used in an external application or deployment
Used in an external application	No	No; the action is invoked from ChatGPT	Yes	Yes
Calls an external REST API	Through an Action	Yes	Requires application code or tool calling	Supported through application code; agents can also connect to external APIs through supported features
Ingests business websites	Limited to GPT configuration and current ChatGPT capabilities	No; the external API owns the data	Requires OpenAI tools or custom ingestion architecture	Yes, through documented sources such as websites and sitemaps
Ingests business documents	GPT knowledge, subject to ChatGPT product limits	No	Supported through current developer tools or custom architecture	Yes, through documented uploads and sources
Managed retrieval	Product dependent	No	Available through OpenAI tools or custom development	Yes
Source citations	Product and implementation dependent	Returned only if the external service provides them	Requires appropriate tools and application handling	Yes, returned as response metadata where available
Agent management API	No external API for a configured GPT	No	Yes, through current developer abstractions	Yes; API paths retain the legacy term projects for agents
Conversation management API	No external API for the configured GPT	No	Yes	Yes
Website embedding	No	No	Requires custom development	Widget, custom UI, API, and Starter Kit options
Custom UI	No	No	Yes	Yes
Analytics and feedback	ChatGPT workspace/product dependent	External service dependent	Build or integrate	Platform and API capabilities are available; verify plan and endpoint scope
Authentication	ChatGPT account/workspace	None, API key, or OAuth for the external service	API credentials and your application authentication	Bearer API key plus your own end-user authentication
SSO	Workspace dependent	Workspace and external-service dependent	Your application responsibility	SAML and enterprise controls are plan dependent
Developer effort	Low	Medium	Medium to high	Low to medium for managed RAG; higher for custom product UX
Infrastructure ownership	OpenAI product	Split between OpenAI and external service	Application team owns most orchestration	CustomGPT.ai manages RAG platform layers; application team owns its product layer
Best-fit use case	ChatGPT-native assistant	GPT-to-service workflow	Direct model and tool integration	Business-data applications requiring managed ingestion, retrieval, citations, and deployment

What Is the CustomGPT.ai RAG API?

The CustomGPT.ai RAG API is a managed application interface for creating and operating AI agents grounded in approved business content. It combines content ingestion, indexing, retrieval, language-model orchestration, agent settings, conversation state, source citations, analytics, and deployment interfaces so developers do not have to operate every RAG infrastructure layer themselves.

The current API uses the term project in endpoint paths and payloads even though the product interface calls the object an agent. This terminology is retained for backward compatibility. CustomGPT.ai API reference

A typical platform flow is:

Approved websites and documents
→ ingestion and indexing
→ retrieval
→ configured AI agent
→ source-grounded response with citations
→ website, SaaS product, internal application, API, or support workflow

This is retrieval-augmented generation, not necessarily model retraining. The application retrieves relevant information from the approved knowledge source and supplies that context to a language model for response generation.

Explore the main RAG API product page or the guide to production RAG API applications.

CustomGPT.ai API Quickstart

The current base URL is:

https://app.customgpt.ai/api/v1/

Authentication uses an API key in a Bearer authorization header:

Authorization: Bearer YOUR_API_KEY

Terminology note: projects in the API means agents in the current CustomGPT.ai interface.

Prerequisites

• A CustomGPT.ai account
• API access under the applicable plan
• A CustomGPT.ai API key
• A server-side development environment
• A sitemap, website, or approved document source
• cURL, Node.js, Python, or another HTTP client
• Environment-variable or secrets-manager support
• A representative test-question set

Step 1: Create an API key

Sign in to CustomGPT.ai, open the menu from the top-right profile circle, select My Profile, open the API tab, and choose Create API Key. The quickstart warns that the key is shown once, so copy it to a secrets manager immediately. API keys and authentication

The public documentation recommends secure storage, minimum necessary permissions, monitoring, rotation, and deactivation of compromised keys. Configurable scopes, expiry behavior, and plan-specific key controls should be confirmed in the live dashboard because the public reference does not fully define every key-management option.

Store the key locally:

export CUSTOMGPT_API_KEY="replace-with-your-key"

Never publish a real key, expose it in browser JavaScript, include it in a mobile bundle, commit it to Git, or log it in full.

Step 2: Create an agent

Create an agent from a sitemap:

curl --request POST 
  --url "https://app.customgpt.ai/api/v1/projects" 
  --header "accept: application/json" 
  --header "authorization: Bearer $CUSTOMGPT_API_KEY" 
  --header "content-type: application/json" 
  --data '{
    "project_name": "Product Documentation Assistant",
    "sitemap_path": "https://example.com/sitemap.xml"
  }'

The response returns the new agent/project identifier. Store it as CUSTOMGPT_AGENT_ID for later calls.

The create-agent endpoint also documents multipart file uploads. Current limits shown in the API reference are up to 50 files per request, 100 MB per file, and 1 GB for the total batch. Confirm these limits before publication or a large migration because they are operational and may change.

Step 3: Add knowledge sources

Add another website or sitemap to an existing agent:

curl --request POST 
  --url "https://app.customgpt.ai/api/v1/projects/$CUSTOMGPT_AGENT_ID/sources" 
  --header "accept: application/json" 
  --header "authorization: Bearer $CUSTOMGPT_API_KEY" 
  --header "content-type: application/json" 
  --data '{
    "sitemap_path": "https://docs.example.com/sitemap.xml"
  }'

The documented source endpoint supports URL-based sources and file uploads. It also references integration connections such as Google Drive and SharePoint, but developers should verify which integrations can be provisioned entirely through the API and which require dashboard authorization.

Step 4: Check ingestion status

Agent creation and source ingestion are asynchronous. Poll the agent details endpoint until the documented readiness field is_chat_active is true:

curl --request GET 
  --url "https://app.customgpt.ai/api/v1/projects/$CUSTOMGPT_AGENT_ID" 
  --header "accept: application/json" 
  --header "authorization: Bearer $CUSTOMGPT_API_KEY"

The reference recommends polling every 5–10 seconds after creating an agent or adding a source. Set a maximum wait time, stop on terminal failure, and surface partial-ingestion problems rather than polling indefinitely.

Step 5: Create a conversation

curl --request POST 
  --url "https://app.customgpt.ai/api/v1/projects/$CUSTOMGPT_AGENT_ID/conversations" 
  --header "accept: application/json" 
  --header "authorization: Bearer $CUSTOMGPT_API_KEY" 
  --header "content-type: application/json" 
  --data '{"name":"API quickstart test"}'

The response returns a session_id. Store that value as CUSTOMGPT_SESSION_ID. A conversation groups messages and context for one user or logical session. The API also documents implicit conversation creation when a new session ID is used, but explicit creation is easier to observe and manage.

