API
The Sentisec HTTP API — provider-native chat endpoints plus a native surface for sessions, keys, credentials, audit, and metrics.
Sentisec is an HTTP endpoint. You point an existing client at a Sentisec base URL instead of the provider's, keep sending the payloads you already send, and the integrity engine inspects every request on the way through.
There is no Sentisec-specific request format to learn. The chat endpoints speak the provider's own wire format byte-for-byte, so the same SDK, the same body, and the same streaming parser all keep working.
Base URLs
Two shapes, one per client family. The /v1 suffix belongs on the
OpenAI-shaped URL only.
https://api.sentisec.ch/ws/<your-workspace-id> # Anthropic-shaped clients
https://api.sentisec.ch/ws/<your-workspace-id>/v1 # OpenAI-shaped clientsUse the workspace-scoped form. It is the one shape that carries your
workspace's own policy on every transport — the unscoped /v1/...
endpoints exist for legacy clients and do not resolve your workspace on
every lane. Your workspace id is on the dashboard's connection page.
Which endpoints are inspected
All the chat-family endpoints authenticate against your workspace and answer with your workspace's stored provider credential. The ones that carry tool calls all evaluate them.
| Endpoint | Wire | Tool calls |
|---|---|---|
POST /ws/{id}/v1/messages | Anthropic Messages | Inspected, streaming and non-streaming |
POST /ws/{id}/v1/chat/completions | OpenAI Chat Completions | Inspected, streaming and non-streaming |
POST /ws/{id}/v1/responses | OpenAI Responses | Inspected, streaming and non-streaming |
POST /ws/{id}/v1/model/{modelId}/converse, …/converse-stream | Amazon Bedrock Converse | Inspected, streaming and non-streaming — see Bedrock |
POST /ws/{id}/v1/embeddings | OpenAI Embeddings | Relayed — an embedding carries no tool call |
GET /ws/{id}/v1/models | Model discovery | Not applicable |
On an inspected endpoint a blocked tool call is rewritten before it reaches your client, so your tool never runs it. Embeddings are relayed verbatim and recorded; Responses differs from the chat endpoints in a few ways worth knowing before you route production traffic to it. Both are covered on Responses and Embeddings.
Do not read the X-Sentisec-Verdict response header as a per-request
verdict, and do not treat a missing one as a failure — where a value
would not be true of the bytes it rides on, the header is left off
rather than defaulted. See
Headers and streaming frames for when it appears,
when it does not, and what each case means.
Authentication
Which credential you send depends on which surface you are calling.
| Surface | Credential | Covers |
|---|---|---|
| Chat + sessions | Workspace API key, Authorization: Bearer sk_sentisec_… | /ws/{id}/v1/messages, /ws/{id}/v1/chat/completions, /ws/{id}/v1/responses, /ws/{id}/v1/model/{modelId}/converse*, /ws/{id}/v1/embeddings, /ws/{id}/v1/models, /ws/{id}/v1/sessions*, and a held call's approval status, /v1/workspaces/{id}/actions/{action_id}/approval (calls waiting for approval) |
| Administration | Admin session token from Sentisec sign-in | Workspace CRUD, API-key management, upstream credentials, audit, metrics |
| Pair redemption | None — the one-time pair code is the proof | POST /v1/sdk/pair/complete |
| Identity webhook | Signed webhook payload, no client credential | POST /webhooks/clerk |
Anthropic-shaped clients may send the workspace key as x-api-key
instead of Authorization. Both headers are accepted on the chat and
session endpoints. The approval status of a held call is the exception:
it reads the key from Authorization: Bearer only.
A workspace key sent to an administration endpoint returns 401, and
an admin session token sent to a chat endpoint returns 401. Match the
credential to the surface.
Workspace keys look like sk_sentisec_<8 chars>_<32 chars>. The
plaintext is shown exactly once, at creation; Sentisec stores only a
hash.
Reference
Chat endpoints
Messages, Chat Completions, streaming, and model discovery — the inspected request path.
Responses and Embeddings
The Responses API — inspected, and how it differs from Chat Completions — plus the embeddings relay.
Headers and streaming frames
Which headers Sentisec reads, which it adds, and how sessions are correlated across requests.
Errors and limits
Every Sentisec-specific error code, what caused it, and the fix.
Rate limits
Each plan's requests and tokens per minute, the 429 your SDK retries, and how often a workspace hits one.
Sessions
Mint a session, read its verdicts, close it, keep it out of learning.
Administration
Workspaces, API keys, upstream credentials, CLI pairing, and the identity webhook.
Audit and metrics
The hash-chained audit log, operational metrics, and the live session feed.
Health
Two unauthenticated liveness endpoints, identical in behaviour.
Related
- Quickstart — first inspected call in 60 seconds
- Providers — which upstreams you can connect
- Examples — language-by-language recipes
opencode
Route opencode through Sentisec in its provider config — Claude models over the Anthropic wire, or Kimi over the OpenAI-compatible wire.
Chat endpoints
Send Anthropic Messages or OpenAI Chat Completions traffic through Sentisec — request shape, streaming, blocked tool calls, and model discovery.