What authentication does the Convex HTTP API use?

Two schemes are supported: HTTP Bearer with a deployment access token in the Authorization header, and the apiKey scheme using 'Convex {access_key}' (admin key) also in the Authorization header. Through Jentic both options are stored in the vault and injected at execution time so they never enter the agent's prompt.

How do I call a Convex query function over HTTP?

POST to /api/query with a JSON body containing the function path (e.g. 'messages:list') and an args object. The deployment runs the function and returns the result inline. Use /api/mutation for write operations and /api/action for side-effect functions.

Can I call any Convex function with a single endpoint?

Yes. POST /api/run/{functionIdentifier} dispatches to whichever query, mutation, or action lives at the supplied identifier. This is useful when the caller does not statically know which function category will be invoked.

What is the base URL for the Convex HTTP API?

Each Convex deployment has its own URL of the form https://{deployment}.convex.cloud. Substitute your deployment identifier (e.g. happy-fox-123) for {deployment} when making calls.

How do I invoke a Convex function through Jentic?

Run jentic search for 'call a convex function', load the POST /api/query, /api/mutation, /api/action, or /api/run operation, then execute it with the function path and arguments. Jentic injects the deployment Bearer or admin key from the vault and returns the function output.

What are the rate limits for the Convex HTTP API?

Rate limits depend on the deployment plan and are not declared in the OpenAPI spec. Treat the function endpoints as soft-limited per deployment and back off on HTTP 429 responses. Consult Convex's pricing page for plan-level concurrency and request limits.

Can I limit what my agent is allowed to do with the Convex HTTP API?

Yes. Because Jentic One is self-hosted, your own rules decide which Convex operations the agent may call, and it is scoped per operation. You can allow the read-only query call (POST /api/query) and the side-effect action call (POST /api/action) while leaving out the mutation call (POST /api/mutation) to keep the agent from writing data, and you can withhold the generic POST /api/run dispatch so it cannot reach functions you did not credit. The agent can only invoke the operations you grant, and your deployment token stays with your instance rather than the agent's prompt.