Step 6: Send the first query

curl --request POST 
  --url "https://app.customgpt.ai/api/v1/projects/$CUSTOMGPT_AGENT_ID/conversations/$CUSTOMGPT_SESSION_ID/messages" 
  --header "accept: application/json" 
  --header "authorization: Bearer $CUSTOMGPT_API_KEY" 
  --header "content-type: application/json" 
  --data '{
    "response_source": "default",
    "prompt": "What authentication methods does the product support?"
  }'

The native message response includes the message identifier, conversation identifier, generated response, citations, and related metadata documented by the endpoint. Use default or own_content when the answer should be restricted to indexed content; openai_content permits supplementation from the underlying model’s general knowledge and should be selected intentionally.

Step 7: Display citations safely

Treat citations as evidence pointers, not automatic proof of correctness. Render only fields returned by the API, such as a title, source URL, or citation identifier. Validate that the URL uses an allowed scheme, safely encode output, remove duplicates, and avoid exposing a restricted internal document to an unauthorized user.

Example application logic:

[1] Authentication Guide — https://docs.example.com/authentication
[2] Enterprise SSO — https://docs.example.com/sso

If a response has no citations, tell the user that no supporting source was returned and consider escalating or suppressing high-risk claims.

Step 8: Add user feedback

The API supports message-level reactions:

curl --request PUT 
  --url "https://app.customgpt.ai/api/v1/projects/$CUSTOMGPT_AGENT_ID/conversations/$CUSTOMGPT_SESSION_ID/messages/$PROMPT_ID/feedback" 
  --header "accept: application/json" 
  --header "authorization: Bearer $CUSTOMGPT_API_KEY" 
  --header "content-type: application/json" 
  --data '{"reaction":"liked"}'

Supported documented values are liked, neutral, and disliked. Feedback can help identify answer-quality problems, retrieval gaps, and content issues, but it should not be described as automatic model retraining.

Step 9: Clean up test resources

Delete a test conversation:

curl --request DELETE 
  --url "https://app.customgpt.ai/api/v1/projects/$CUSTOMGPT_AGENT_ID/conversations/$CUSTOMGPT_SESSION_ID" 
  --header "accept: application/json" 
  --header "authorization: Bearer $CUSTOMGPT_API_KEY"

Delete a test source:

curl --request DELETE 
  --url "https://app.customgpt.ai/api/v1/projects/$CUSTOMGPT_AGENT_ID/sources/$SOURCE_ID" 
  --header "accept: application/json" 
  --header "authorization: Bearer $CUSTOMGPT_API_KEY"

Delete a test agent only when you are sure it is no longer needed:

curl --request DELETE 
  --url "https://app.customgpt.ai/api/v1/projects/$CUSTOMGPT_AGENT_ID" 
  --header "accept: application/json" 
  --header "authorization: Bearer $CUSTOMGPT_API_KEY"

Agent deletion is irreversible and removes associated knowledge, conversations, settings, and analytics.

Open the complete API reference or test the API with your content.

Complete Code Examples

cURL quickstart

#!/usr/bin/env bash
set -euo pipefail

: "${CUSTOMGPT_API_KEY:?Set CUSTOMGPT_API_KEY}"
: "${CUSTOMGPT_AGENT_ID:?Set CUSTOMGPT_AGENT_ID}"

BASE_URL="https://app.customgpt.ai/api/v1"

conversation_json=$(curl --silent --show-error --fail-with-body 
  --request POST 
  --url "$BASE_URL/projects/$CUSTOMGPT_AGENT_ID/conversations" 
  --header "accept: application/json" 
  --header "authorization: Bearer $CUSTOMGPT_API_KEY" 
  --header "content-type: application/json" 
  --data '{"name":"cURL production test"}')

session_id=$(printf '%s' "$conversation_json" | jq -r '.data.session_id // .data.sessionId // empty')

if [[ -z "$session_id" ]]; then
  echo "Conversation response did not contain a session ID" >&2
  exit 1
fi

message_json=$(curl --silent --show-error --fail-with-body 
  --request POST 
  --url "$BASE_URL/projects/$CUSTOMGPT_AGENT_ID/conversations/$session_id/messages" 
  --header "accept: application/json" 
  --header "authorization: Bearer $CUSTOMGPT_API_KEY" 
  --header "content-type: application/json" 
  --data '{
    "response_source":"default",
    "prompt":"What authentication methods does the product support?"
  }')

printf 'Answer:n%sn' "$(printf '%s' "$message_json" | jq -r '.data.openai_response // empty')"
printf 'Citations:n'
printf '%s' "$message_json" | jq '.data.citations // []'

Node.js example

// Node.js 18+; keep this code on the server.
const API_KEY = process.env.CUSTOMGPT_API_KEY;
const AGENT_ID = process.env.CUSTOMGPT_AGENT_ID;
const BASE_URL = "https://app.customgpt.ai/api/v1";

if (!API_KEY || !AGENT_ID) {
  throw new Error("Set CUSTOMGPT_API_KEY and CUSTOMGPT_AGENT_ID.");
}

async function request(path, options = {}, timeoutMs = 30_000) {
  const controller = new AbortController();
  const timer = setTimeout(() => controller.abort(), timeoutMs);

  try {
    const response = await fetch(`${BASE_URL}${path}`, {
      ...options,
      signal: controller.signal,
      headers: {
        accept: "application/json",
        authorization: `Bearer ${API_KEY}`,
        ...(options.body ? { "content-type": "application/json" } : {}),
        ...options.headers,
      },
    });

    const raw = await response.text();
    let body;
    try {
      body = raw ? JSON.parse(raw) : null;
    } catch {
      throw new Error(`Malformed JSON from API (HTTP ${response.status}).`);
    }

    if (response.status === 429) {
      const retryAfter = response.headers.get("retry-after") || "not provided";
      throw new Error(`Rate limited. Retry-After: ${retryAfter}.`);
    }

    if (!response.ok) {
      throw new Error(`CustomGPT API error ${response.status}: ${raw.slice(0, 500)}`);
    }

    return body;
  } finally {
    clearTimeout(timer);
  }
}

function safeCitation(citation) {
  const title = String(citation?.title || citation?.page_title || "Source");
  const candidate = citation?.url || citation?.source_url;
  if (!candidate) return { title, url: null };

  try {
    const url = new URL(candidate);
    if (!["https:", "http:"].includes(url.protocol)) return { title, url: null };
    return { title, url: url.toString() };
  } catch {
    return { title, url: null };
  }
}

async function main() {
  const conversation = await request(`/projects/${AGENT_ID}/conversations`, {
    method: "POST",
    body: JSON.stringify({ name: "Node API example" }),
  });

  const sessionId = conversation?.data?.session_id;
  if (!sessionId) throw new Error("Missing data.session_id in conversation response.");

  const message = await request(
    `/projects/${AGENT_ID}/conversations/${sessionId}/messages`,
    {
      method: "POST",
      body: JSON.stringify({
        response_source: "default",
        prompt: "What authentication methods does the product support?",
      }),
    },
    60_000,
  );

  const answer = message?.data?.openai_response;
  if (!answer) throw new Error("Missing data.openai_response in message response.");

  console.log(answer);
  const citations = Array.isArray(message?.data?.citations)
    ? message.data.citations.map(safeCitation)
    : [];
  console.log(citations);
}

main().catch((error) => {
  console.error(error instanceof Error ? error.message : error);
  process.exitCode = 1;
});

