API Reference¶

SentriKat provides a comprehensive REST API for all operations.

Two base URLs¶

Most of this reference describes your own installation:

https://your-sentrikat-instance/api

A handful of routes are not on your installation at all. They are on the license server, which is where activation, the heartbeat, releases and the shared knowledge base live:

https://portal.sentrikat.com/api/v1

Those are the ones under /api/v1, and each page that describes them says so:

Calling one of these on your own instance returns 404, which is the usual first symptom of using the wrong base URL.

Authentication¶

There is no bearer or JWT token to request, store or refresh. Which mechanism you use depends on who is calling. See Authentication for the full description.

Signing in as a user¶

Log in once, keep the cookie, and send it with every later call:

# 1. sign in, storing the session cookie
curl -c cookies.txt -X POST https://sentrikat.example.com/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": "your-password"}'

# 2. reuse it
curl -b cookies.txt https://sentrikat.example.com/api/products

The login response carries no token: it reports the signed-in user and any next step (password expiry, 2FA setup). The session lives in the cookie.

API Sections¶

Common Patterns¶

Pagination¶

List endpoints support pagination:

GET /api/products?page=1&per_page=50

Response includes pagination metadata:

{
  "items": [...],
  "total": 156,
  "page": 1,
  "per_page": 50,
  "pages": 4
}

Filtering¶

Most list endpoints support filtering:

GET /api/products?vendor=Microsoft&criticality=critical
GET /api/vulnerabilities?priority=critical&ransomware=true

Sorting¶

Sort results with sort and order:

GET /api/products?sort=created_at&order=desc

Error Handling¶

Errors return appropriate HTTP status codes:

Error response format:

{
  "error": "validation_error",
  "message": "Invalid vendor name",
  "details": {
    "field": "vendor",
    "constraint": "required"
  }
}

Rate Limiting¶

Every endpoint sits under a global default, and the busier ones set their own tighter limit on top of it:

Per-endpoint limits are stated on each API page where they differ from the default.

OpenAPI Specification¶

Interactive API documentation available at:

https://your-sentrikat-instance/api/docs

Download OpenAPI spec:

curl https://sentrikat.example.com/api/spec.json