Skip to content

Authentication API

SentriKat uses three distinct authentication mechanisms — pick the one that matches the caller:

Caller Mechanism
Browser UI / admin API Session cookie (HttpOnly, SameSite) established at login, plus a CSRF token on state-changing requests. There is no bearer/JWT token to store or refresh.
Agents X-Agent-Key header carrying an agent key (see API Keys).
license-server bridge X-Provision-Key header (server-to-server provisioning).

Login

Authenticate and start a session.

POST /api/auth/login
Content-Type: application/json

{
  "username": "admin",
  "password": "your-password"
}

On success the server sets an HttpOnly session cookie and the browser is authenticated from then on — the cookie is sent automatically, together with a CSRF token on state-changing requests. There is no access token in the response to store. Retrieve the signed-in user with GET /api/auth/status.

Logout

End the current session (clears the session cookie).

POST /api/auth/logout

Response: 

{
  "message": "Successfully logged out"
}

Current User

Get information about the authenticated user (uses the session cookie).

GET /api/auth/status

Response: 

{
  "id": 1,
  "username": "admin",
  "email": "[email protected]",
  "full_name": "Administrator",
  "role": "super_admin",
  "organizations": [
    {
      "id": 1,
      "name": "default",
      "role": "org_admin"
    }
  ],
  "created_at": "2024-01-01T00:00:00Z",
  "last_login": "2024-02-01T12:00:00Z"
}

API Keys

For agent and automation use. All /api/agent-keys endpoints require an authenticated admin session (browser session cookie + CSRF).

Create API Key

POST /api/agent-keys
Content-Type: application/json

{
  "name": "CI/CD Pipeline",
  "key_type": "server",
  "expires_at": "2025-12-31T23:59:59Z",
  "permissions": ["products:read", "products:write"],
  "scan_vscode_extensions": false,
  "scan_code_dependencies": false
}
Field Type Default Description
name string required Descriptive name for the key
key_type string "server" "server" for infrastructure or "client" for end-user workstations
expires_at datetime null Optional expiration timestamp
permissions string[] [] Permission scopes
scan_vscode_extensions boolean false Enable VS Code extension scanning for agents using this key
scan_code_dependencies boolean false Enable code dependency scanning (pip, npm, gem, cargo, go, composer)

Response: 

{
  "id": 1,
  "name": "CI/CD Pipeline",
  "key": "sk_agent_xxxxxxxxxxxx",
  "key_prefix": "sk_agent_xxxxxxxxxxxx",
  "key_type": "server",
  "scan_vscode_extensions": false,
  "scan_code_dependencies": false,
  "expires_at": "2025-12-31T23:59:59Z",
  "created_at": "2024-01-01T00:00:00Z"
}

Key Security

The full API key is only shown once. Store it securely.

Key Type

Use "server" for infrastructure (servers, CI/CD, containers) and "client" for end-user machines (developer workstations, laptops). The dashboard provides a toggle to filter vulnerabilities by key type.

List API Keys

GET /api/agent-keys

Revoke API Key

DELETE /api/agent-keys/{id}

Using Agent Keys

Agents authenticate with the X-Agent-Key header:

curl https://sentrikat.example.com/api/agent/inventory \
  -H "X-Agent-Key: sk_agent_xxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"hostname": "server-01", "software": [...]}'