Python example

"""Server-side CustomGPT.ai conversation example."""

from __future__ import annotations

import os
import time
from typing import Any

import requests

API_KEY = os.environ.get("CUSTOMGPT_API_KEY")
AGENT_ID = os.environ.get("CUSTOMGPT_AGENT_ID")
BASE_URL = "https://app.customgpt.ai/api/v1"

if not API_KEY or not AGENT_ID:
    raise RuntimeError("Set CUSTOMGPT_API_KEY and CUSTOMGPT_AGENT_ID.")

session = requests.Session()
session.headers.update(
    {
        "accept": "application/json",
        "authorization": f"Bearer {API_KEY}",
    }
)


def request_json(method: str, path: str, **kwargs: Any) -> dict[str, Any]:
    max_attempts = 3
    for attempt in range(max_attempts):
        response = session.request(
            method,
            f"{BASE_URL}{path}",
            timeout=(5, 60),
            **kwargs,
        )

        if response.status_code == 429 and attempt < max_attempts - 1:
            retry_after = response.headers.get("Retry-After")
            delay = float(retry_after) if retry_after and retry_after.isdigit() else 2**attempt
            time.sleep(delay)
            continue

        response.raise_for_status()
        try:
            payload = response.json()
        except requests.JSONDecodeError as exc:
            raise RuntimeError("CustomGPT.ai returned malformed JSON.") from exc

        if not isinstance(payload, dict):
            raise RuntimeError("CustomGPT.ai returned an unexpected response type.")
        return payload

    raise RuntimeError("CustomGPT.ai request failed after retries.")


conversation = request_json(
    "POST",
    f"/projects/{AGENT_ID}/conversations",
    json={"name": "Python API example"},
)
session_id = conversation.get("data", {}).get("session_id")
if not session_id:
    raise RuntimeError("Conversation response did not include data.session_id.")

message = request_json(
    "POST",
    f"/projects/{AGENT_ID}/conversations/{session_id}/messages",
    json={
        "response_source": "default",
        "prompt": "What authentication methods does the product support?",
    },
)

data = message.get("data") or {}
answer = data.get("openai_response")
if not answer:
    raise RuntimeError("Message response did not include data.openai_response.")

print(answer)
for citation in data.get("citations") or []:
    if isinstance(citation, dict):
        print(citation.get("title") or citation.get("page_title") or "Source")
        print(citation.get("url") or citation.get("source_url") or "No public URL")
    else:
        print(f"Citation ID: {citation}")

CustomGPT.ai also documents an official Python package installed with:

pip install customgpt-client

Use the current SDK documentation and cookbook to confirm method names before adopting it. CustomGPT.ai Python SDK

Deploy the Developer Starter Kit after validating the API with these server-side examples.

Authentication and API-Key Security

CustomGPT.ai API requests use a Bearer token:

Authorization: Bearer YOUR_CUSTOMGPT_API_KEY

The safest public-client architecture is:

Browser or mobile app
→ your authenticated backend
→ server-side CustomGPT.ai API client
→ CustomGPT.ai API

This pattern prevents the CustomGPT.ai credential from being extracted from frontend source code, browser developer tools, network logs, or a mobile application bundle. Your backend can also enforce user identity, authorization, quotas, conversation ownership, audit logging, and content-access rules.

Never do this

• Never put the key in public JavaScript.
• Never place the key in a mobile application bundle.
• Never commit the key to Git.
• Never include the key in a screenshot.
• Never log the full key.
• Never share a production key between unrelated clients.
• Never use an unrestricted production key for local testing.

API security checklist

• Store secrets in a managed secrets service or protected environment variables.
• Use the minimum permissions available.
• Maintain separate development, staging, and production keys.
• Rotate keys on a defined schedule and after personnel or vendor changes.
• Revoke a suspected compromised key immediately.
• Authenticate every application user before proxying a request.
• Authorize access to the selected agent and source collection.
• Map each conversation to the correct user or tenant.
• Apply application-level rate limits and abuse controls.
• Validate input size and supported file types.
• Sanitize markdown, HTML, URLs, and filenames before rendering.
• Redact secrets and sensitive prompts from logs.
• Record security-relevant events without storing unnecessary content.
• Test prompt injection and cross-tenant data access.
• Define deletion, offboarding, and incident-response procedures.

Review the OWASP API Security Top 10 and the OWASP Top 10 for LLM Applications when threat-modeling the complete application.

Endpoint Overview

API area	Typical operation	Current endpoint	Common use
Agents	Create	POST /projects	Create an agent from a sitemap or files
Agents	List	GET /projects	Discover agents and IDs
Agents	Get status/details	GET /projects/{projectId}	Check readiness, including is_chat_active
Agents	Delete	DELETE /projects/{projectId}	Permanently remove an agent and related data
Agent settings	Read	GET /projects/{projectId}/settings	Retrieve agent configuration
Sources	Add	POST /projects/{projectId}/sources	Add a sitemap, URL, files, or supported connection
Sources	List	GET /projects/{projectId}/sources	Review connected data sources
Sources	Delete	DELETE /projects/{projectId}/sources/{sourceId}	Remove a source and all of its documents
Documents/pages	List	GET /projects/{projectId}/pages	List indexed webpages and uploaded documents
Documents/pages	Reindex	POST /projects/{projectId}/pages/{pageId}/reindex	Refresh URL-based content
Conversations	Create	POST /projects/{projectId}/conversations	Create a session and obtain session_id
Conversations	List	GET /projects/{projectId}/conversations	Retrieve paginated conversation records
Conversations	Delete	DELETE /projects/{projectId}/conversations/{sessionId}	Permanently remove a conversation and messages
Messages	Send	POST /projects/{projectId}/conversations/{sessionId}/messages	Ask the agent a question
Messages	Get details	GET /projects/{projectId}/conversations/{sessionId}/messages/{promptId}	Retrieve answer, citations, feedback, and metadata
Feedback	Update	PUT /projects/{projectId}/conversations/{sessionId}/messages/{promptId}/feedback	Store liked, neutral, or disliked feedback
Usage	Read account limits	GET /limits/usage	Monitor agents, stored words, and monthly queries
OpenAI-format chat	Send	POST /projects/{projectId}/chat/completions	Use an OpenAI-compatible convenience format

The OpenAI-format endpoint is a convenience interface, not a claim of compatibility with every OpenAI API endpoint or parameter. Use the native CustomGPT.ai message endpoint when you need the full platform-specific feature set.

