API Reference¶

SentriKat provides a comprehensive REST API for all operations.

Two base URLs¶

Most of this reference describes your own installation:

https://your-sentrikat-instance/api

A handful of routes are not on your installation at all. They are on the license server, which is where activation, the heartbeat, releases and the shared knowledge base live:

https://api.sentrikat.com/api/v1

Those are the ones under /api/v1, and each page that describes them says so:

Calling one of these on your own instance returns 404, which is the usual first symptom of using the wrong base URL.

The heartbeat carries counters, knowledge-base state, a data-quality index and the last bundle outcome, never product lists, hosts or CVEs. Every field is listed at sentrikat.com/telemetry.

Authentication¶

There is no bearer or JWT token to request, store or refresh. Which mechanism you use depends on who is calling. See Authentication for the full description.

Signing in as a user¶

Log in once, keep the cookie, and send it with every later call:

# 1. sign in, storing the session cookie
curl -c cookies.txt -X POST https://sentrikat.example.com/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": "your-password"}'

# 2. reuse it
curl -b cookies.txt https://sentrikat.example.com/api/products

The login response carries no token: it reports the signed-in user and any next step (password expiry, 2FA setup). The session lives in the cookie.

API Sections¶

Common Patterns¶

Pagination¶

List endpoints support pagination:

GET /api/products?page=1&per_page=50

Response includes pagination metadata:

{
  "items": [...],
  "total": 156,
  "page": 1,
  "per_page": 50,
  "pages": 4
}

Filtering¶

Most list endpoints support filtering:

GET /api/products?vendor=Microsoft&criticality=5
GET /api/vulnerabilities?priority=critical&ransomware=true

Sorting¶

Sort results with sort and order:

GET /api/products?sort=created_at&order=desc

Error Handling¶

Errors return appropriate HTTP status codes:

Error response format on your own installation (the license-server routes return {"detail": "..."} instead):

{
  "error": "validation_error",
  "message": "Invalid vendor name",
  "details": {
    "field": "vendor",
    "constraint": "required"
  }
}

Rate Limiting¶

Every endpoint sits under a global default, and the busier ones set their own tighter limit on top of it:

Per-endpoint limits are stated on each API page where they differ from the default.

OpenAPI Specification¶

Interactive API documentation available at:

https://your-sentrikat-instance/api/docs

Download OpenAPI spec:

curl https://sentrikat.example.com/api/spec.json