REST API

Authentication, scans, findings and evidence through the Sentrasec REST API.

Sentrasec exposes a REST interface over HTTPS. Everything the console and CLI do goes through it, so anything they can do, you can automate.

Base URL

Deployment	Base URL
SaaS	`https://api.sentrasec.ai`
Self-hosted	Your `SENTRASEC_API_URL`

Authentication

Bearer tokens, issued per workspace:

curl https://api.sentrasec.ai/v1/findings \
  -H "Authorization: Bearer $SENTRASEC_TOKEN"

Tokens carry the permissions of the identity they were issued to. Scope them to what the automation actually needs.

Apps

GET    /v1/apps
POST   /v1/apps
GET    /v1/apps/{id}
PATCH  /v1/apps/{id}
DELETE /v1/apps/{id}

curl -X POST https://api.sentrasec.ai/v1/apps \
  -H "Authorization: Bearer $SENTRASEC_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"name": "payments-api", "repository": "github.com/acme/payments-api"}'

Scans

GET    /v1/scans
POST   /v1/scans
GET    /v1/scans/{id}
GET    /v1/scans/{id}/findings

Scans are asynchronous. Submitting returns immediately with a scan id and a status:

{
  "id": "scn_01h8x9k2m",
  "app_id": "app_01h8x9k2m",
  "status": "queued",
  "created_at": "2026-07-25T09:14:22Z"
}

Poll GET /v1/scans/{id} until status is completed or failed.

Findings

GET    /v1/findings
GET    /v1/findings/{id}
PATCH  /v1/findings/{id}

Filter with query parameters:

curl "https://api.sentrasec.ai/v1/findings?severity=critical,high&app_id=app_01h8x9k2m&status=open" \
  -H "Authorization: Bearer $SENTRASEC_TOKEN"

Updating a finding records a decision. A reason is required, because that is what makes the audit trail worth having:

curl -X PATCH https://api.sentrasec.ai/v1/findings/fnd_01h8x9 \
  -H "Authorization: Bearer $SENTRASEC_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"status": "accepted_risk", "reason": "Endpoint is internal-only and behind mTLS."}'

Evidence and compliance

GET    /v1/compliance/frameworks
GET    /v1/compliance/{framework}/evidence

Evidence is generated from scans that already ran and traces back to them.

Pagination

List endpoints are cursor-paginated:

{
  "data": [],
  "next_cursor": "eyJpZCI6ImZuZF8wMWg4eDkifQ",
  "has_more": true
}

Pass ?cursor= to continue.

Rate limits

Responses carry X-RateLimit-Limit, X-RateLimit-Remaining and X-RateLimit-Reset. On 429, back off using Retry-After.

Self-hosted deployments set their own limits.

Errors

Status	Meaning
`400`	Malformed request
`401`	Missing or invalid token
`403`	Token lacks permission
`404`	Not found, or not visible to this token
`409`	Conflict with current state
`422`	Valid syntax, invalid values
`429`	Rate limited
`5xx`	Server error

Error bodies carry a machine-readable code and a human-readable message.