What authentication does the Pennylane API use?

The Pennylane API uses OAuth 2.0 with the authorization code flow. The authorization URL is https://app.pennylane.com/oauth/authorize and the token URL is https://app.pennylane.com/oauth/token. Through Jentic, OAuth token acquisition and refresh are handled automatically so agents do not manage the flow directly.

Can I create journal entries with multiple line items?

Yes. POST /journals accepts a structured payload with multiple line items, each specifying an account code, amount, and debit/credit direction. This supports standard double-entry bookkeeping where debits equal credits within each journal entry.

How do I manage webhook subscriptions through Jentic?

Search Jentic for 'subscribe to accounting events' to discover the POST /webhook_subscription operation. Load the schema and execute with your callback URL. The API also supports GET /webhook_subscription to check current configuration, PUT to update, and DELETE to remove subscriptions.

What are the rate limits for the Pennylane API?

The OpenAPI specification does not document specific rate limits. Implement standard retry logic with exponential backoff on HTTP 429 responses. The API is designed for integration use cases rather than high-frequency bulk operations.

Can I list and filter journal entries by date range?

GET /journals returns journal entries with support for query parameters. The endpoint enables retrieval of entries for reconciliation, reporting, or audit purposes. Individual entries can be fetched by ID via GET /journals/{id}.

Can I limit what my agent is allowed to do with the Pennylane API?

Yes. Because Jentic One is self-hosted, your own rules decide which Pennylane operations and credentials the agent may use, so it can read journal entries and ledger accounts without being able to create them or subscribe a webhook unless you add those operations. Since Pennylane puts the journal id in the URL path at GET /journals/{id}, a rule can pin the agent to a specific journal rather than the whole account. The stored OAuth token is injected only for the calls you allow, so writes like POST /journals, POST /ledger_accounts, and POST /webhook_subscription happen only when you have explicitly granted them.