CFEngine Enterprise API

Name: CFEngine Enterprise API
Brand: CFEngine Enterprise API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentDeveloper ToolsMonitoring Observabilitybasic28 EndpointsREST

For Agents

Manage CFEngine Mission Portal hosts, RBAC users and roles, settings, and inventory queries against the CFEngine hub.

Install Jentic One Beta

Connect the CFEngine Enterprise API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the CFEngine Enterprise API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with CFEngine Enterprise API.

List managed hosts and inspect per-host state, classes, and last-seen times against the CFEngine hub

Create, update, lock, and delete Mission Portal user accounts

Define and assign RBAC roles that scope which hosts and reports a user can access

GET STARTED

Start building with CFEngine Enterprise API

Explore with Jentic

View OpenAPI Document

Use Cases

Patterns agents use CFEngine Enterprise API for, with concrete tasks.

★ Managed Host Inventory

Pull a continuously updated inventory of every host running CFEngine across the estate, including each host's classes, last reported time, and identity. The /api/host and /api/hosts/by-class endpoints power custom dashboards, drift detection, and audit reports without scraping the Mission Portal UI. Useful for compliance teams who need an authoritative list of which hosts are still under configuration management.

Call GET /api/host and GET /api/hosts/by-class then return every host id whose classes include 'cfengine_3'

RBAC User Provisioning

Provision and deprovision Mission Portal user accounts and the roles that scope their access. PUT /api/user/{username} creates an account, POST /api/user/{username} updates it, and the matching /api/role endpoints define which hosts and reports each role can see. Used by platform teams that want IdP-driven onboarding rather than manual Mission Portal clicks.

Call PUT /api/user/jane.doe with a payload containing email, password and role 'cf_remoteuser', then verify with GET /api/user/jane.doe

Host Lifecycle Management

Remove decommissioned hosts cleanly and recover from accidental deletions. DELETE /api/host/{hostId} drops a host from the hub, GET /api/hosts/deleted lists soft-deleted hosts still recoverable, and POST /api/hosts/restore-deleted/{hostId} brings one back. This avoids the common pitfall of orphaned host records skewing inventory counts after fleet churn.

Call GET /api/hosts/deleted, then for each host id call POST /api/hosts/restore-deleted/{hostId} until the active inventory matches the expected count

AI Agent Infrastructure Audit via Jentic

An ops agent receives a request such as 'tell me which hosts are missing the latest policy class' and needs to call the CFEngine hub directly. Through Jentic, the agent searches for the right operation, loads the input schema, and calls /api/hosts/by-class with credentials drawn from the Jentic vault. The agent returns a typed list of host ids without the developer wiring HTTP basic auth or paging logic.

Use Jentic to search 'list cfengine hosts by class', load the operation, and execute it for class 'compliance_baseline_v2'

Key Endpoints

28 endpoints — jentic publishes the only available openapi specification for cfengine enterprise api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

GET

/api/host

List all managed hosts

GET

/api/host/{hostId}

Get details for a single host

GET

/api/hosts/by-class

Group hosts by hard classes

DELETE

/api/host/{hostId}

Remove a host from the hub

POST

/api/hosts/restore-deleted/{hostId}

Restore a deleted host

PUT

/api/user/{username}

Create a new Mission Portal user

GET

/api/role

List RBAC roles

GET

/api/settings

Read Mission Portal settings

GET

/api/host

List all managed hosts

GET

/api/host/{hostId}

Get details for a single host

GET

/api/hosts/by-class

Group hosts by hard classes

DELETE

/api/host/{hostId}

Remove a host from the hub

POST

/api/hosts/restore-deleted/{hostId}

Restore a deleted host

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

CFEngine Mission Portal username and password are stored encrypted in the Jentic vault and added to the HTTP Basic Authorization header at execution time. Agents receive scoped access only — the raw credentials never enter the agent's context window or prompt history.

Intent-based discovery

Agents search Jentic by intent (e.g., 'list cfengine hosts' or 'create a mission portal user') and Jentic returns the matching CFEngine operation with its input schema, so the agent calls the right endpoint without scraping the Mission Portal docs.

Time to first call

Direct CFEngine integration: half a day for HTTP Basic wiring, RBAC payload modelling, and host pagination. Through Jentic: under 30 minutes — search, load schema, execute.

FAQs

Specific to using CFEngine Enterprise API through Jentic.

Why is there no official OpenAPI spec for CFEngine Enterprise API?

CFEngine does not publish an OpenAPI specification. Jentic generates and maintains this spec so that AI agents and developers can call CFEngine Enterprise API via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the CFEngine Enterprise API use?

The API uses HTTP Basic authentication with Mission Portal credentials. Through Jentic, the username and password live in the Jentic vault and are added to the Authorization header at execution time so they never enter the agent's prompt or context window.

Can I list every host managed by CFEngine through the API?

Yes. GET /api/host returns the full inventory of hosts known to the hub, and GET /api/hosts/by-class groups the same hosts by their hard classes for targeted policy work. Each host record includes its id and last-seen timestamp.

What are the rate limits for the CFEngine Enterprise API?

CFEngine does not publish a fixed cloud rate limit because the API runs on a self-hosted Mission Portal. Throughput is bounded by the hub's hardware and by basic-auth login throttling configured locally; treat large inventory pulls as you would any internal database query.

How do I create a new Mission Portal user with the CFEngine API through Jentic?

Search Jentic for 'create a cfengine user', load the operation backed by PUT /api/user/{username}, and execute it with the username, email, password, and role payload. Jentic injects the basic-auth credentials so the agent only handles the typed input.

Can I restore a host that was accidentally deleted from the CFEngine hub?

Yes. Soft-deleted hosts remain recoverable until the configured retention window passes. List them with GET /api/hosts/deleted, then call POST /api/hosts/restore-deleted/{hostId} for each id to bring them back into active inventory.

CFEngine Enterprise API

Connect the CFEngine Enterprise API to your agent

Capabilities

Start building with CFEngine Enterprise API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs