canonical: https://jentic.com/apis/redhat.local/patchman-engine

# Redhat Patchman-engine API

The Patchman-engine API is the backend of the Patch application on Red Hat's cloud console, reporting which errata advisories apply to an account's registered RHEL systems. It lists applicable advisories with their advisory_type, severity, synopsis, public_date, and cve_count, and shows which systems each advisory applies to. Per system, it returns applicable advisories, installed packages, and counts of security, bug fix, and enhancement advisories, while package endpoints show installed versions across the fleet. Export endpoints return the same data in bulk, and list endpoints accept filter[name] query parameters and sort fields.

## For AI agents

Find which Red Hat errata advisories apply to which RHEL systems, sort systems by security advisory count, and see installed and updatable packages across the fleet.

## Scope

Does not install updates, run remediation playbooks, or scan non-RHEL hosts. Use for reporting Red Hat advisory applicability, systems, and installed packages only.

## Capabilities

- List applicable errata advisories for all systems, filtered by advisory_type, severity, or public_date
- Show which systems an advisory such as an RHSA security erratum applies to
- Rank systems by rhsa_count, rhba_count, or rhea_count to find the most exposed hosts
- List the advisories and installed packages for one system by inventory_id
- Find every system with a given package installed and the versions in use
- Look up advisory-system pairs for chosen systems and advisories in one request
- Export advisories, systems, and packages in bulk for reporting

## Use cases

### Patch triage agent through Jentic

An operations agent asked 'what needs patching first?' needs the account's real advisory data, not a generic CVE feed. Through Jentic the agent searches for 'list Red Hat advisories affecting my systems', loads the Patch advisories operation with its input schema, and filters by advisory_type and severity while the x-rh-identity header is injected at call time. It then calls the advisory systems operation for the top results to name the hosts that need the update.

Example prompt: Call GET `/api/patch/v1/advisories` with filter[severity] set to critical and sort '-applicable_systems', then GET `/api/patch/v1/advisories/{advisory_id}/systems` for the first three advisories

### Most-exposed systems report

Security teams want a list of hosts ordered by outstanding security errata. The Patch systems list sorts by rhsa_count, rhba_count, or rhea_count and filters on stale and last_upload, so a weekly report can show the systems with the most open security advisories and flag ones that stopped reporting.

Example prompt: Call GET `/api/patch/v1/systems` with sort '-rhsa_count' and limit 20, then report each system's display_name and rhsa_count

### Package exposure lookup

When a vulnerable library is announced, the first question is where it is installed. The Patch package endpoints list every system with a package installed and every installed version of it, and the per-system package list shows whether an update is available on that host.

Example prompt: Call GET `/api/patch/v1/packages/openssl/versions`, then GET `/api/patch/v1/packages/openssl/systems` to list the hosts running each version

### Bulk export for compliance evidence

Auditors ask for proof of patch status across the estate. The Patch export endpoints return applicable advisories, systems, and installed packages in bulk, including per-system advisory and package exports by inventory_id, which can be archived as evidence alongside the change records.

Example prompt: Call GET `/api/patch/v1/export/systems` and GET `/api/patch/v1/export/advisories` and save both results for the audit file

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | `/api/patch/v1/advisories` | List applicable advisories |
| GET | `/api/patch/v1/advisories/{advisory_id}/systems` | List systems an advisory applies to |
| GET | `/api/patch/v1/systems` | List systems |
| GET | `/api/patch/v1/systems/{inventory_id}/advisories` | List advisories for a system |
| GET | `/api/patch/v1/packages/{package_name}/systems` | List systems with a package installed |
| POST | `/api/patch/v1/views/advisories/systems` | View advisory-system pairs |
| GET | `/api/patch/v1/export/advisories` | Export applicable advisories |

## Key resources

- **Advisories** — Applicable errata with type, severity, synopsis, public date, CVE count, and the systems they apply to
- **Systems** — Registered systems with advisory counts, packages, staleness, and per-system advisories, deletable by inventory_id
- **Packages** — Installed packages across systems, their versions, and the systems running them
- **Views** — Advisory-system and system-advisory pairs for chosen sets of systems and advisories
- **Export** — Bulk exports of advisories, systems, and packages

## AI readiness

This API is usable in Jentic One now. Its AI-readiness score against Jentic's framework shows where it stands today and where improvements would make it even easier for agents to use.

