THE PROTOCOL

The protocol.

Log lines in, verdicts out. Four endpoints. One header. No SDK required.

$ curl -X POST https://api.sentinelscanner.io/platform/signup \
    -H 'Content-Type: application/json' \
    -d '{"email":"you@yourcompany.com"}'
→ {"customer_id":"…","tier":"FREE","api_key":"argus_…"}

$ curl -X POST https://api.sentinelscanner.io/platform/ingest \
    -H 'X-API-Key: argus_…' \
    -H 'Content-Type: application/json' \
    -d '{"events":[{"event_id":"ev-0001","agent":"worker-7",
         "text":"…log line…"}]}'

{
  "verdicts": [{
    "event_id": "ev-0001",
    "score": 46.2,
    "components": {
      "vocabulary": 24.0, "phrases": 16.7,
      "structures": 5.5, "morphology": 0.0
    },
    "matched_behaviors": [
      "EXTERNAL_STATE_PERSISTENCE",
      "UNREGISTERED_COMMUNICATION"
    ],
    "vocab_hits": 4, "phrase_hits": 2,
    "flagged": true
  }]
}

Endpoints

METHOD	PATH	REQUEST	RESPONSE
POST	/platform/signup	email	customer_id, tier, api_key (shown once)
POST	/platform/ingest	events[] — event_id, agent, text	verdicts[] — score, components, matched_behaviors, flagged
GET	/platform/me	X-API-Key	tier, events_used, events_remaining
GET	/platform/alerts	X-API-Key, optional since	flagged events, newest first

Authentication

Every call after signup carries X-API-Key. The key is shown once and stored only as a hash.

Free tier

1,000 scored events, no card. /platform/me returns events_remaining at any time.

Idempotency

Re-ingested event_ids return the stored verdict. Replay is safe.