canonical: https://jentic.com/apis/elaichi.ai/elaichi # Elaichi API The Elaichi API governs how people and AI agents reach a team's connected SaaS tools. It manages organizations, teams, roles, and members with fine-grained permissions and entitlements, links external apps through connectors and connections, and groups the operations an agent may run into toolboxes. It also covers org domains, audit logs, SSO connections, and SCIM user provisioning, so access is granted, scoped, and recorded in one place. ## For AI agents Govern which tools and connections an agent or member can reach: manage organizations, teams, roles, permissions, toolboxes, SSO, and SCIM provisioning, with every action recorded in an audit log. ## Scope Does not process payments, send messages, or run the connected tools' own business logic. Use for governing access, roles, connections, and tool permissions only. ## Capabilities - Create organizations, teams, and roles with scoped permissions - Invite members and appoint or remove team administrators - Link external apps through connectors and manage each connection - Group the operations an agent may run into toolboxes - Provision users and groups over SCIM and configure SSO connections - Read the audit log of actions across the organization ## Use cases ### Governing an agent's tool access A team wants an agent to use only a chosen set of tools. Through Jentic the workflow assembles a toolbox of the operations the agent may run, attaches it to a role, and assigns that role, so the agent can run those tools and nothing more. Permissions and entitlements refine the boundary per organization, and the audit log records what ran. Example prompt: Create a toolbox with a chosen set of operations, attach it to a role, and assign the role to an agent ### Standing up a team's access model A new organization needs its people and permissions in place. The API creates the organization, its teams and roles, invites members, and appoints team administrators, so an onboarding workflow builds the whole access model through calls rather than a console. Roles carry the permissions and entitlements that decide what each member can do. Example prompt: Create an organization, add a team, create a role with permissions, and invite a member into it ### Directory sync and single sign-on An enterprise customer expects SCIM and SSO. The API provisions users and groups over SCIM, maps groups to roles, and configures SSO connections and org domains, so identity stays in sync with the customer's directory and sign-in is centralized. The audit log captures each change for review. Example prompt: Configure an SSO connection, provision a user over SCIM, and map a directory group to a role ## Key endpoints | Method | Path | Description | | --- | --- | --- | | GET | `/user/me` | Get the current user bootstrap payload | | GET | `/organization` | List your organizations | | POST | `/role` | Create a role | | GET | `/team` | List teams | | POST | `/team/{id}/members` | Add a team member | | GET | `/role/{id}` | Get a role | ## Key resources - **Organizations** — Organizations, their domains, and entitlements - **Teams and roles** — Teams, members, roles, and the permissions attached to them - **Connections** — Connectors, custom connectors, and stored connections to external apps - **Toolboxes** — Grouped operations an agent may run, with synthetic tools - **SCIM and SSO** — SCIM tokens, groups, group mapping, and SSO connections - **Audit log** — A record of actions taken across the organization ## AI readiness This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use. - **Score:** 55 / 100 - **Maturity:** Foundational - **Dimensions:** - Foundational Compliance: 48 / 100 - Developer Experience & Jentic Compatibility: 62 / 100 - AI-Readiness & Agent Experience: 57 / 100 - Agent Usability: 43 / 100 - Security: 75 / 100 - AI Discoverability: 67 / 100 - **View full report:** https://jentic.com/apis/elaichi.ai/elaichi/scorecard - **How the score is calculated:** https://docs.jentic.com/reference/api-readiness-framework/overview/ - **More about the dimensions:** https://docs.jentic.com/reference/api-readiness-framework/specification/#dimensional-model-overview ### Score it yourself Every API in the directory is allowlisted, so you can re-score it with no key required. - **Score your own API:** https://jentic.com/scorecard.md - **Scoring CLI agent skill:** https://github.com/jentic/jentic-api-scorecard/blob/main/skills/jentic-api-scorecard/SKILL.md ```sh npx @jentic/api-scorecard-cli score ``` ## Why Jentic - **Setup:** Wiring the Elaichi API by hand means handling a bearer organization token for most calls, a separate OAuth2 flow for interactive clients, and SCIM tokens for provisioning, none of them interchangeable. Through Jentic you install once, import Elaichi from the API Directory, store the credential once, and your agent calls it. - **Permission scoping:** Elaichi puts the role and team id in the URL path (`/team/{id}/...` and `/role/{id}`), so a rule can pin your agent to one team and the operations you pick, such as listing members and reading roles. Deleting an organization or rotating tokens is not included unless you add it. - **Credential handling:** Your Elaichi token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'create a team' or 'assemble a toolbox', and Jentic returns the matching Elaichi operation with its input schema so the agent calls the right endpoint without reading the reference docs. ## Related APIs - **Descope** — Manages user authentication, SSO, and session flows - **Auth0** — Handles authentication, user management, and authorization - **Apideck Vault** — Stores and manages connections and OAuth flows to third-party apps ## FAQ ### What authentication does the Elaichi API use? The Elaichi API authenticates most operations with a bearer organization API token sent as `Authorization: Bearer ...`, and additionally supports an OAuth2 authorization-code flow for interactive clients and separate SCIM tokens for the provisioning endpoints, per its OpenAPI spec. A few endpoints such as health and the OpenAPI document need no credential. Through Jentic the token is stored encrypted by your own Jentic One instance and injected at call time, so it never enters the agent's context. ### Is there an Elaichi MCP server? Elaichi is itself a control plane for connecting agents to tools, and you can drive its own API directly through Jentic without a separate MCP server: import it from the API Directory, store your token once, and your agent calls its role, team, and connection operations on demand without loading extra tool definitions into its context. ### Can I control which tools an agent may run with the Elaichi API? Yes. You group operations into toolboxes and attach them to roles, then assign roles to members or agents, so each principal can run only the tools in the toolboxes you grant. Permissions and entitlements refine that boundary per organization. ### What are the rate limits for the Elaichi API? The OpenAPI spec does not publish specific rate limits. Check the Elaichi documentation at https://elaichi.ai for the limits that apply to your plan before running bulk provisioning. ### Can I limit what my agent is allowed to do with the Elaichi API? Yes. Write a rule that allows your agent only the operations it needs on one team, such as listing members and reading roles, so it cannot delete organizations or change SSO settings elsewhere. Every call it makes is logged. ### How do I give an agent scoped tool access with the Elaichi API through Jentic? Search Jentic for 'assemble a toolbox for an agent' and it returns the toolbox operation with its input schema; your agent builds the toolbox, attaches it to a role, and assigns the role. To run it on your own infrastructure, install Jentic One from its GitHub repo.