Install Jentic One Beta

Connect the Patchman-engine API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Patchman-engine API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fredhat.local%2Fpatchman-engine" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fredhat.local%2Fpatchman-engine" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Patchman-engine API.

List applicable errata advisories for all systems, filtered by advisory_type, severity, or public_date

Show which systems an advisory such as an RHSA security erratum applies to

Rank systems by rhsa_count, rhba_count, or rhea_count to find the most exposed hosts

List the advisories and installed packages for one system by inventory_id

GET STARTED

Start building with Patchman-engine API

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use Patchman-engine API for, with concrete tasks.

★ Patch triage agent through Jentic

An operations agent asked 'what needs patching first?' needs the account's real advisory data, not a generic CVE feed. Through Jentic the agent searches for 'list Red Hat advisories affecting my systems', loads the Patch advisories operation with its input schema, and filters by advisory_type and severity while the x-rh-identity header is injected at call time. It then calls the advisory systems operation for the top results to name the hosts that need the update.

Call GET /api/patch/v1/advisories with filter[severity] set to critical and sort '-applicable_systems', then GET /api/patch/v1/advisories/{advisory_id}/systems for the first three advisories

Most-exposed systems report

Security teams want a list of hosts ordered by outstanding security errata. The Patch systems list sorts by rhsa_count, rhba_count, or rhea_count and filters on stale and last_upload, so a weekly report can show the systems with the most open security advisories and flag ones that stopped reporting.

Call GET /api/patch/v1/systems with sort '-rhsa_count' and limit 20, then report each system's display_name and rhsa_count

Package exposure lookup

When a vulnerable library is announced, the first question is where it is installed. The Patch package endpoints list every system with a package installed and every installed version of it, and the per-system package list shows whether an update is available on that host.

Call GET /api/patch/v1/packages/openssl/versions, then GET /api/patch/v1/packages/openssl/systems to list the hosts running each version

Bulk export for compliance evidence

Auditors ask for proof of patch status across the estate. The Patch export endpoints return applicable advisories, systems, and installed packages in bulk, including per-system advisory and package exports by inventory_id, which can be archived as evidence alongside the change records.

Call GET /api/patch/v1/export/systems and GET /api/patch/v1/export/advisories and save both results for the audit file

Key Endpoints

21 endpoints — the patchman-engine api is the backend of the patch application on red hat's cloud console, reporting which errata advisories apply to an account's registered rhel systems.

METHOD

PATH

DESCRIPTION

GET

/api/patch/v1/advisories

List applicable advisories

GET

/api/patch/v1/advisories/{advisory_id}/systems

List systems an advisory applies to

GET

/api/patch/v1/systems

List systems

GET

/api/patch/v1/systems/{inventory_id}/advisories

List advisories for a system

GET

/api/patch/v1/packages/{package_name}/systems

List systems with a package installed

POST

/api/patch/v1/views/advisories/systems

View advisory-system pairs

GET

/api/patch/v1/export/advisories

Export applicable advisories

GET

/api/patch/v1/advisories

List applicable advisories

GET

/api/patch/v1/advisories/{advisory_id}/systems

List systems an advisory applies to

GET

/api/patch/v1/systems

List systems

GET

/api/patch/v1/systems/{inventory_id}/advisories

List advisories for a system

GET

/api/patch/v1/packages/{package_name}/systems

List systems with a package installed

POST

/api/patch/v1/views/advisories/systems

View advisory-system pairs

GET

/api/patch/v1/export/advisories

Export applicable advisories

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring the Patch API by hand means building the x-rh-identity header, replacing the spec's placeholder host, and learning its filter[name] query syntax and sort fields. Through Jentic you install once, import the Patchman-engine API from the API Directory, store the header value once, and your agent calls it.

Permission scoping

Patch puts the system's inventory_id and the advisory_id in the URL path (/api/patch/v1/systems/{inventory_id}/...), so a rule can bound your agent to one system or one advisory and the operations you pick. You choose the operations it may call, so the destructive one, system deletion, is not included unless you add it.

Credential isolation

Your x-rh-identity value is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'list Red Hat advisories affecting my systems' or 'find systems with a package installed', and Jentic returns the matching Patch operation with its input schema, including the filter and sort parameters.

FAQs

Specific to using Patchman-engine API through Jentic.

What authentication does the Patchman-engine API use?

Per its OpenAPI spec, every operation uses an apiKey scheme named RhIdentity, sent in the x-rh-identity request header. Through Jentic that header value is stored by your own instance and attached at call time, so the agent never handles it.

Can I find which systems an advisory applies to?

Yes. GET /api/patch/v1/advisories/{advisory_id}/systems lists the systems an advisory applies to, and GET /api/patch/v1/export/advisories/{advisory_id}/systems returns the same set in bulk. For several advisories and systems at once, POST /api/patch/v1/views/advisories/systems takes arrays of advisories and systems in the body.

What are the rate limits for the Patchman-engine API?

The OpenAPI spec does not specify rate limits. Check the Patchman-engine project documentation at https://github.com/RedHatInsights/patchman-engine for current guidance.

