canonical: https://jentic.com/apis/redhat.local/patchman-engine-api

# Redhat Patchman-engine API

API of the Patch application on [cloud.redhat.com](cloud.redhat.com) Syntax of the `filter[name]` query parameters is described in [Filters documentation](https://github.com/RedHatInsights/patchman-engine/wiki/API-custom-filters). The API exposes 21 endpoints secured with apiKey authentication.

## For AI agents

Programmatically show me all applicable advisories for all my systems, show me details an advisory by given advisory name. Covers 21 operations with apiKey authentication.

## Scope

Does not handle payments, communications, or crm - use for analytics only.

## Capabilities

- Show me all applicable advisories for all my systems
- Export applicable advisories for all my systems
- Integrate Patchman-engine API into automated workflows
- Query and filter Patchman-engine API records by parameters
- Monitor Patchman-engine API operational status and events

## Use cases

### Analytics Operations

Use the Patchman-engine API to perform analytics operations programmatically. The API provides 21 endpoints covering core functionality including show me all applicable advisories for all my systems, show me details an advisory by given advisory name, show me systems on which the given advisory is applicable.

Example prompt: Call GET `/api/patch/v1/advisories` to show me all applicable advisories for all my systems

### Automated API Management

Automate API operations by combining multiple Patchman-engine API endpoints. Agents can show me details an advisory by given advisory name and then show me systems on which the given advisory is applicable in a single workflow.

Example prompt: Call GET `/api/patch/v1/advisories/{advisory_id}` to show me details an advisory by given advisory name, then verify the result

### AI Agent Integration via Jentic

AI agents discover and call Patchman-engine API endpoints through Jentic without managing credentials directly. An agent searches for the required operation by intent, receives the matching endpoint schema, and executes the call with Jentic-managed authentication. This eliminates the need to read API documentation or handle apiKey tokens manually.

Example prompt: Search Jentic for 'show me all applicable advisories for all my systems', load the operation schema, and execute with Jentic-managed credentials

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/api/patch/v1/advisories` | Show me all applicable advisories for all my systems |
| GET | `/api/patch/v1/advisories/{advisory_id}` | Show me details an advisory by given advisory name |
| GET | `/api/patch/v1/advisories/{advisory_id}/systems` | Show me systems on which the given advisory is applicable |
| GET | `/api/patch/v1/export/advisories` | Export applicable advisories for all my systems |
| GET | `/api/patch/v1/export/advisories/{advisory_id}/systems` | Export systems for my account |
| GET | `/api/patch/v1/export/packages` | Show me all installed packages across my systems |
| GET | `/api/patch/v1/export/packages/{package_name}/systems` | Show me all my systems which have a package installed |
| GET | `/api/patch/v1/export/systems` | Export systems for my account |

## Key resources

- **api** — Operations related to api

## Why Jentic

- **Setup:** Wiring the Patchman-engine API by hand means learning its apiKey auth, pointing at its host, and calling the versioned `/api/patch/v1` paths yourself. Through Jentic you install once, import the Patchman-engine API from the API Directory, store the API key once, and your agent calls it.
- **Permission scoping:** Patchman-engine puts resource ids in the URL path (for example `/advisories/{advisory_id}` and `/export/packages/{package_name}/systems`), so a rule can pin your agent to specific advisories or packages. Every operation here is a read, so the agent only retrieves advisory, package, and system data you allow.
- **Credential handling:** Your Patchman-engine API key is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list applicable advisories for my systems' or 'export affected systems for an advisory', and Jentic returns the matching Patchman-engine operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Mixpanel** — Alternative analytics API
- **Amplitude** — Alternative analytics API
- **Segment** — Complementary analytics API
- **Pendo** — Complementary analytics API

## FAQ

### What authentication does the Patchman-engine API use?

The Patchman-engine API uses an API key passed in the `x-rh-identity` header. Through Jentic, these credentials are stored encrypted in your Jentic One instance and injected at execution time, so raw secrets never enter the agent context.

### Can I show me all applicable advisories for all my systems with the Patchman-engine API?

Yes. Use the GET `/api/patch/v1/advisories` endpoint. The API returns structured JSON responses that agents can parse and act on directly.

### What are the rate limits for the Patchman-engine API?

Rate limits are not specified in the OpenAPI spec. Check the vendor documentation for current limits. Through Jentic, rate limiting is handled automatically with retry logic built into the execution layer.

### How do I show me all applicable advisories for all my systems through Jentic?

Install the Jentic SDK with pip install jentic, authenticate through Jentic One, the self-hosted execution layer, then search for 'show me all applicable advisories for all my systems'. Jentic returns the matching Patchman-engine API operation with its input schema. Load the schema and execute the call - credentials are injected automatically.

### How many endpoints does the Patchman-engine API have?

The Patchman-engine API exposes 21 endpoints covering API operations.

### Can I limit what my agent is allowed to do with the Patchman-engine API?

Yes. Because you run Jentic One yourself, your own rules decide which Patchman-engine operations and credentials the agent may use. Every Patchman-engine operation is a read, so you can restrict the agent to just retrieving advisory, package, and system data, and since resource ids sit in the URL path (for example `/advisories/{advisory_id}` and `/export/packages/{package_name}/systems`) a rule can pin the agent to specific advisories or packages. The agent can only call the operations you permit with the API key you have stored.