Error Handling

Status or error	Likely meaning	Recommended application behavior
400	Invalid request, missing field, unsupported value, or malformed payload	Do not retry unchanged. Validate the request and return a safe user message.
401	Missing or invalid API token	Stop, alert the operator, and verify key storage or rotation.
403	Operation or tool not permitted	Check plan, role, agent setting, or feature access. Do not retry automatically.
404	Agent, conversation, message, source, or document not found	Verify tenant mapping and IDs; avoid leaking resource existence across users.
409	Conflicting state, such as a locked or invalid operation	Refresh resource state, then retry only when the operation is safe.
402	Plan or feature requirement on documented operations	Route to plan/entitlement handling; do not present as a temporary outage.
429	Rate or resource limit exceeded	Respect Retry-After when present; otherwise use bounded exponential backoff with jitter.
Timeout	Network delay, long generation, or ingestion delay	Cancel the client request, preserve request context, and offer retry or asynchronous status.
500	Temporary server error	Retry a small number of times with backoff; open a circuit after repeated failures.
Malformed JSON	Proxy, partial response, or unexpected service behavior	Log a redacted sample and request ID; do not render raw content to the user.
Missing answer	Successful HTTP response without expected data	Treat as an application error, record the payload shape, and degrade safely.

Do not retry every 4xx response. Retries should be bounded, observable, and limited to errors that may succeed later. Use idempotent operations where available, preserve correlation IDs, and place failed asynchronous ingestion jobs into a review or dead-letter workflow.

Rate Limits, Usage, and Scaling

What are the CustomGPT.ai API rate limits? The public API reference documents 429 responses and provides an account-usage endpoint, but it does not publish one universal requests-per-minute value for every plan and operation. Check the current API reference, your plan, your account’s usage data, and any contract-specific limits before setting production concurrency.

The usage endpoint is:

GET /api/v1/limits/usage

It returns current and maximum values for agents, storage measured in words, and monthly queries.

For production workloads:

• Queue bursty ingestion and large file operations.
• Use a separate concurrency budget for user queries and administrative jobs.
• Avoid aggressive status polling; use the documented 5–10-second readiness interval as a starting point.
• Apply bounded retries with jitter.
• Cache safe, non-personal, stable answers only when the source and permissions permit it.
• Enforce backpressure before requests reach the vendor API.
• Monitor 429 rate, timeouts, error rate, p95 latency, and usage allowance.
• Separate high-cost analytical workloads from low-latency support traffic.
• Define cost and usage alerts before launch.
• Test the actual plan under representative concurrency rather than assuming a development test predicts production behavior.

Read the deeper guide to production RAG API applications.

Streaming Responses

CustomGPT.ai documents streaming on the OpenAI-format endpoint:

POST /projects/{projectId}/chat/completions

Set stream: true and accept text/event-stream. The endpoint returns Server-Sent Events whose data follows an OpenAI-style chat-completion chunk format, ending with data: [DONE].

const response = await fetch(
  `https://app.customgpt.ai/api/v1/projects/${AGENT_ID}/chat/completions`,
  {
    method: "POST",
    headers: {
      Authorization: `Bearer ${API_KEY}`,
      "Content-Type": "application/json",
      Accept: "text/event-stream",
    },
    body: JSON.stringify({
      messages: [{ role: "user", content: "Summarize the authentication guide." }],
      stream: true,
    }),
  },
);

A production client must buffer partial lines, handle an event split across network chunks, support cancellation, impose an idle timeout, and treat partial text as incomplete until the final event. Verify how citations are delivered in the streaming mode you select before designing the UI; do not assume every citation is available with the first text token.

Conversation Management

A conversation is a logically grouped sequence of user messages and agent responses. The API returns a session_id when a conversation is created. Use that session ID for subsequent messages and store it in your own application database.

Recommended mapping:

Your application user ID
→ your internal session record
→ CustomGPT.ai conversation ID

Do not use one global conversation for all users. That pattern risks cross-user context leakage, broken analytics, and incorrect personalization.

For every conversation:

• Associate the ID with the authenticated user and tenant.
• Check ownership before reading, writing, renaming, or deleting it.
• Start a new conversation when the task, user, or access scope changes materially.
• Record the minimum metadata necessary for support and auditing.
• Define a retention period in your application policy.
• Delete conversations when required by user requests, offboarding, or test cleanup.
• Avoid placing secrets or unnecessary personal data in prompts.
• Obtain user consent where conversational data is retained or analyzed.

The API supports listing conversations with pagination and deleting a conversation with all of its messages.

Citations and Source Verification

Citations improve transparency because they show which indexed content was associated with an answer. They are useful for customer support, compliance review, enterprise search, research, debugging retrieval, and content-gap analysis.

Citations do not guarantee that the answer is correct. A cited source can be outdated, misunderstood, insufficient, contradictory, or inaccessible to the current user.

Citation-validation checklist

1. The source exists.
2. The current user is allowed to access it.
3. The source supports the answer.
4. The cited section is current.
5. The title is understandable.
6. Duplicate citations are removed.
7. Broken links are handled.
8. Restricted internal links are not exposed publicly.
9. The application distinguishes sourced fact from inference.
10. Conflicting sources are escalated.

For sensitive applications, require a human review when citations conflict, when the answer depends on stale content, or when the user requests regulated advice.

Data Ingestion and Refresh

A production RAG application needs a continuing content-management process, not a one-time upload.

Source approval
→ ingestion
→ processing
→ quality check
→ production availability
→ monitoring
→ update
→ retirement or deletion

Manage the lifecycle deliberately:

• Approve source owners and intended audiences.
• Remove duplicate or superseded documents.
• Apply labels or segmentation where supported.
• Wait for processing before sending production traffic.
• Test representative questions after every major ingestion.
• Reindex URL-based pages after material changes.
• Delete and re-upload changed file sources when required by the current API behavior.
• Detect removed website pages and broken citations.
• Resolve conflicting policies and versioned documents.
• Track content freshness as an operational metric.
• Remove sources promptly when access rights or ownership change.

Connecting a Custom API to a CustomGPT.ai Agent

There are two different integration directions:

1. Your application calls CustomGPT.ai

Your product backend
→ CustomGPT.ai API
→ grounded answer and citations
→ your product UI

This is the pattern used for custom interfaces, SaaS copilots, support workflows, and internal applications.

2. A CustomGPT.ai agent calls your API

User asks the agent to perform an action
→ CustomGPT.ai agent selects a configured external API operation
→ your authenticated REST API
→ operation result returns to the agent
→ agent explains the result

CustomGPT.ai documents external API connections through supported Quick Setup options and custom OpenAPI schemas. Review the current guide to connect a custom API using an OpenAPI schema. Authentication methods, OAuth support, Smart Tasks, Plan & Act behavior, and plan requirements should be verified for the specific integration.

Do not confuse allowing your application to query CustomGPT.ai with allowing an agent to execute operations in your business system.

