// Getting Started
REST API v2
The SentinelPRO IA REST API gives you programmatic access to threats, assets, incidents, compliance data, and platform controls. Build integrations, automate response workflows, or embed security telemetry directly into your own dashboards.
API VERSION
v2.0 — Stable
PROTOCOL
HTTPS / TLS 1.3
FORMAT
JSON (UTF-8)
AUTH METHOD
Bearer Token
SPEC
OpenAPI 3.1
CHANGELOG
v2 — Sep 2025
⬡ NOTE — API v1 was removed in platform v4.0 (January 2026). All integrations must use v2 endpoints. See the migration guide.
// Authentication
API Keys
All API requests require a valid API key passed as a Bearer token in the Authorization header. Keys are scoped per license and tied to your plan permissions.
HEADER FORMAT
Authorization: Bearer sp_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
⚠ SECURITY — Never expose API keys in client-side code, public repos, or logs. Rotate keys immediately if compromised via Settings → API Keys → Revoke.
| Key Prefix | Type | Scope |
|---|---|---|
| sp_live_ | Production | Full API access per plan permissions |
| sp_test_ | Sandbox | Read-only, mock responses, no real actions |
| sp_whk_ | Webhook | Verify incoming webhook signatures only |
// Base URL
Endpoints
PRODUCTION
https://api.sentinelpro-ai.com/v2
SANDBOX
https://sandbox.sentinelpro-ai.com/v2
All endpoints return Content-Type: application/json. Dates use ISO 8601 (UTC). IDs are prefixed strings (e.g. thr_01HXYZ).
// Rate Limits
Request Quotas
Limits are applied per API key per minute. Exceeded limits return HTTP 429. Remaining quota is returned in response headers on every request.
STARTER
120 req/min
1,000 req/day max
PROFESSIONAL
600 req/min
50,000 req/day max
ENTERPRISE
Unlimited
Custom SLA available
| Response Header | Description |
|---|---|
| X-RateLimit-Limit | Your plan's max requests per minute |
| X-RateLimit-Remaining | Requests remaining in current window |
| X-RateLimit-Reset | Unix timestamp when window resets |
| Retry-After | Seconds to wait after a 429 response |
// Errors
Error Codes
All errors return a consistent JSON body with error.code and error.message.
{
"error": {
"code": "invalid_api_key",
"message": "The API key provided is invalid or has been revoked.",
"status": 401,
"request_id": "req_01HXY9ABCDEF"
}
}
400
BAD_REQUEST
Missing or invalid request parameters.
401
UNAUTHORIZED
Invalid or missing API key.
403
FORBIDDEN
Key lacks permission for this action.
404
NOT_FOUND
Resource does not exist.
429
RATE_LIMITED
Too many requests. See Retry-After header.
500
INTERNAL_ERROR
Platform error. Retry with exponential backoff.
// Threats
Threat Endpoints
Query, triage, and respond to active threats detected by the SentinelPRO IA engine.
GET
/threats
List all active threats
▶
QUERY PARAMETERS
| Parameter | Type | Description |
|---|---|---|
| severityOPT | string | Filter: critical, high, medium, low |
| statusOPT | string | active, resolved, investigating |
| limitOPT | integer | Max results per page (default: 50, max: 200) |
| cursorOPT | string | Pagination cursor from previous response |
| fromOPT | ISO 8601 | Filter threats detected after this timestamp |
RESPONSE
{
"data": [
{
"id": "thr_01HXYZ9ABCDEF",
"title": "Suspicious PowerShell execution",
"severity": "critical",
"status": "active",
"host": "DESKTOP-04.acme.local",
"mitre_tactic": "Execution",
"mitre_technique": "T1059.001",
"detected_at": "2026-03-09T08:14:32Z",
"score": 97
}
],
"pagination": {
"cursor": "eyJpZCI6InRocl8wMUhYWVoifQ==",
"has_more": true,
"total": 47
}
}
GET
/threats/{id}
Get a single threat with full detail
▶
PATH PARAMETERS
| Parameter | Type | Description |
|---|---|---|
| idREQ | string | Threat ID (prefix: thr_) |
RESPONSE
{
"id": "thr_01HXYZ9ABCDEF",
"title": "Suspicious PowerShell execution",
"severity": "critical",
"status": "active",
"host": "DESKTOP-04.acme.local",
"process": { "name": "powershell.exe", "pid": 4892, "parent": "cmd.exe" },
"mitre": { "tactic": "Execution", "technique": "T1059.001", "subtechnique": "PowerShell" },
"iocs": ["185.220.101.47", "c2.malicious-domain.net"],
"timeline": [...],
"detected_at": "2026-03-09T08:14:32Z"
}
POST
/threats/{id}/resolve
Mark a threat as resolved
▶
REQUEST BODY
| Field | Type | Description |
|---|---|---|
| resolutionREQ | string | mitigated, false_positive, accepted_risk |
| noteOPT | string | Free-text analyst note (max 1000 chars) |
POST
/threats/{id}/kill
Kill malicious process on endpoint
▶
⚠ DESTRUCTIVE — This action immediately terminates the process. Requires Professional or Enterprise plan.
