Install Jentic One Beta
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Elaichi API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Felaichi.ai%2Felaichi" | shStep 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Felaichi.ai%2Felaichi" | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
What an agent can do with Elaichi API.
Create organizations, teams, and roles with scoped permissions
Invite members and appoint or remove team administrators
Link external apps through connectors and manage each connection
Group the operations an agent may run into toolboxes
Provision users and groups over SCIM and configure SSO connections
GET STARTED
Read the audit log of actions across the organization
Patterns agents use Elaichi API for, with concrete tasks.
★ Governing an agent's tool access
A team wants an agent to use only a chosen set of tools. Through Jentic the workflow assembles a toolbox of the operations the agent may run, attaches it to a role, and assigns that role, so the agent can run those tools and nothing more. Permissions and entitlements refine the boundary per organization, and the audit log records what ran.
Create a toolbox with a chosen set of operations, attach it to a role, and assign the role to an agent
Standing up a team's access model
A new organization needs its people and permissions in place. The API creates the organization, its teams and roles, invites members, and appoints team administrators, so an onboarding workflow builds the whole access model through calls rather than a console. Roles carry the permissions and entitlements that decide what each member can do.
Create an organization, add a team, create a role with permissions, and invite a member into it
Directory sync and single sign-on
An enterprise customer expects SCIM and SSO. The API provisions users and groups over SCIM, maps groups to roles, and configures SSO connections and org domains, so identity stays in sync with the customer's directory and sign-in is centralized. The audit log captures each change for review.
Configure an SSO connection, provision a user over SCIM, and map a directory group to a role
206 endpoints — the elaichi api governs how people and ai agents reach a team's connected saas tools.
METHOD
PATH
DESCRIPTION
/user/me
Get the current user bootstrap payload
/organization
List your organizations
/role
Create a role
/team
List teams
/team/{id}/members
Add a team member
/role/{id}
Get a role
/user/me
Get the current user bootstrap payload
/organization
List your organizations
/role
Create a role
/team
List teams
/team/{id}/members
Add a team member
/role/{id}
Get a role
What agents get from Jentic-routed access to this vendor.
Setup
Wiring the Elaichi API by hand means handling a bearer organization token for most calls, a separate OAuth2 flow for interactive clients, and SCIM tokens for provisioning, none of them interchangeable. Through Jentic you install once, import Elaichi from the API Directory, store the credential once, and your agent calls it.
Permission scoping
Elaichi puts the role and team id in the URL path (/team/{id}/... and /role/{id}), so a rule can pin your agent to one team and the operations you pick, such as listing members and reading roles. Deleting an organization or rotating tokens is not included unless you add it.
Credential isolation
Your Elaichi token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
Intent-based discovery
Agents search Jentic by intent such as 'create a team' or 'assemble a toolbox', and Jentic returns the matching Elaichi operation with its input schema so the agent calls the right endpoint without reading the reference docs.
Alternatives and complements available in the Jentic catalogue.
Specific to using Elaichi API through Jentic.
What authentication does the Elaichi API use?
The Elaichi API authenticates most operations with a bearer organization API token sent as `Authorization: Bearer ...`, and additionally supports an OAuth2 authorization-code flow for interactive clients and separate SCIM tokens for the provisioning endpoints, per its OpenAPI spec. A few endpoints such as health and the OpenAPI document need no credential. Through Jentic the token is stored encrypted by your own Jentic One instance and injected at call time, so it never enters the agent's context.
Is there an Elaichi MCP server?
Elaichi is itself a control plane for connecting agents to tools, and you can drive its own API directly through Jentic without a separate MCP server: import it from the API Directory, store your token once, and your agent calls its role, team, and connection operations on demand without loading extra tool definitions into its context.
Can I control which tools an agent may run with the Elaichi API?
Yes. You group operations into toolboxes and attach them to roles, then assign roles to members or agents, so each principal can run only the tools in the toolboxes you grant. Permissions and entitlements refine that boundary per organization.
What are the rate limits for the Elaichi API?
The OpenAPI spec does not publish specific rate limits. Check the Elaichi documentation at https://elaichi.ai for the limits that apply to your plan before running bulk provisioning.
Can I limit what my agent is allowed to do with the Elaichi API?
Yes. Write a rule that allows your agent only the operations it needs on one team, such as listing members and reading roles, so it cannot delete organizations or change SSO settings elsewhere. Every call it makes is logged.
How do I give an agent scoped tool access with the Elaichi API through Jentic?
Search Jentic for 'assemble a toolbox for an agent' and it returns the toolbox operation with its input schema; your agent builds the toolbox, attaches it to a role, and assigns the role. To run it on your own infrastructure, install Jentic One from its GitHub repo.
For Agents
Govern which tools and connections an agent or member can reach: manage organizations, teams, roles, permissions, toolboxes, SSO, and SCIM provisioning, with every action recorded in an audit log.
Use for: Create a new team and add members to it, Grant a role a specific set of permissions, Connect a SaaS app and store its connection, Assemble a toolbox of operations an agent may run
Not supported: Does not process payments, send messages, or run the connected tools' own business logic. Use for governing access, roles, connections, and tool permissions only.
The Elaichi API governs how people and AI agents reach a team's connected SaaS tools. It manages organizations, teams, roles, and members with fine-grained permissions and entitlements, links external apps through connectors and connections, and groups the operations an agent may run into toolboxes. It also covers org domains, audit logs, SSO connections, and SCIM user provisioning, so access is granted, scoped, and recorded in one place.
This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.
Base layer of spec validity and structural soundness.
Aggregated quality score from linter diagnostics, weighted by severity.
Percentage of `$ref` references that resolve successfully.
Checks whether the API description parses successfully and conforms to its declared specification (e.g., OpenAPI).
Structural correctness score based on schema issues using logarithmic dampening.
Clarity, completeness, and ingestion readiness for developers and tooling.
How richly the API is illustrated with examples.
Percentage of examples that conform to their schemas.
Percentage of operations with complete response definitions (success, client error, server error).
Health of API ingestion, bundling, and resolution within Jentic pipelines.
Semantic breadth, depth, and agent comprehension for AI systems.
Coverage of descriptions across API elements.
Coverage of RFC 9457 Problem Details for error responses.
Coverage, uniqueness, and casing consistency of operationIds for AI inference.
Coverage of summaries across operations/tags/info.
Functional utility, complexity comfort, and AI orchestration readiness.
Agent comfort level based on API operational and structural complexity.
Trust, risk posture, and security compliance.
Average quality of security schemes based on authentication method strength (weakest link for OAuth2).
Findability, semantic richness, and reasoning readiness.
Clarity and depth of descriptions across API elements.
Score it yourself
Every API in the directory is allowlisted, so you can re-score it with no key required.
npx @jentic/api-scorecard-cli score <openapi-url>