Platform Comparisons

OpenAI GPT Actions vs. CustomGPT.ai API

Evaluation area	OpenAI GPT Actions	CustomGPT.ai API
Primary direction	GPT inside ChatGPT calls an external service	External application calls a CustomGPT.ai agent
User interface	ChatGPT	Your website, SaaS product, internal tool, widget, or custom UI
Runs inside ChatGPT	Yes	No
Runs in your own application	No	Yes
External API calls	Core purpose	Application can call CustomGPT.ai; agent-to-external-API features are separate
Business-content ingestion	Not the purpose of Actions	Managed websites, sitemaps, files, and supported sources
Managed retrieval	External service responsibility	Included as part of the platform
Citations	External service must supply and the GPT must present them appropriately	Native response and source metadata are available
Conversation API	No external API for the configured GPT	Yes
Custom UI and website embedding	No	Yes
Authentication	None, API key, or OAuth to the external service	Bearer API key plus application-level user authentication
Best fit	A ChatGPT-native assistant needs to retrieve data or trigger a workflow	A developer needs a grounded AI capability in an external product

CustomGPT.ai API vs. OpenAI developer API

Evaluation area	OpenAI developer API	CustomGPT.ai API	What to verify
Primary abstraction	Models, responses, tools, files, conversations, and agent capabilities	Managed agents grounded in business content	Which abstraction matches the product architecture
Model access	Direct access to supported OpenAI models	Model orchestration through CustomGPT.ai	Current model selection and plan availability
Website ingestion	Build or combine current OpenAI and custom tools	Managed website and sitemap ingestion	Crawl scope and refresh behavior
Document ingestion	OpenAI file tools or custom pipeline	Managed file and source ingestion	Supported formats, limits, OCR, and retention
Retrieval infrastructure	OpenAI tools or your chosen stack	Managed by CustomGPT.ai	Required ranking and infrastructure control
Citations	Must be produced and rendered through the chosen implementation	Returned by supported CustomGPT.ai responses	Citation fields and access controls
Agent and conversation management	Available through current OpenAI APIs and application code	Platform-native agent and conversation endpoints	State, deletion, analytics, and tenancy
Tool/function calling	Supported through OpenAI developer tools	Supported CustomGPT.ai actions and external API features	Plan and security requirements
Infrastructure responsibility	Application team owns more orchestration and evaluation	CustomGPT.ai manages more RAG platform layers	Vendor dependency versus engineering burden
Best fit	Direct model control and custom AI orchestration	Faster managed business-content RAG deployment	Required model freedom, control, and time to production

This comparison was technically reviewed on July 30, 2026. It should be rechecked when either vendor changes APIs, models, product names, or plan terms.

CustomGPT.ai API vs. Building RAG From Scratch

Evaluation area	Managed CustomGPT.ai API	Ground-up RAG stack
Initial implementation	Platform configuration plus integration	Design and build every layer
Ingestion and parsing	Managed for documented sources	Select and operate parsers, crawlers, OCR, and queues
Chunking, embeddings, vector database	Managed platform responsibility	Engineering team responsibility
Retrieval and reranking	Managed and configurable within product scope	Fully customizable
Citations	Platform capability	Must be designed, generated, and validated
Conversation state	API and platform features	Build or select state infrastructure
Analytics and feedback	Platform capabilities	Build or integrate
Access control	Platform plus application controls	Entirely your responsibility
Monitoring and evaluation	Platform plus application observability	Entirely your responsibility
Model upgrades	Managed within platform options	You control upgrades and regression testing
Infrastructure control	Limited to supported product controls	Maximum control
Engineering burden	Lower	Higher
Vendor dependency	Managed-platform dependency	Dependency spread across your chosen vendors and code
Total cost of ownership	Subscription, usage, integration, and governance	Engineering, infrastructure, operations, security, and ongoing maintenance

Build from scratch when retrieval is proprietary intellectual property, a specialized ranking system is essential, unsupported infrastructure control is mandatory, or the organization can fund the engineering and operations burden. Use a managed RAG API when speed to production, website and document ingestion, citations, and reduced infrastructure ownership matter more than deep control over every retrieval component.

Compare build-versus-buy considerations.

Developer Starter Kit

The CustomGPT.ai Developer Starter Kit is an MIT-licensed, open-source frontend for the CustomGPT.ai RAG API. The current repository is a TypeScript/Next.js application with deployment modes that include a standalone app, iframe, direct widget, and floating button. It includes conversation management, real-time streaming, citations, file uploads, responsive UI, multi-agent support, and a server-side proxy pattern for API-key protection.

The project also includes optional voice features that require an OpenAI API key. Review the current repository before promising a feature in a customer implementation.

git clone https://github.com/Poll-The-People/customgpt-starter-kit.git
cd customgpt-starter-kit
npm install
cp .env.example .env.local

Add the required server-side configuration to .env.local, then run the development server according to the repository README.

Use the Starter Kit when you need:

• A faster custom-frontend starting point
• A branded interface for a SaaS product
• An agency-delivered client deployment
• A working citation and conversation implementation
• A prototype for evaluating API behavior
• A reference for secure server-side proxying

Resources:

• Starter Kit product page
• Live Starter Kit
• GitHub repository

Production Architecture

A practical production architecture separates the untrusted client from the vendor credential and gives your application control over users, permissions, quotas, logging, and escalation.

User
→ web or mobile interface
→ authenticated application backend
→ authorization and tenant checks
→ secrets manager
→ CustomGPT.ai RAG API client
→ agent and conversation management
→ approved knowledge sources
→ source-grounded response with citations
→ safe rendering in the application UI
→ analytics, feedback, and human escalation

Recommended layers:

1. Client application
2. Application authentication
3. Backend API
4. Authorization and tenant policy
5. Secrets management
6. CustomGPT.ai API client
7. Agent and conversation mapping
8. Approved knowledge sources
9. Citation validation
10. Logging and monitoring
11. Usage and cost controls
12. User feedback
13. Human escalation
14. Deletion and offboarding workflows

Production controls should include request timeouts, retries, caching rules, queues for ingestion, conversation isolation, source permissions, data minimization, redacted logs, application rate limits, and alerting for error or usage spikes.

Discuss a production RAG implementation or read the production RAG guide.

API Use Cases

Customer-support application

Ingest help-center content, product documentation, policies, and troubleshooting guides. Return source-cited answers, collect user feedback, and escalate low-confidence or unsupported cases into the ticketing workflow. Measure supported-answer rate, escalation rate, resolution rate, and citation quality.

In-product SaaS copilot

Embed a custom interface inside the product, authenticate the customer, map each customer to the correct agent and sources, and isolate conversations. Use the API for UI control, customer context, citations, and workflow-specific behavior.

Internal enterprise search

Connect approved private knowledge, require authenticated access, enforce department or tenant boundaries, display source citations, and complete a security review before launch. Avoid indexing content whose access model cannot be enforced in the application.