REQUEST BODY
| Field | Type | Description |
|---|---|---|
| confirmREQ | boolean | Must be true to execute |
| isolate_hostOPT | boolean | Also isolate the endpoint from network |
// Assets
Asset Endpoints
GET
/assets
List all monitored assets
▶
QUERY PARAMETERS
| Parameter | Type | Description |
|---|---|---|
| typeOPT | string | endpoint, cloud_resource, domain, ip |
| risk_score_minOPT | integer | Filter assets with risk score ≥ this value (0–100) |
RESPONSE
{
"data": [
{
"id": "ast_01HXYZ9CLOUD",
"type": "cloud_resource",
"name": "prod-data-bucket",
"provider": "aws",
"region": "eu-west-1",
"risk_score": 88,
"exposures": ["public_read_acl", "no_versioning"],
"last_scanned": "2026-03-09T06:00:00Z"
}
],
"pagination": { "cursor": null, "has_more": false, "total": 1 }
}
POST
/assets/{id}/scan
Trigger an immediate scan of an asset
▶
Queues an immediate full scan. Returns a scan job ID. Poll GET /scans/{job_id} for status.
{
"job_id": "scn_01HXY2BCDEFG",
"status": "queued",
"estimated_duration_seconds": 45
}
// Incidents
Incident Endpoints
GET
/incidents
List all incidents
▶
{
"data": [
{
"id": "inc_01HXYZ9INC01",
"title": "Lateral movement detected — DESKTOP-04",
"severity": "critical",
"status": "investigating",
"assignee": "[email protected]",
"threat_count": 4,
"created_at": "2026-03-09T08:20:00Z",
"updated_at": "2026-03-09T09:11:00Z"
}
],
"pagination": { "cursor": null, "has_more": false, "total": 1 }
}
POST
/incidents
Create a new incident manually
▶
REQUEST BODY
| Field | Type | Description |
|---|---|---|
| titleREQ | string | Incident title (max 200 chars) |
| severityREQ | string | critical, high, medium, low |
| threat_idsOPT | array | Array of thr_ IDs to link |
| assigneeOPT | string | Email of assigned analyst |
// Webhooks
Webhook Events
Subscribe to real-time events via HTTPS POST to your endpoint. Payloads are signed with your webhook secret using HMAC-SHA256 in the X-SentinelPRO-Signature header.
threat.detected
Fires when the threat engine confirms a new threat above your configured severity threshold.
threat.resolved
Fires when a threat transitions to resolved, false_positive, or accepted_risk status.
threat.escalated
Fires when a threat severity is upgraded (e.g. medium → critical) based on new signals.
incident.created
Fires when a new incident is opened (manually or auto-correlated).
incident.updated
Fires on any incident field change: status, assignee, severity, or new threat linked.
asset.risk_changed
Fires when an asset's risk score crosses a configured threshold.
compliance.failing
Fires when a compliance framework control drops below passing threshold.
license.expiring
Fires 30, 14, and 7 days before license expiry.
// Pagination
Cursor-Based Pagination
All list endpoints use cursor-based pagination. Pass the cursor value from a response's pagination object as a query parameter to fetch the next page.
{
"pagination": {
"cursor": "eyJpZCI6InRocl8wMUhYWVoifQ==", // pass as ?cursor= in next request
"has_more": true, // false = last page
"total": 247 // total records matching query
}
}
// SDKs
Official Client Libraries
All SDKs are open-source, auto-generated from the OpenAPI 3.1 spec, and published under the MIT license.
// Live Tester
Try the API
⬡ API REQUEST SIMULATOR