API Reference

Overview

The Sentry API is a JSON over HTTPS interface. All requests and responses use application/json, and every request must be made over TLS. The base URL for your deployment is:

https://sentry.confidion.com/api

Conventions:

• Standard HTTP status codes indicate success (2xx) or failure (4xx/5xx).
• Errors return a JSON body with an error field describing the problem. Error bodies are deliberately terse; the detail is recorded server-side.
• Timestamps are ISO 8601 (UTC).
• Paging is cursor-based, not page-numbered — see the incremental pull endpoint below.
• Endpoint paths carry their .php suffix, which is what the server serves. Only /api/profiling/… is additionally routed without one.

Authentication

Requests are authenticated with a per-consumer API key issued to your account. Present it in the X-Api-Key header, or equivalently as Authorization: Bearer:

curl -X GET "https://sentry.confidion.com/api/servicenow_pull.php?limit=100" \
  -H "X-Api-Key: YOUR_API_KEY" \
  -H "Accept: application/json"

Send the key in a header, never in the URL. Query strings are retained in load-balancer and proxy access logs, browser history and referrer headers. The ?api_key= form is rejected with 400 by default.

Keep your key secret — treat it like a password. Keys are stored encrypted at rest, can be rotated at any time, and a compromised key can be revoked from your account settings or by contacting support.

Rate limits

API usage is subject to per-plan rate limits. When you exceed your limit, the API responds with 429 Too Many Requests. Throttle your client and retry after a short backoff. Higher limits are available on enterprise plans.

Endpoints

These are the endpoints the API serves. Full parameters, response schemas and error shapes for each are in the OpenAPI specification.

Export intelligence into your systems

Profiling (Nexus)

Push intelligence into Sentry

Operations

Outbound webhooks — HMAC-signed alert delivery to a URL you control — are configured in the app rather than over the API. The enrolled collector-agent protocol at /api/collector.php is documented in the specification for completeness; it is spoken by the Sentry agent, not by integrations.

Scheduled imports: use the cursor

A scheduled import must never double-import a row or skip one, and a trailing-window export cannot promise that — two runs whose windows overlap return the same rows twice, and a missed run loses whatever fell between them. /api/servicenow_pull.php is cursor-based for exactly this reason:

1. First run: call with no cursor. Bound the backfill with since if you don't want the full history.
2. Store next_cursor from the response.
3. Every later run: pass that value back as cursor.

Rows are ordered by ascending id and filtered strictly greater than the cursor, so a client that honours this never sees a row twice and never misses one — even when runs overlap or one is skipped.

next_cursor is null only when the page did not fill, meaning you are caught up. A full page always returns a cursor, so keep calling until it comes back null rather than assuming one call drains the backlog.

curl -X GET "https://sentry.confidion.com/api/servicenow_pull.php?cursor=184213&limit=500" \
  -H "X-Api-Key: YOUR_API_KEY"

{"items": [ ... ], "count": 500, "next_cursor": 184713}