Authentication API¶

SentriKat uses three distinct authentication mechanisms. Pick the one that matches the caller:

Caller	Mechanism
Browser UI / admin API	Session cookie (HttpOnly, SameSite) established at login, plus a CSRF token on state-changing requests. There is no bearer/JWT token to store or refresh.
Agents	`X-Agent-Key` header carrying an agent key (see API Keys).
license-server bridge	`X-Provision-Key` header (server-to-server provisioning).

Authenticate and start a session.

POST /api/auth/login
Content-Type: application/json

{
  "username": "admin",
  "password": "your-password"
}

On success the server sets an HttpOnly session cookie and the browser is authenticated from then on. The cookie is sent automatically, together with a CSRF token on state-changing requests. There is no access token in the response to store. Retrieve the signed-in user with GET /api/auth/status.

Logout¶

End the current session (clears the session cookie).

POST /api/auth/logout

Response:

{
  "success": true,
  "redirect": "/login"
}

Current User¶

Get information about the authenticated user (uses the session cookie).

GET /api/auth/status

Response: the user object is nested under user, and is null when nobody is signed in. Check authenticated rather than the presence of the key.

{
  "enabled": true,
  "authenticated": true,
  "user": {
    "id": 1,
    "username": "admin",
    "email": "[email protected]",
    "role": "super_admin"
  }
}

API Keys¶

For agent and automation use. All /api/agent-keys endpoints require an authenticated admin session (browser session cookie + CSRF).

Create API Key¶

POST /api/agent-keys
Content-Type: application/json

{
  "name": "CI/CD Pipeline",
  "key_type": "server",
  "expires_at": "2025-12-31T23:59:59Z",
  "permissions": ["products:read", "products:write"],
  "scan_vscode_extensions": false,
  "scan_code_dependencies": false
}

Field	Type	Default	Description
`name`	string	required	Descriptive name for the key
`key_type`	string	`"server"`	`"server"` for infrastructure or `"client"` for end-user workstations
`expires_at`	datetime	`null`	Optional expiration timestamp
`permissions`	string[]	`[]`	Permission scopes
`scan_vscode_extensions`	boolean	`false`	Enable VS Code extension scanning for agents using this key
`scan_code_dependencies`	boolean	`false`	Enable code dependency scanning (pip, npm, gem, cargo, go, composer)

Response:

{
  "id": 1,
  "name": "CI/CD Pipeline",
  "key": "sk_agent_xxxxxxxxxxxx",
  "key_prefix": "sk_agent_xxxxxxxxxxxx",
  "key_type": "server",
  "scan_vscode_extensions": false,
  "scan_code_dependencies": false,
  "expires_at": "2025-12-31T23:59:59Z",
  "created_at": "2024-01-01T00:00:00Z"
}

Key Security

The full API key is only shown once. Store it securely.

Key Type

Use "server" for infrastructure (servers, CI/CD, containers) and "client" for end-user machines (developer workstations, laptops). The dashboard provides a toggle to filter vulnerabilities by key type.

List API Keys¶

GET /api/agent-keys

Revoke API Key¶

DELETE /api/agent-keys/{id}

Using Agent Keys¶

Agents authenticate with the X-Agent-Key header:

curl https://sentrikat.example.com/api/agent/inventory \
  -H "X-Agent-Key: sk_agent_xxxxxxxxxxxx" \
  -H "Content-Type: application/json" \
  -d '{"hostname": "server-01", "software": [...]}'