What authentication does the KEYVOX API use?

An HMAC signature passed in the authorization header. The signing key is issued from the KEYVOX partner console and signs each request payload. Through Jentic, the signing key is held in the encrypted vault and the signature is computed per call so the raw key never enters the agent's context.

Can I issue a time-limited PIN with the KEYVOX API?

Yes. POST /v1/createLockPin with the unit identifier and the booking window returns a PIN that is valid only for that window. The same pattern applies to lockers via POST /v1/createLockerPin, where the PIN is scoped to the chosen locker.

What are the rate limits for the KEYVOX API?

The OpenAPI spec does not publish a rate limit. With seven endpoints and request volumes typically driven by booking events, throughput rarely hits a hard limit. If you receive HTTP 429, back off exponentially and retry the PIN-creation call.

How do I trigger a remote unlock through Jentic?

Search Jentic for 'unlock a keyvox lock' to find POST /v1/unlock, load its schema, and execute it with the unit identifier and booking context. The Jentic flow is pip install jentic, then client.search, client.load, and client.execute. Jentic injects the HMAC signature for you.

Can I read recent lock events with the KEYVOX API?

Yes. POST /v1/locks/events returns recent events for the supplied unit identifiers, which you can pair with /v1/getBookingOrders to link each unlock to the booking that authorised it. This is the data set used for access auditing.

Can I limit what my agent is allowed to do with the KEYVOX API?

Yes. Because you run Jentic One yourself, you decide which KEYVOX operations your agent may call and which credential it signs with, so you can grant read-only actions like getUnits and getBookingOrders while withholding the rest. KEYVOX carries its targets in the POST request body rather than in the URL path, so a write action such as unlock, createLockPin, or createLockerPin is only available to the agent if you add it to that set. Your HMAC signing key is stored once by your own instance and applied per request, so the agent never handles the raw key while working inside the boundaries you set.