API & CI reference

The Sentinel API is JSON over HTTPS. Every response sets Cache-Control: no-store. Base URL is your deployment, e.g. https://your-host. Only assess assets you own or are authorized to test.

For professional testers

Sentinel is a force multiplier, not a replacement for a human tester. It automates the repetitive, standardized part of a BaaS/web-app assessment — authorization sweeps, recon, reporting scaffolding, and the engagement paperwork — so your billable hours go to the expert work clients actually pay a person for. It's authorization-first by design: it makes you prove authorization, keeps client secrets encrypted and out of the browser, defaults destructive probes off, and logs every run.

Engagement workflow

1. Scope & RoE. Create an engagement, fill scope and rules of engagement, and work the CREST pre-engagement checklist — testing is blocked until it's complete. Export the RoE PDF for signature.
2. Authorization. Verify the target under Domains (DNS-TXT / hosted file). In strict mode (REQUIRE_VERIFIED_TARGET=1) active runs against unverified hosts are refused; every run is written to an authorization audit trail.
3. Passive recon. Check my app to fingerprint the backend, External Scan for headers / exposed files / CVEs, Code & Deps for dependency + secret + BaaS SAST (source never leaves your environment).
4. Deep authorization testing. Configure the target (Supabase URL + anon key only, role tokens, schema) and run the deep engine: Supabase RLS / FK-embedding / SECURITY DEFINER RPC, Firebase rules & auth != null bypass, GraphQL introspection / aliasing / batching, Appwrite role bypass. Blind SSRF/RCE/OOB-SQLi confirmed via the self-hosted OAST collaborator. Write probes are off by default and staging-only.
5. Findings. Record findings with CVSS v3.1, evidence, repro and remediation; retest and sign off, all in the per-engagement audit log.
6. Verdict & report. Go-Live Check for a combined go/no-go; export the branded pentest report PDF plus findings as CSV/Markdown.
7. Automate. Mint an API token and wire the same checks into CI (SAST → SARIF/JUnit, scheduled scans); heavy runs go through the job queue.

What's automated vs what stays human

The tool answers "is this door unlocked?" for every known door, consistently and fast. The human decides which doors matter, what's behind them, and how to chain half-open ones into a break-in.

ROI at a glance

On a commodity BaaS engagement the tool typically removes ~30–40% of total time by cutting the undifferentiated work: recon setup (~40–50%), standardized authz sweeps (~40–50%), reporting/QA (~40%) and admin (~50%). The creative/business-logic portion is unchanged. Net: a ~5-day job becomes ~3–3.5 days — which converts to more engagements per month, better fixed-fee margin, and more consistent coverage. Tool cost (self-host ≈ a small VPS, or a low monthly plan) is trivial against the labour saved on a single engagement. The steeper the manual/creative content, the smaller the % gain; the more it's "another Supabase app to check for RLS holes," the bigger it is. (Figures are illustrative, not measured benchmarks — validate against your own engagement mix.)

Authentication

Interactive use is cookie-based (sign in at /). For automation, create an API token in Teams & Access → API tokens and send it as a bearer token:

curl -H "Authorization: Bearer skt_XXXX" https://your-host/api/overview

A token acts within the workspace it was created in. Tokens are shown once at creation and stored hashed.

Errors & rate limits

Errors are { "error": "code", "message": "..." }. Notable codes:

External scan

POST /api/scan — passive external scan.

curl -X POST https://your-host/api/scan \
  -H "Authorization: Bearer skt_XXXX" -H "Content-Type: application/json" \
  -d '{"target":"example.com","authorized":true}'

Returns score, grade, counts and findings. Counts toward your monthly scan quota.

Async jobs

Heavy work can run in the background. POST /api/jobs with { type, params } returns 202 and a job; poll GET /api/jobs/:id until status is done/failed. Types: scan, deep-run, dast, golive, perf, report.

ID=$(curl -s -X POST $BASE/api/jobs -H "$AUTH" -H "$JSON" \
  -d '{"type":"scan","params":{"target":"example.com","authorized":true}}' | jq -r .job.id)
curl -s $BASE/api/jobs/$ID -H "$AUTH"

Deep BaaS & DAST

POST /api/dast/run and the per-engagement deep engines require the target to be verified (proof of ownership) and are gated by plan. See the in-app Engagements workflow for Supabase/Firebase/GraphQL/Appwrite configuration.

Go-Live verdict

POST /api/golive/run with { url, authorized:true, includePerf, includeSit, engagementId } returns a single combined go/no-go verdict folding security, performance and integration signals.

SAST (code) scanner — CI

BaaS-aware static analysis. Run it in your pipeline; your source never leaves it.

# scan a directory, emit SARIF + JUnit, fail the build on high findings
npx --no-install baas-sast ./src --sarif sast.sarif --junit sast.xml --fail-on high

Or via API: POST /api/scan/sast with { files:[{path,content}] } → SARIF-shaped findings. Rules include service_role in client code, request.auth != null-only rules, USING(true) RLS, JWT decode without verify, and IDOR patterns.

JUnit & SARIF output

Integration suites export JUnit for your CI test reporter: GET /api/sit/suites/:id/junit.xml. The SAST scanner emits SARIF 2.1.0 for code scanning dashboards. Both are standard formats consumed by GitHub Actions, GitLab CI and Jenkins.

# GitHub Actions example
- name: Sentinel SAST
  run: npx --no-install baas-sast ./src --sarif results.sarif --fail-on high
- uses: github/codeql-action/upload-sarif@v3
  with: { sarif_file: results.sarif }

Workspaces

GET /api/orgs lists your workspaces; POST /api/orgs/switch { orgId } changes the active one. Data in each workspace is physically isolated in its own database.

Billing webhooks

When Stripe is configured, point a webhook at POST /api/billing/webhook for checkout.session.completed and customer.subscription.* events. The endpoint verifies the Stripe signature (STRIPE_WEBHOOK_SECRET) and maps subscription state onto the workspace plan.

Status

GET /api/status is a public liveness view: { ok, version, uptimeMs, requests }. GET /api/health reports version and OAST availability.

Sentinel is a single zero-dependency Node.js app. Self-hosted installs run unlimited and unbilled. See the deployment guides shipped with the app.