What authentication does the Kantata OX API use?

The API uses HTTP bearer tokens. Each request must include `Authorization: Bearer {token}` where the token is generated from the Kantata OX account's API settings. Through Jentic the token is stored encrypted in the vault and scoped per agent execution, so the raw bearer never appears in the agent's context.

Can I disable a former employee's account membership programmatically?

Yes. POST /account_memberships/{id}/disable disables a membership without deleting historical time, expense, and assignment data. Use the matching /account_memberships/{id}/enable endpoint to reverse the change if the person rejoins.

What are the rate limits for the Kantata OX API?

The platform applies per-account throttling and returns HTTP 429 when bursts exceed the contract limit. Exact ceilings depend on the customer's Kantata plan - check with your account manager before scaling automation traffic, and use /subscribed_events instead of polling to stay well under the limit.

How do I subscribe to Kantata events through Jentic?

Run `pip install jentic` and search Jentic for 'subscribe to Kantata events'. Jentic returns the schema for POST /subscribed_events; supply the event type from /subscribed_events/event_types and a target webhook URL, then execute to register.

Why does the Kantata OX API live on api.mavenlink.com?

Kantata OX was previously called Mavenlink. The product rebranded but the API host did not change to preserve existing integrations, so the base URL remains https://api.mavenlink.com/api/v1. All v1 endpoints are first-class on the current Kantata OX product.

Is the Kantata OX API included in every plan?

API access is included in Kantata OX paid plans but not surfaced in trial accounts. Enterprise customers can request additional rate-limit headroom and event subscriptions through their account manager.

Can I limit what my agent is allowed to do with the Kantata OX API?

Yes. Jentic One is self-hosted, so your own rules decide which Kantata OX operations and credentials the agent may use. Because the membership id sits in the URL path (/account_memberships/{id}), you can pin the agent to one account membership for reads and updates, and you choose which operations it can call. A state-changing operation like disabling a membership via POST /account_memberships/{id}/disable is not available to the agent unless you add it.