Developer-documentation assistant

Index API references, guides, changelogs, code examples, and versioned documentation. Show links to exact sources and handle questions about unsupported or deprecated versions explicitly.

Member or customer portal

Offer authenticated, organization-specific access to policies, standards, training, and resources. Apply branding, multilingual response settings, analytics, and conversation isolation.

Research application

Make a large document collection searchable with transparent citations. Require users to review sources, flag conflicting evidence, and define boundaries for legal, medical, financial, or other high-risk conclusions.

Automated support workflow

Receive a question, retrieve approved knowledge, draft a response, allow human review when required, then create or update a ticket with an audit trail. This workflow normally requires integration engineering; do not imply every step is automatic without configuration.

Security and Enterprise Controls

CustomGPT.ai states that its platform is SOC 2 Type II compliant and documents encryption in transit and 256-bit AES encryption at rest, isolated agent environments, GDPR support, and SAML 2.0 access for enterprise use cases. Some controls, DPAs, roles, access features, and SSO options are plan dependent. Review the current security page, SOC 2 Type II information, GDPR information, and Trust Center during procurement.

SOC 2 Type II does not automatically make a customer application compliant. GDPR support does not remove the customer’s responsibilities as a controller or processor. Security depends on platform configuration, application authentication, source permissions, data minimization, monitoring, and incident response.

Enterprise API security checklist

• Store API keys only on trusted servers.
• Use least-privilege controls where available.
• Separate development, staging, and production.
• Authenticate users and enforce tenant boundaries.
• Isolate conversations and agents.
• Validate input and sanitize output.
• Restrict source access.
• Apply rate limits and abuse detection.
• Log security-relevant events without unnecessary content.
• Minimize retained prompts and personal data.
• Define deletion and offboarding workflows.
• Review subprocessors and contractual terms.
• Conduct threat modeling.
• Test prompt injection and data-exfiltration attempts.
• Review current SSO, DPA, retention, and data-residency requirements before purchase.

API Pricing and Cost Factors

How much does the CustomGPT.ai API cost? API access is tied to CustomGPT.ai plans and allowances rather than a single universal per-request price published on the API reference. The current pricing page lists API and SDK access among plan features, while agent, storage, query, upload, analytics, support, and enterprise allowances vary. Review the current pricing page before budgeting or quoting a customer.

Cost factor	Why it affects cost	What to verify
Platform plan	Determines included capabilities and allowances	Current monthly or annual plan terms
API availability	May be included but subject to plan limits	Whether the selected plan supports the intended production use
Agent count	Separate agents may be needed by product, tenant, language, or department	Included agents and add-on options
Query or message volume	Production traffic consumes monthly allowance	Included queries and overage behavior
Content volume	Large knowledge bases consume storage and ingestion capacity	Word/storage allowance and source limits
Upload volume	Frequent refreshes may consume monthly upload allowances	File-count, word, and vision limits
Data refresh frequency	Reindexing and recurring sync create operational load	Sync behavior and integration allowances
Model and capability selection	Advanced capabilities may consume more resources	Plan and usage implications
Custom integrations	External systems require engineering and possibly additional services	OAuth, connector, and implementation cost
Enterprise controls	SSO, DPA, custom roles, and support may require enterprise terms	Exact plan and contract scope
Custom frontend	A product UI requires design, development, hosting, and maintenance	Starter Kit versus custom build
Monitoring and human support	Reliable deployment needs observability and escalation	Internal staffing and vendor support level

API Performance and Evaluation

Measure the complete user experience, not only model latency.

Metric	What it measures	Important limitation
End-to-end latency	Time from user submission to complete rendered response	Includes network, authentication, retrieval, generation, and UI work
Time to first response	Perceived responsiveness, especially when streaming	A fast first token does not guarantee a good final answer
Citation coverage	Percentage of answers with source metadata	More citations do not necessarily mean better support
Citation correctness	Whether each citation supports the statement	Requires human or evaluated review
Supported-answer rate	Questions answered from approved content	Depends on content quality and test-set design
Unsupported-answer rate	Questions that should be declined or escalated	A low rate can hide overconfident answers
User feedback	Perceived usefulness	Subjective and vulnerable to sampling bias
Error and timeout rate	Reliability	Must be segmented by endpoint and traffic type
429 rate	Capacity pressure or quota exhaustion	Could reflect application bursts rather than vendor performance alone
Cost per conversation	Platform and operational cost divided by useful sessions	Requires a clear definition of a useful session
Content freshness	Whether answers rely on current source material	Needs source-level monitoring
Escalation rate	Percentage requiring a human or ticket	A lower rate is not always better for high-risk questions

Use representative questions from the real business use case, including valid questions, missing-information questions, conflicting sources, prompt-injection attempts, and access-control tests.

Testing Checklist

Test	Expected behavior	Production action
Valid authentication	Request succeeds for an allowed resource	Record success and latency
Invalid authentication	401 without sensitive detail	Alert on repeated failures
Revoked key	Requests fail immediately	Rotate configuration and investigate use
Missing agent	Safe 404 handling	Verify mapping; do not leak other tenants
Valid in-scope query	Grounded answer with relevant citations	Include in regression suite
Missing-information query	Honest limitation or escalation	Tune instructions and content
Citation validation	Source supports answer	Block or flag unsupported claims
Conflicting sources	Conflict is surfaced	Route to content owner or human review
Prompt injection	Agent resists unsafe instruction and source exfiltration	Add controls and monitoring
Restricted data request	Access is denied	Log security event
Long input	Safely rejected or handled within limits	Enforce application limit
Malformed input	400 or safe validation error	Do not retry unchanged
Concurrent conversations	Correct isolation and stable latency	Size concurrency and queues
Cross-user isolation	No context or source leakage	Release blocker if failed
Rate limiting	Bounded retry or graceful message	Monitor 429s
Timeout	Request is cancelled and user can retry	Capture correlation data
Server error	Limited retry and graceful degradation	Alert after threshold
Ingestion failure	Source does not become production-ready	Notify operator and preserve error state
Deleted source	Answers no longer cite removed content	Re-run regression tests
Content update	Revised answer appears after reindex	Monitor freshness SLA
Conversation deletion	History is no longer available	Confirm application record cleanup
Mobile interface	Responsive and secure	Test keyboard, links, and streaming
Accessibility	Screen-reader and keyboard support	Meet product accessibility target
Logging	Useful metadata without secret leakage	Review redaction
Human escalation	Context reaches the correct workflow	Test audit trail and ownership

Case Studies and Production Proof

Dlubal Software: API-connected support for 130,000+ users

Dlubal Software deployed its AI assistant, Mia, on its public website and inside its desktop engineering software. The official case study states that the implementation supports more than 130,000 users across 132 countries and that Dlubal connected internal processes through the CustomGPT.ai API. Dlubal identified API capabilities, answer quality, ease of use, and scalability as selection factors. Read the Dlubal case study.

