What authentication does the Katana API use?

The API uses HTTP bearer tokens. Clients call POST /oauth/token to exchange Katana credentials for a bearer, then send `Authorization: Bearer {token}` on every subsequent call. Through Jentic the credential exchange happens server-side and the bearer never reaches the agent.

Can I create a sales order with multiple line items in Katana?

Yes. POST /sales-orders accepts a customer ID, location ID, and an array of line items referencing variants and quantities. Resolve unknown variants first via GET /api/Variants and unknown customers via POST /api/Customers/findOne to avoid creating duplicate records.

What are the rate limits for the Katana API?

Katana applies per-tenant throttling and returns HTTP 429 on bursts. The platform is sized for SMB manufacturing traffic, so steady polling for stock and order status (every minute or two) sits well within the limit. Use cached /api/taxRates and /api/Locations responses to keep request volume down.

How do I create a Katana sales order through Jentic?

Run `pip install jentic` and search Jentic for 'create a Katana sales order'. Jentic returns the schema for POST /sales-orders; supply the customer ID, location ID, and line item array, then execute. The bearer token is injected from your Jentic One instance.

Does the Katana API expose stock levels per variant?

Yes. GET /api/Variants returns each variant with its on-hand and committed quantities per location, which lets a quoting tool reject orders that would oversell available stock at the chosen warehouse.

Is the Katana API included in every plan?

API access is included with Katana paid plans. The trial tier is limited and high-volume integrations may need an Advanced plan to lift API quotas.

Can I limit what my agent is allowed to do with the Katana API?

Yes. Because you run Jentic One yourself, you decide which Katana operations the agent may call, so you can grant read-only access to variant stock via GET /api/Variants and tax and location lookups via GET /api/taxRates and /api/Locations while withholding writes. Katana's writes post to collection endpoints like /sales-orders and /api/Customers rather than a resource id in the path, so you scope by operation, allowing sales-order creation without also allowing customer creation unless you add it. The agent can only invoke the operations you include, and the stored OAuth credential is injected at execution rather than exposed to the agent.