Is there a Patchman-engine MCP server?

You don't need an MCP server to give your agent the Patch API. Jentic connects it directly from the API Directory: import it, store your identity header once, and your agent calls the advisory, system, and package operations on demand without loading extra tool definitions into its context.

How do I list critical advisories through Jentic?

Search Jentic for 'list Red Hat advisories affecting my systems', load GET /api/patch/v1/advisories, and run it with filter[severity] and a sort such as -public_date. Each result carries its synopsis, advisory_type, and applicable_systems count. To run it on your own infrastructure, install Jentic One from its GitHub repo.

What base URL does this spec use?

The spec's servers list http://redhat.local and a relative root, which are placeholders. Its description places the Patch application on cloud.redhat.com, and all paths sit under /api/patch/v1, so set the host for your deployment when you import it.

Can I limit what my agent is allowed to do with the Patchman-engine API?

Yes. For instance, allow only the GET operations under /api/patch/v1/advisories and /api/patch/v1/systems, so the agent can triage advisories and systems but cannot call DELETE /api/patch/v1/systems/{inventory_id}, and every call it makes is logged.

Redhat Patchman-engine API

Browse all Redhat APIs

AI ReadinessAI-Aware (B-)63/100

See full scorecard

Community OpenAPI document · agent-readySecurityVulnerability ManagementapiKey21 EndpointsREST

Know of an official OpenAPI document? Contribute it →

For Agents

Find which Red Hat errata advisories apply to which RHEL systems, sort systems by security advisory count, and see installed and updatable packages across the fleet.

Use for: Find all critical security advisories affecting my systems, Which systems still need RHSA-2024:1234, List systems with the most security advisories, Show the installed packages on a host by inventory id

Not supported: Does not install updates, run remediation playbooks, or scan non-RHEL hosts. Use for reporting Red Hat advisory applicability, systems, and installed packages only.

The Patchman-engine API is the backend of the Patch application on Red Hat's cloud console, reporting which errata advisories apply to an account's registered RHEL systems. It lists applicable advisories with their advisory_type, severity, synopsis, public_date, and cve_count, and shows which systems each advisory applies to. Per system, it returns applicable advisories, installed packages, and counts of security, bug fix, and enhancement advisories, while package endpoints show installed versions across the fleet. Export endpoints return the same data in bulk, and list endpoints accept filter[name] query parameters and sort fields.

Jentic One on Github View OpenAPI Document

Show dimension breakdown

Foundational Compliance

Base layer of spec validity and structural soundness.

Grade: A+Signals: 4

97%

Lint Results

Aggregated quality score from linter diagnostics, weighted by severity.

100%

Resolution Completeness

Percentage of `$ref` references that resolve successfully.

100%

Specification Validity

Checks whether the API description parses successfully and conforms to its declared specification (e.g., OpenAPI).

100%

Structural Integrity

Structural correctness score based on schema issues using logarithmic dampening.

Developer Experience & Jentic Compatibility

Clarity, completeness, and ingestion readiness for developers and tooling.

Grade: CSignals: 4

Example Density

How richly the API is illustrated with examples.

100%

Example Validity

Percentage of examples that conform to their schemas.

25%

Response Coverage

Percentage of operations with complete response definitions (success, client error, server error).

93%

Tooling Readiness

Health of API ingestion, bundling, and resolution within Jentic pipelines.

AI-Readiness & Agent Experience

Semantic breadth, depth, and agent comprehension for AI systems.

Grade: DSignals: 4

34%

Description Coverage

Coverage of descriptions across API elements.

Error Standardization

Coverage of RFC 9457 Problem Details for error responses.

90%

OperationId Quality

Coverage, uniqueness, and casing consistency of operationIds for AI inference.

51%

Summary Coverage

Coverage of summaries across operations/tags/info.

Agent Usability

Functional utility, complexity comfort, and AI orchestration readiness.

Grade: A+Signals: 1

94%

Complexity Comfort

Agent comfort level based on API operational and structural complexity.

Security

Trust, risk posture, and security compliance.

Grade: C-Signals: 1

50%

Authentication Strength

Average quality of security schemes based on authentication method strength (weakest link for OAuth2).

100

AI Discoverability

Findability, semantic richness, and reasoning readiness.

Grade: A+Signals: 1

100%

Descriptive Richness

Clarity and depth of descriptions across API elements.

Connect the Patchman-engine API to your agent

Capabilities

Start building with Patchman-engine API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs

Redhat Patchman-engine API

Jentic AI Readiness Score

Patchman-engine API

Foundational Compliance

Lint Results

Resolution Completeness

Specification Validity

Structural Integrity

Developer Experience & Jentic Compatibility

Example Density

Example Validity

Response Coverage

Tooling Readiness

AI-Readiness & Agent Experience

Description Coverage

Error Standardization

OperationId Quality

Summary Coverage

Agent Usability

Complexity Comfort

Security

Authentication Strength

AI Discoverability

Descriptive Richness