GEMA: 248,000+ queries and 6,000+ hours saved

GEMA’s deployment spans public support, member access, internal knowledge, and support workflows. The official case study reports more than 248,000 queries and more than 6,000 hours saved. Treat it as platform-scale evidence and verify the exact API contribution before describing a particular endpoint implementation. Read the GEMA case study.

BQE Software: 180,000 support questions and 86% AI resolution

BQE Software expanded from help-center support into in-product and technical-documentation experiences. Its official case study reports 180,000 support questions and an 86% AI resolution rate, with deployments across the help center, an in-product resource center, an API documentation assistant, and a website sales chatbot. Read the BQE case study.

The Tokenizer: 20,000+ legal sources across 80+ jurisdictions

The Tokenizer used CustomGPT.ai to power the Token RegRadar research experience across more than 20,000 legal sources and more than 80 jurisdictions. This is evidence for a source-grounded commercial research application; do not label it an API deployment unless the implementation details explicitly confirm that pattern. Read The Tokenizer case study.

Bernalillo County: 4.81× ROI and more than 114,000 contacts

Bernalillo County’s official case study reports a multi-channel support deployment, more than 114,000 contacts, 4.81× ROI, and approximately $108,000 in net savings. Use the result as evidence of a mature platform deployment, not a promise that another organization will achieve the same outcome. Read the Bernalillo County case study.

Explore more customers or discuss your RAG application architecture.

Common API Implementation Mistakes

1. Assuming a ChatGPT GPT is directly callable as an API. Use OpenAI’s developer API or a managed application API instead.
2. Confusing GPT Actions with exposing the GPT as an endpoint. Actions let the GPT call your API; they do not turn the GPT into your API.
3. Exposing an API key in frontend code. Route traffic through an authenticated backend.
4. Committing secrets to Git. Use environment variables or a secrets manager and enable secret scanning.
5. Using one conversation for every user. Map one conversation to the correct user or logical session.
6. Querying before ingestion is complete. Poll readiness and block production traffic until the agent is active.
7. Ignoring pagination. Continue until the API’s last-page indicator is reached.
8. Hard-coding stale endpoints. Maintain an API client layer and monitor documentation changes.
9. Failing to validate citations. Check permission, relevance, freshness, and link safety.
10. Retrying every error. Retry only transient errors and use bounded backoff.
11. Ignoring 429 responses. Apply backpressure and respect retry guidance.
12. Using no request timeout. Set connect, read, and overall operation limits.
13. Logging confidential prompts. Redact or minimize content and protect logs.
14. Sending unapproved business data. Establish source ownership and data-classification rules.
15. Ignoring content updates. Reindex changed URLs and replace changed files.
16. Assuming citations guarantee correctness. Treat them as evidence pointers requiring validation.
17. Skipping prompt-injection tests. Test source exfiltration, role override, and malicious documents.
18. Providing no human escalation. Define a path for unsupported, sensitive, or high-risk questions.
19. Treating dashboard integrations as API endpoints. Use only operations documented in the API reference.
20. Copying stale pricing or limits. Link to current pages and verify the account contract.
21. Using production keys in local demos. Create separate test credentials and resources.
22. Failing to delete test resources. Include cleanup in scripts and release checklists.
23. Ignoring client offboarding. Revoke access, delete or transfer data, and close conversations.
24. Assuming OpenAI compatibility means every endpoint is supported. The documented chat-completions endpoint is a convenience interface, not complete API equivalence.

Frequently Asked Questions

Is there an API for an OpenAI custom GPT?

No general API turns a GPT configured in ChatGPT into a reusable endpoint for an external application. OpenAI GPTs are designed for use inside ChatGPT. GPT Actions let a GPT call an external API, while developers building a separate website or product should use OpenAI’s developer API or another application platform such as the CustomGPT.ai RAG API.

Can I call a ChatGPT GPT from my application?

Not as a general reusable API endpoint. OpenAI’s current guidance says GPTs are designed to work in ChatGPT and are not the method for embedding an assistant in an external product. Rebuild the required behavior with the OpenAI developer API, or use a managed RAG platform when business-content ingestion and citations are central requirements.

What is the difference between a custom GPT and the OpenAI API?

A custom GPT is a configured ChatGPT experience used inside ChatGPT. The OpenAI API is a developer platform for integrating supported models, tools, files, and conversational capabilities into an external application. Access to a ChatGPT subscription does not automatically equal API access or API billing.

What is a GPT Action?

A GPT Action is a configured connection that lets a GPT inside ChatGPT call an external API. The action uses an OpenAPI schema and supports current authentication options such as no authentication, API key, or OAuth. In this pattern, the GPT is the client and your service is the API.

Can a GPT Action call my API?

Yes. Configure the API operation through an OpenAPI schema and select a supported authentication method. You must also account for workspace domain controls, sharing requirements, user confirmation, privacy policy requirements for public GPTs, and the security of your own API.

Can my API call an OpenAI GPT?

Not a GPT configured in ChatGPT as a general endpoint. Your application can call OpenAI’s developer APIs and recreate the instructions, tools, knowledge, and application logic needed for the external experience.

Can I embed an OpenAI GPT on a website?

No. OpenAI’s GPT FAQ states that GPTs are designed to work in ChatGPT and are not a way to embed ChatGPT in an external website or application. Use an API-based application architecture instead.

What is the CustomGPT.ai API?

The CustomGPT.ai API is a managed interface for creating and operating source-grounded AI agents on approved business content. It includes endpoints for agents, sources, indexed documents, conversations, messages, citations, settings, feedback, usage, analytics, and related platform functions.

Is CustomGPT.ai an OpenAI product?

No. CustomGPT.ai is a separate company and platform. It may use supported foundation-model providers as part of its service, but it is not an official OpenAI product and should not be described as one.

Is the CustomGPT.ai API a RAG API?

Yes. It is designed to retrieve relevant information from indexed business sources and use that context to generate an answer. The platform also manages ingestion, indexing, agents, conversations, citations, and deployment features around the RAG workflow.

Can the API answer questions from my documents?

Yes, after the documents are added to an agent and processing is complete. The application should verify readiness, test representative questions, and validate citations before production use.

Can the API ingest a website or sitemap?

Yes. The create-agent and add-source endpoints document website and sitemap ingestion through sitemap_path. Confirm crawl scope, supported URLs, and refresh behavior for the target site.

Can the API return source citations?

Yes. Message details include citations and related metadata. Your application must still validate permissions, relevance, freshness, duplicate links, and safe URL rendering.

How do I get a CustomGPT.ai API key?

Sign in, open My Profile, select the API tab, and create a key. Store the one-time-displayed secret in a secrets manager and never expose it to a browser or mobile client.

How is the API authenticated?

Requests use the API key in an HTTP Bearer authorization header: Authorization: Bearer YOUR_API_KEY. The public quickstart’s prose also uses the phrase “HTTP Basic Auth,” but the current examples and reference use a Bearer token; confirm this wording during final technical review.

