API reference

API keys

List, create and revoke your organisation's API keys.

These endpoints manage the keys described in Authentication. The Developers → API keys screen in the dashboard uses them. Creating and revoking keys is written to the audit log.

Any key can create and revoke keys today. There are no scopes or roles to limit this yet.

List keys

GET /v1/keys

Returns every key in your organisation, active ones first, newest first within each group. Revoked keys stay in the list. A secret or hash is never returned.

Terminal

curl "$SENTINEL_URL/v1/keys" \
  -H "Authorization: Bearer $SENTINEL_KEY"

Response · 200

{
  "keys": [
    {
      "id": "3f2e1d0c-9b8a-4765-8432-10fedcba9876",
      "name": "payments-core",
      "prefix": "snt_live_Xk3f9a",
      "created_by": "8a7b6c5d-4e3f-4a2b-9c1d-0e9f8a7b6c5d",
      "created_at": "2026-10-15T09:30:12.054Z",
      "current": true
    },
    {
      "id": "8a7b6c5d-4e3f-4a2b-9c1d-0e9f8a7b6c5d",
      "name": "bootstrap",
      "prefix": "snt_live_4be1c0",
      "created_by": "bootstrap",
      "created_at": "2026-10-14T16:02:47.910Z",
      "revoked_at": "2026-10-15T09:41:03.377Z",
      "current": false
    }
  ]
}

Create a key

POST /v1/keys

Creates a key and returns it with its secret. This response is the only time the secret is shown. Store it somewhere safe straight away. Returns 201.

name

string required

A label so people can tell keys apart, for example the service that uses it. 1 to 64 characters.

Terminal

curl -X POST "$SENTINEL_URL/v1/keys" \
  -H "Authorization: Bearer $SENTINEL_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "name": "payments-core"
  }'

Response · 201

{
  "id": "3f2e1d0c-9b8a-4765-8432-10fedcba9876",
  "name": "payments-core",
  "prefix": "snt_live_Xk3f9a",
  "created_by": "8a7b6c5d-4e3f-4a2b-9c1d-0e9f8a7b6c5d",
  "created_at": "2026-10-15T09:30:12.054Z",
  "current": false,
  "secret": "snt_live_Xk3f9aQm2Lr8Vt0yWn5Bc7Hd1Jp4Gs6Fz9Ke3Ua0Ox2"
}

Revoke a key

DELETE /v1/keys/{id}

Revokes a key. Requests using it fail with 401 from then on. The key stays in the list with revoked_at set, because audit entries name it. Revoking can't be undone.

Two revocations are refused with 409, so nobody locks the organisation out:

the key making the request, and
the organisation's last active key.

Terminal

curl -X DELETE "$SENTINEL_URL/v1/keys/8a7b6c5d-4e3f-4a2b-9c1d-0e9f8a7b6c5d" \
  -H "Authorization: Bearer $SENTINEL_KEY"

The response is the key with revoked_at set.

Key fields

Field	Type	Meaning
`id`	string, uuid	The key's ID. This is what audit entries, notes and approvals record as the actor.
`name`	string	The label it was created with
`prefix`	string	The first characters of the secret, for example `snt_live_Xk3f9a`, so you can match a key to where it's used. Empty for keys made before prefixes were stored.
`created_by`	string	The ID of the key that created it, or `sentinel-admin` or `bootstrap`
`created_at`	string, date-time	When it was created
`revoked_at`	string, date-time	When it was revoked. Absent while active.
`current`	boolean	`true` for the key making this request
`secret`	string	Only on create. The full key.

Errors

Endpoint	Code	`error`
All	`401`	`missing or invalid API key`
`POST`	`400`	`name must be 1 to 64 characters`
`DELETE`	`404`	`key not found`
`DELETE`	`409`	`you can't revoke the key you are signed in with`
`DELETE`	`409`	`this is the last active key; create another before revoking it`
`DELETE`	`409`	`this key is already revoked`

Edit this pageorReport an issue

Screening

Check a person or business against the loaded sanctions and PEP lists, review the matches, and see which lists are loaded.

Overview

Today's figures for the home screen.