What authentication does the Exist.io API use?

The Exist.io API uses HTTP bearer token authentication. You pass an Authorization: Bearer <token> header where the token is either a personal access token or an OAuth2-issued token. Through Jentic the token is held in the encrypted vault and only scoped credentials are issued to the agent at execution time, so the raw token never enters agent context.

Can I write data into a user's Exist.io account with this API?

Yes, but only for attributes your client owns. Call POST /api/2/attributes/acquire to claim ownership of a custom or supported attribute, then use POST /api/2/attributes/update or POST /api/2/attributes/increment to write daily values. Attributes already owned by another integration cannot be written until they are released.

What insights and correlations are available?

GET /api/2/insights returns the narrative insights Exist generates, GET /api/2/correlations returns the strongest detected attribute pairs with their correlation strength, and GET /api/2/correlations/combo lets you query a specific pair. GET /api/2/averages returns rolling averages for an attribute.

How do I read a user's mood values for the last week through Jentic?

Run pip install jentic, then use the async client to search 'read exist.io attribute values', load the returned GET /api/2/attributes/with-values operation, and execute with attributes=mood and limit=7. Jentic returns the parsed response with no manual auth handling required.

What are the rate limits for the Exist.io API?

The OpenAPI spec does not declare rate limits. Exist.io applies per-user limits in production; treat 429 responses as authoritative and back off using the Retry-After header when present.

Can I limit what my agent is allowed to do with the Exist.io API?

Yes. Because you host Jentic One yourself, your own rules decide which Exist.io operations and credentials the agent may use, so you can allow read-only calls such as GET /api/2/attributes/with-values, GET /api/2/insights, and GET /api/2/correlations while keeping everything else off. Since Exist.io identifies attributes in the request body rather than the URL path, you scope by operation: write actions like POST /api/2/attributes/acquire, /api/2/attributes/update, and /api/2/attributes/increment stay out of the allowed set unless you add them. Your bearer token is injected only for the operations you have approved, so the agent cannot call an endpoint you have not enabled.