API Reference

{
  "data": [ ... ],
  "meta": {
    "total": 142,
    "page": 1,
    "page_size": 20
  }
}

{
  "success": true,
  "message": "Threat resolved successfully"
}

{
  "error": "Invalid credentials"
}

# Authenticate and obtain a JWT token
curl -X POST http://localhost:8080/sentinel/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{"username": "admin", "password": "your-password"}'

# Response:
# {"token": "eyJhbGciOiJIUzI1NiIs..."}

# Verify that a token is still valid
curl http://localhost:8080/sentinel/api/auth/verify \
  -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..."

curl http://localhost:8080/sentinel/api/dashboard/summary \
  -H "Authorization: Bearer <token>"

# List high-severity SQL injection threats, page 1
curl "http://localhost:8080/sentinel/api/threats?page=1&page_size=20&severity=high&type=sqli" \
  -H "Authorization: Bearer <token>"

# Response:
# {
#   "data": [
#     {
#       "id": "abc123",
#       "type": "sqli",
#       "severity": "high",
#       "ip": "203.0.113.42",
#       "route": "/api/users",
#       "blocked": true,
#       "timestamp": "2025-01-15T10:30:00Z"
#     },
#     ...
#   ],
#   "meta": { "total": 47, "page": 1, "page_size": 20 }
# }

# Mark threat abc123 as resolved
curl -X POST http://localhost:8080/sentinel/api/threats/abc123/resolve \
  -H "Authorization: Bearer <token>"

# Block the actor at 203.0.113.42
curl -X POST http://localhost:8080/sentinel/api/actors/203.0.113.42/block \
  -H "Authorization: Bearer <token>"

# Block an IP range
curl -X POST http://localhost:8080/sentinel/api/ip-lists \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"ip": "198.51.100.0/24", "type": "block", "reason": "Known botnet range"}'

# Test an input string against all active WAF rules
curl -X POST http://localhost:8080/sentinel/api/waf/test \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"input": "SELECT * FROM users WHERE id=1 OR 1=1"}'

# Get current rate limit counter states
curl http://localhost:8080/sentinel/api/rate-limits/current \
  -H "Authorization: Bearer <token>"

# Ask a question about your security data
curl -X POST http://localhost:8080/sentinel/api/ai/query \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: application/json" \
  -d '{"query": "What were the most common attack types this week?"}'

# Get AI analysis for threat abc123
curl -X POST http://localhost:8080/sentinel/api/ai/analyze-threat/abc123 \
  -H "Authorization: Bearer <token>"

# Generate a GDPR report for the last 30 days
curl "http://localhost:8080/sentinel/api/reports/gdpr?window=720h" \
  -H "Authorization: Bearer <token>"

# Get hourly attack trends for the last 24 hours
curl "http://localhost:8080/sentinel/api/analytics/trends?window=24h&interval=hour" \
  -H "Authorization: Bearer <token>"

# Get per-route latency metrics
curl http://localhost:8080/sentinel/api/performance/routes \
  -H "Authorization: Bearer <token>"

// Connect to the live threat stream
const proto = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
const ws = new WebSocket(
  `${proto}//${window.location.host}/sentinel/ws/threats?token=${jwt}`
);

ws.onmessage = (event) => {
  const threat = JSON.parse(event.data);
  console.log('New threat:', threat.type, threat.severity, threat.ip);
};

ws.onclose = () => {
  // Reconnect with backoff
  setTimeout(() => connect(), 5000);
};

# Connect to WebSocket using curl (for testing)
curl --include \
  --no-buffer \
  --header "Connection: Upgrade" \
  --header "Upgrade: websocket" \
  --header "Sec-WebSocket-Version: 13" \
  --header "Sec-WebSocket-Key: $(openssl rand -base64 16)" \
  "http://localhost:8080/sentinel/ws/threats?token=<jwt>"