REST API

Sentrasec exposes a REST interface over HTTPS. Use it to automate work you would otherwise do in the web app or CLI.

Base URL

Deployment	Base URL
SaaS	https://api.sentrasec.ai
Self-hosted	Your SENTRASEC_API_URL

Authentication

Bearer tokens, issued per workspace:

curl https://api.sentrasec.ai/v1/findings \
  -H "Authorization: Bearer $SENTRASEC_TOKEN"

Tokens carry the permissions of the identity they were issued to. Scope them to what the automation actually needs.

Apps

GET    /v1/apps
POST   /v1/apps
GET    /v1/apps/{id}
PATCH  /v1/apps/{id}
DELETE /v1/apps/{id}

curl -X POST https://api.sentrasec.ai/v1/apps \
  -H "Authorization: Bearer $SENTRASEC_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "payments-api", "repository": "github.com/acme/payments-api"}'

Scans

GET    /v1/scans
POST   /v1/scans
GET    /v1/scans/{id}
GET    /v1/scans/{id}/findings

Scans are asynchronous. Submitting returns immediately with a scan id and a status:

{
  "id": "scn_01h8x9k2m",
  "app_id": "app_01h8x9k2m",
  "status": "queued",
  "created_at": "2026-07-25T09:14:22Z"
}

Poll GET /v1/scans/{id} until status is completed or failed.

Findings

GET    /v1/findings
GET    /v1/findings/{id}
PATCH  /v1/findings/{id}

Filter with query parameters:

curl "https://api.sentrasec.ai/v1/findings?severity=critical,high&app_id=app_01h8x9k2m&status=open" \
  -H "Authorization: Bearer $SENTRASEC_TOKEN"

Updating a finding records a decision. A reason is required, because that is what makes the audit trail worth having:

curl -X PATCH https://api.sentrasec.ai/v1/findings/fnd_01h8x9 \
  -H "Authorization: Bearer $SENTRASEC_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"status": "accepted_risk", "reason": "Endpoint is internal-only and behind mTLS."}'

Compliance records

GET    /v1/compliance/frameworks
GET    /v1/compliance/{framework}/evidence

Scans, triage decisions, remediation plans and re-scans are kept as records and mapped to controls in SOC 2, ISO 27001, PCI DSS, HIPAA, GDPR and DORA. Each record traces back to the scan or decision that produced it.

Pagination

List endpoints are cursor-paginated:

{
  "data": [],
  "next_cursor": "eyJpZCI6ImZuZF8wMWg4eDkifQ",
  "has_more": true
}

Pass ?cursor= to continue.

Rate limits

Responses carry X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. On 429, back off using Retry-After.

Self-hosted deployments set their own limits.

Errors

Status	Meaning
400	Malformed request
401	Missing or invalid token
403	Token lacks permission
404	Not found, or not visible to this token
409	Conflict with current state
422	Valid syntax, invalid values
429	Rate limited
5xx	Server error

Error bodies carry a machine-readable code and a human-readable message.