- **Score:** 63 / 100
- **Maturity:** AI-Aware
- **Dimensions:**
  - Foundational Compliance: 99 / 100
  - Developer Experience & Jentic Compatibility: 55 / 100
  - AI-Readiness & Agent Experience: 44 / 100
  - Agent Usability: 94 / 100
  - Security: 50 / 100
  - AI Discoverability: 100 / 100
- **View full report:** https://jentic.com/apis/redhat.local/patchman-engine/scorecard
- **How the score is calculated:** https://docs.jentic.com/reference/api-readiness-framework/overview/
- **More about the dimensions:** https://docs.jentic.com/reference/api-readiness-framework/specification/#dimensional-model-overview

### Score it yourself

Every API in the directory is allowlisted, so you can re-score it with no key required.

- **Score your own API:** https://jentic.com/scorecard.md
- **Scoring CLI agent skill:** https://github.com/jentic/jentic-api-scorecard/blob/main/skills/jentic-api-scorecard/SKILL.md

```sh
npx @jentic/api-scorecard-cli score <openapi-url>
```

## Why Jentic

- **Setup:** Wiring the Patch API by hand means building the x-rh-identity header, replacing the spec's placeholder host, and learning its filter[name] query syntax and sort fields. Through Jentic you install once, import the Patchman-engine API from the API Directory, store the header value once, and your agent calls it.
- **Permission scoping:** Patch puts the system's inventory_id and the advisory_id in the URL path (`/api/patch/v1/systems/{inventory_id}/...`), so a rule can bound your agent to one system or one advisory and the operations you pick. You choose the operations it may call, so the destructive one, system deletion, is not included unless you add it.
- **Credential handling:** Your x-rh-identity value is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'list Red Hat advisories affecting my systems' or 'find systems with a package installed', and Jentic returns the matching Patch operation with its input schema, including the filter and sort parameters.

## Related APIs

- **Tenable Vulnerability Management API (Nessus)** — Network vulnerability scanning across mixed operating systems
- **Cisco PSIRT openVuln API** — Security advisories for Cisco products
- **AIS CVE Intelligence API** — CVE details and threat intelligence
- **Catalog Inventory** — Red Hat console inventory of sources and service offerings

## FAQ

### What authentication does the Patchman-engine API use?

Per its OpenAPI spec, every operation uses an apiKey scheme named RhIdentity, sent in the x-rh-identity request header. Through Jentic that header value is stored by your own instance and attached at call time, so the agent never handles it.

### Can I find which systems an advisory applies to?

Yes. GET `/api/patch/v1/advisories/{advisory_id}/systems` lists the systems an advisory applies to, and GET `/api/patch/v1/export/advisories/{advisory_id}/systems` returns the same set in bulk. For several advisories and systems at once, POST `/api/patch/v1/views/advisories/systems` takes arrays of advisories and systems in the body.

### What are the rate limits for the Patchman-engine API?

The OpenAPI spec does not specify rate limits. Check the Patchman-engine project documentation at https://github.com/RedHatInsights/patchman-engine for current guidance.

### Is there a Patchman-engine MCP server?

You don't need an MCP server to give your agent the Patch API. Jentic connects it directly from the API Directory: import it, store your identity header once, and your agent calls the advisory, system, and package operations on demand without loading extra tool definitions into its context.

### How do I list critical advisories through Jentic?

Search Jentic for 'list Red Hat advisories affecting my systems', load GET `/api/patch/v1/advisories`, and run it with filter[severity] and a sort such as -public_date. Each result carries its synopsis, advisory_type, and applicable_systems count. To run it on your own infrastructure, install Jentic One from its GitHub repo.

### What base URL does this spec use?

The spec's servers list http://redhat.local and a relative root, which are placeholders. Its description places the Patch application on cloud.redhat.com, and all paths sit under `/api/patch/v1`, so set the host for your deployment when you import it.

### Can I limit what my agent is allowed to do with the Patchman-engine API?

Yes. For instance, allow only the GET operations under `/api/patch/v1/advisories` and `/api/patch/v1/systems`, so the agent can triage advisories and systems but cannot call DELETE `/api/patch/v1/systems/{inventory_id}`, and every call it makes is logged.