FM-034 — Composio REST API `appNames=` Silently Ignored

Field	Value
Severity	SEV-2 (integration catalog incomplete)
Category	Integrations
Date	2026-03-21
Status	Archived

Symptom

Composio tool catalog only had 2 toolkits (GitHub + Gmail, ~105 tools) after sync. All 31 toolkits were in AUTH_CONFIG_IDS but only 2 appeared in the DB.

Root cause

fetchToolSchemasFromRest() used appNames=TOOLKIT in the URL. The Composio v2 actions API silently ignores appNames and returns ALL ~22,000 tools unsorted. The correct param is apps=TOOLKIT. With appNames=, totalPages was ~222 instead of 8-28.

Secondary bug: AUTH_CONFIG_IDS used key microsoftteams but Composio’s slug is microsoft_teams.

Fix

1. Changed appNames= to apps= in URL
2. Renamed microsoftteams → microsoft_teams
3. Added ComposioToolkitSlug type — TypeScript now catches invalid slugs at compile time

Prevention

• Always verify API filter params return toolkit-specific data: totalPages < 500 = filter works; totalPages > 7000 = filter ignored
• APIs that silently accept invalid params are dangerous
• Use ComposioToolkitSlug type for all toolkit slug references