Guides Reference

Endpoints you call

This guide is about the public API surface: where it lives, how it is versioned, and what is actually live today versus what arrives as more of the platform API opens up.

Base URL and paths

The API is served from a single base URL, and resources are root-anchored paths on it.

Base URL
https://api.cybersentriq.com

The token audience is the same value as this base URL: request tokens for https://api.cybersentriq.com (see Authentication overview), and send them here, to https://api.cybersentriq.com.

Versioning

Endpoints are versioned with an api-version query parameter. Omit it to get the current default; pin it to protect a client from future changes:

GET https://api.cybersentriq.com/<resource>?api-version=1.0

Pin api-version in production clients so a new default cannot change your integration's behavior underneath it.

Live today: the health check

The only endpoint live today is the health check. It needs no authentication:

Shell
curl -sS https://api.cybersentriq.com/health

It returns HTTP 200 with a small JSON body naming the environment:

JSON
{ "status": "ok", "environment": "production" }

Use it to confirm connectivity and that you are pointed at the right environment, before you attach a token to anything.

Coming soon

The rest of the platform API is not generally available yet. As more of it opens up, resources arrive here under the same base URL, versioned with api-version, and protected by the Authorization: Bearer token from either sign-in path. Watch llms.txt and the OpenAPI description, which grow as endpoints land.

The shape of an authenticated call is the same for every resource: a root-anchored path, an api-version, and a Bearer token. Here is that shape against the self/me resource, the first authenticated endpoint to open up. For a walkthrough of it, see Your identity: /self/me.

self/me is available on development first, and needs a valid access token. Use the call below as the template for authenticated calls; the resource catalog expands as more of the API opens up.

curl
curl -sS "https://api.cybersentriq.com/self/me?api-version=1.0" \
  -H "Authorization: Bearer <ACCESS_TOKEN>"
TypeScript / Node
const res = await fetch(
  "https://api.cybersentriq.com/self/me?api-version=1.0",
  { headers: { Authorization: `Bearer ${accessToken}` } },
);
const me = await res.json();
Python
import requests

res = requests.get(
    "https://api.cybersentriq.com/self/me",
    params={"api-version": "1.0"},
    headers={"Authorization": f"Bearer {access_token}"},
)
me = res.json()
C#
using System.Net.Http;

var http = new HttpClient();
var req = new HttpRequestMessage(HttpMethod.Get,
    "https://api.cybersentriq.com/self/me?api-version=1.0");
req.Headers.Add("Authorization", $"Bearer {accessToken}");

var res = await http.SendAsync(req);
var me = await res.Content.ReadAsStringAsync();
Go
req, _ := http.NewRequest("GET",
    "https://api.cybersentriq.com/self/me?api-version=1.0", nil)
req.Header.Set("Authorization", "Bearer "+accessToken)

res, err := http.DefaultClient.Do(req)
if err != nil {
    log.Fatal(err)
}
defer res.Body.Close()
// Decode res.Body into your model.

It returns HTTP 200 with the caller's identity record. Additional fields may be added as the identity surface grows, so decode leniently:

JSON
{
  "sub": "idp|abc123",
  "scope": "openid profile email offline_access api:full:read api:full:write",
  "permissions": ["self:profile:read", "self:profile:write", "self:organization:read"]
}
Field What it is
sub An opaque, stable identifier for the caller, carried in the access token. Its shape differs between interactive users and machine-to-machine callers, and may change. Treat it as opaque; do not parse it.
scope The space-delimited OAuth scopes your client was granted — for example openid profile email offline_access, plus any api:full:* you requested. Distinct from permissions.
permissions Your effective permission set: what you are allowed to do. See Permissions.

For a fuller walkthrough of this call, with versioning and error handling, see Your identity.

Your profile: /self/profile

Alongside /self/me, /self/profile is your own editable profile. GET /self/profile returns it; PATCH /self/profile updates a small set of self-service fields (display_name, marketing_opt_in, phone_number). The read needs the self:profile:read permission and the update needs self:profile:write — see Permissions. Both are versioned with api-version and take the same Authorization: Bearer token as every other call.

Shell
curl -sS "https://api.cybersentriq.com/self/profile?api-version=1.0" \
  -H "Authorization: Bearer <ACCESS_TOKEN>"

To update a field, PATCH the same path with a JSON body carrying only the fields you want to change:

Shell
curl -sS -X PATCH "https://api.cybersentriq.com/self/profile?api-version=1.0" \
  -H "Authorization: Bearer <ACCESS_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"display_name":"Ada Lovelace"}'

Next