API Reference

Every HTTP and WebSocket endpoint the Sentinel dashboard API exposes. Paths are relative to your configured prefix (default /sentinel), so /api/threats is served at /sentinel/api/threats. Examples use http://localhost:8080/sentinel.

Response Format

Paginated lists wrap results in data with a meta object:

{
  "data": [ ... ],
  "meta": { "total": 142, "page": 1, "page_size": 20 }
}

Single resources come back as { "data": { ... } }; actions return a message:

{ "message": "Threat resolved" }

{ "error": "Invalid credentials", "code": "UNAUTHORIZED" }

Errors use standard status codes with an error message and a machine-readable code such as BAD_REQUEST, NOT_FOUND, RATE_LIMITED, WAF_DISABLED, or EPHEMERAL_STORAGE.

Authentication

TOKEN=$(curl -s -X POST http://localhost:8080/sentinel/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": "your-password"}' | jq -r .token)

Threats

curl "http://localhost:8080/sentinel/api/threats?severity=High&type=SQLi&page=1&page_size=20" \
  -H "Authorization: Bearer $TOKEN"

# {
#   "data": [
#     {
#       "id": "3f9c...",
#       "timestamp": "2026-09-11T10:30:00Z",
#       "ip": "203.0.113.42",
#       "method": "GET",
#       "path": "/api/users",
#       "threat_types": ["SQLi"],
#       "severity": "High",
#       "confidence": 80,
#       "blocked": true,
#       "cvss": 9.8,
#       ...
#     }
#   ],
#   "meta": { "total": 47, "page": 1, "page_size": 20 }
# }

Actors and IP Blocks

WAF

curl -X PUT http://localhost:8080/sentinel/api/waf/rules \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"mode": "block", "rules": {"OpenRedirect": "off"}}'

curl -X POST http://localhost:8080/sentinel/api/waf/test \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"payload": "1 UNION SELECT password FROM users"}'

Rate Limits

Users, Audit Logs, and AuthShield

Alerts

Dashboard Settings

The WAF mode and sensitivity, custom rules, route rate limits, and the alert threshold are stored when you change them, so they survive a restart and reach every replica within Storage.SyncInterval. Stored settings win over the values in your Config: these endpoints show which is in force and discard the stored ones. (v2.6.0+)

curl -X DELETE http://localhost:8080/sentinel/api/settings/live   -H "Authorization: Bearer $TOKEN"

AI

Without an AI provider configured, these return 200 with {"data": null, "message": "AI not configured"}. See what each call sends to the provider.

Compliance Reports

Each report includes a provenance block and a truncated list. On in-memory storage in release mode they return 409 EPHEMERAL_STORAGE unless acknowledge_ephemeral=true is passed. Field-by-field contents are in Compliance Reports.

Score, Analytics, and Performance

CSP Report Receiver

WebSocket

Browsers can't set headers on a WebSocket, so pass the JWT as a token query parameter: ws://localhost:8080/sentinel/ws/threats?token=<jwt>. Connections without a valid token are refused.

const proto = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
const ws = new WebSocket(
  `${proto}//${window.location.host}/sentinel/ws/threats?token=${jwt}`
);
ws.onmessage = (event) => console.log(JSON.parse(event.data));

Next Steps

• The Dashboard -- The UI built on these endpoints
• Configuration -- Every config field
• WAF -- Modes, sensitivity levels, and custom rules
• Compliance Reports -- Report contents and provenance