Agentic Fabriq
Egnyte
DOCS & KNOWLEDGE · FILES & DOCS
Files, folders, share links, and permissions in that person’s own workspace.
Connecting Egnyte in practice
The default budget is 1,000 calls a day and 2 calls a second per access token, and throttling arrives as 409 Conflict with a Retry-After rather than 429 — so retry logic keyed on 429 never fires, and 409 also means an ordinary resource conflict. Access tokens expire after 30 days and are revoked the moment the user changes their password.
Scopes that draw scrutiny
no scope parameterA token requested without scope has global access to all APIs, and the consent dialog then reads "Read, write and delete files/folders", "Create, update and delete users", "Generate audit reports", plus link and permission management.Egnyte.userUser Management, so creating, updating and deleting Egnyte users — identity administration rather than file access.Egnyte.permissionThe Permissions API: adds, updates, deletes and reports on folder permissions, so it can reshape who sees what across the domain.Egnyte.auditAudit Reporting, which generates audit reports for the whole domain.Egnyte.launchwebsessionEmbedded UI: launches a web session, so it hands a browser an authenticated Egnyte session.Egnyte.groupGroup Management, which decides collective access rather than individual entitlements.
Rate limits
- Standard API calls: 1,000 per day per token and 2 per second per token. Limits are "enforced per access token, not per API key".
- Plan family ceilings — Business/Essentials: 2 calls/second, 1,000/day, 30,000/month. Enterprise Lite/Elite: 2, 2,000, 60,000. Enterprise/Ultimate: 2, 4,000, 120,000.
- OAuth token endpoint (/puboauth/token): 100 token requests per hour for public apps, 10 per user per hour for internal apps.
- AI APIs: 100 calls per day, 10 per minute and 2 per second per token.
- Headers: X-Accesstoken-Qps-Allotted, X-Accesstoken-Qps-Current, X-Accesstoken-Quota-Allotted and X-Accesstoken-Quota-Current, with the daily counter resetting at 00:00 UTC.
Who has to approve
API access is only available to active Egnyte customers on eligible plans — "Egnyte domains on Trial, Legacy Office, or Team plans are not supported" — and the key has to be registered on the developer portal. Third-party applications must scope their token requests: "Applications will not be approved for production without proper scoping or a valid justification for global access." Administrators can also act as another user through impersonation, and those calls execute in the impersonated user’s context and are logged as that user in audit reports.
Worth knowing
- Throttling is a 409 Conflict with Retry-After, and 409 is also the documented code for "Conflict with an existing resource", so the same status means two unrelated things and has to be disambiguated by the body.
- Tokens last 30 days (expires_in 2592000) and are "immediately revoked if a user changes their password or explicitly revokes access", so 401 is a routine refresh trigger rather than an incident.
- Because limits are per access token rather than per API key, spreading work across users raises throughput and minting more API keys does not.
- Egnyte migrated its API management platform from Mashery to Apigee on 1 October 2025, and prior developers "must create a new account using the same email address" to reach previously created API keys.
Checked against Egnyte API best practices (2026-09-29), Egnyte API authentication and scopes (2026-09-29), Egnyte getting started and plan limits (2026-09-29)
What an agent can do
Each action is granted on its own. An agent allowed to read is not thereby allowed to write, and the scope beside each row is what the acting user must have connected for it to run at all.
Often connected alongside
Put Egnyte behind one governed endpoint.
Same permissions, same audit trail, whatever else you connect next.