Should an API key be used in frontend JavaScript?

No. Put the key in a trusted backend, authenticate the user to your application, and proxy authorized requests to CustomGPT.ai. A browser-delivered secret can be copied by any user who can run developer tools.

Does CustomGPT.ai offer a Python SDK?

Yes. The official documentation lists the package installation command pip install customgpt-client and links to cookbooks. Verify current classes and methods before writing production code.

Is there a JavaScript SDK?

The public documentation prominently supports direct HTTP use and provides JavaScript examples. Check the current SDK repository and API reference before claiming an official JavaScript package; raw fetch from a server-side Node.js environment is a reliable documented pattern.

Is the CustomGPT.ai API compatible with the OpenAI SDK?

A documented convenience endpoint accepts an OpenAI-style chat-completions request and supports streaming. It should be described as limited OpenAI-format compatibility, not compatibility with every OpenAI endpoint, model, parameter, tool, or SDK behavior.

What does “project” mean in the CustomGPT.ai API?

Project is the legacy API term for an agent. Endpoint paths, payloads, and responses continue to use projects for backward compatibility even though the current product interface uses agent.

How do I create an agent with the API?

Send POST /api/v1/projects with a project_name and a documented content source such as sitemap_path or multipart file upload. Store the returned project ID and wait until processing is complete before querying it.

How do I upload files with the API?

Use multipart form data on the create-agent or add-source endpoint. The current reference recommends files[] for multiple files and documents batch and file-size limits that should be rechecked before a large upload.

How do I create a conversation?

Send POST /api/v1/projects/{projectId}/conversations with an optional name. Store the returned session_id and map it to the authenticated application user.

How do I continue an existing conversation?

Send the next message to the same agent and session_id: POST /projects/{projectId}/conversations/{sessionId}/messages. Verify the user owns that conversation before sending the request.

How do I retrieve citations?

Read citations from the message response or retrieve a message by its prompt ID. Render only fields returned by the API, validate URLs, and enforce source permissions before displaying them.

Does the API support streaming?

Yes. The OpenAI-format chat/completions endpoint documents Server-Sent Events when stream is true. Confirm citation timing and native-endpoint behavior for the selected implementation.

What are the API rate limits?

No single universal numeric rate limit is published for every plan and endpoint in the public reference. The API documents 429 responses and provides GET /limits/usage for account allowances. Verify production limits with current plan documentation or your contract.

How much does API access cost?

API access is tied to CustomGPT.ai plans and allowances. The current pricing page lists API and SDK access while query, agent, storage, upload, analytics, support, and enterprise terms vary. Use the live pricing page rather than copying a table into long-lived documentation.

What happens when I exceed my usage allowance?

The request may return a resource or rate-limit error, including 429, and production traffic may stop succeeding until the allowance resets or the plan changes. Monitor GET /limits/usage, set alerts, and confirm overage behavior with the selected plan.

Can the API be used in a SaaS product?

Yes. Keep the API key on the server, authenticate users, isolate tenants and conversations, enforce source access, and design monitoring, deletion, and support workflows around the integration.

Can I use the API for customer support?

Yes. A common pattern is to ingest approved help-center content, answer with citations, collect message feedback, and escalate unsupported questions to a human or ticketing system.

Can I use the API for internal company knowledge?

Yes, provided the application enforces authentication and source permissions appropriate for the content. Complete a security, privacy, and procurement review before indexing sensitive material.

Can I create a custom frontend?

Yes. Call the API from your backend and render the result in your own interface, or use the open-source Developer Starter Kit as a starting point.

Is there an open-source starter kit?

Yes. The CustomGPT.ai Developer Starter Kit is MIT licensed and provides a Next.js/TypeScript interface with standalone, widget, iframe, and floating-button deployment options. Review the current repository before implementation.

Can CustomGPT.ai connect to my external API?

Yes, through supported external API integration features, including custom OpenAPI-schema connections. Verify current authentication, OAuth, plan, and action requirements for the target system.

What is the difference between calling CustomGPT.ai and connecting an API to an agent?

Calling CustomGPT.ai means your application sends requests to the CustomGPT.ai API. Connecting an API to an agent means the agent can call your external service to retrieve data or perform an action. They are opposite integration directions and have different authentication and security designs.

Can the API use private data?

Yes, but the customer must control which data is approved, who can query it, how sources are segmented, and how conversations and logs are retained. Review platform security and contractual documentation for the intended data classification.

Is CustomGPT.ai SOC 2 Type II compliant?

CustomGPT.ai states that it is SOC 2 Type II compliant. Request the current report and review its scope, exceptions, systems, and audit period during vendor assessment. SOC 2 does not by itself make the customer’s application compliant.

Does CustomGPT.ai support SSO?

CustomGPT.ai documents SAML 2.0 authenticated access for enterprise use cases. Availability and scope are plan dependent, so verify whether SSO applies to administrators, team users, end users, or a particular deployment.

Is customer data used to train public AI models?

CustomGPT.ai states that customer business data is kept private to the relevant agent and is not used to train public models. Confirm current contractual terms, subprocessors, model-provider handling, retention, and deletion requirements during security review.

How should I handle API errors?

Validate requests before sending, set timeouts, parse error bodies defensively, retry only transient failures, apply bounded exponential backoff with jitter, log redacted correlation data, and provide a user-safe fallback or escalation path.

How should I handle rate limits?

Detect 429, respect Retry-After if present, queue or reject excess work, apply backpressure, and alert before monthly allowances are exhausted. Do not let every application instance retry simultaneously.

How should conversations be isolated between users?

Store one CustomGPT.ai session ID in an internal record owned by the authenticated user and tenant. Check ownership on every operation and never share a global conversation across users.

How do I delete conversations or agents?

Use the documented DELETE endpoints for conversations, sources, documents, or agents. Agent and conversation deletion is permanent, so require authorization and confirmation and preserve only the audit metadata allowed by policy.

When should I build RAG from scratch instead?

Build from scratch when retrieval architecture is strategic intellectual property, specialized ranking or deployment control is mandatory, or the team can operate parsing, embeddings, vector infrastructure, orchestration, security, evaluation, and monitoring. A managed RAG API is usually faster when those layers are not the product’s differentiator.

Conclusion: Choose the Right Custom GPT API Path

Use an OpenAI GPT when the experience belongs inside ChatGPT. Use GPT Actions when that GPT needs to call an external API. Use the OpenAI developer API when your team is building a custom application directly on OpenAI models and tools. Use the CustomGPT.ai API when the application needs managed business-content ingestion, source-grounded retrieval, citations, agent and conversation management, analytics, and deployment support. Build a ground-up RAG stack when the retrieval infrastructure itself must be deeply proprietary.

• Get a CustomGPT.ai API key
• Follow the API quickstart
• Deploy the Developer Starter Kit
• Review API plans and pricing
• Discuss your RAG application architecture
• Build a React chatbot embed with CustomGPT.ai