What this is
The Authenticated API is the second of the two SENTRY API areas. The Public API (search, profiles, membership history, stats) needs no token. Everything under /api/v1/intel/… needs one.
A token works only on /api/v1/intel/… and /api/v1/auth/me. Other signed-in routes (Overlay, messages, notifications, debug and reader-debug) return 403 {"detail":"API token not valid for this route"} for a token. The website and SENTRY Overlay use a NAVCOM-ID session for those.
A sen_ token is a per-user key you mint while signed in. It is bound to your SENTRY account and a set of scopes. Requests that send it are treated as you: reads return only intel your account can already access, and writes are saved as your account. A token never grants extra org or group power.
Create and revoke tokens on Settings → Account.
Token shape
- Prefix
sen_, then a random secret. Store it like a password. - The full value is shown once at create. SENTRY stores only a hash.
- Give it a short name (script, bot, CI) so you can revoke the right one later.
- Pick an expiry when you create it: 30, 90 (default) or 365 days, or never. After it expires, calls get 401.
- A token not used for 90 days is revoked automatically. The clock starts at its last use, or at creation if it was never used.
- Revoke tokens yourself as soon as you no longer need them.
Scopes
| Scope | Effect |
|---|---|
intel.read | Always included. GET on /api/v1/intel/… as you. |
intel.write | Optional. POST/PUT/PATCH/DELETE on intel routes. Without it, writes return 403. |
If you request write without read, read is added automatically.
Authenticate
curl -sS -H "Authorization: Bearer sen_YOUR_TOKEN" \ https://sentry.wildknightsquadron.com/api/v1/intel/feed
| Status | When |
|---|---|
| 401 | No token, wrong token, revoked token, expired token, or token revoked after 90 days unused. Body {"detail":"Invalid or missing credentials (NAVCOM-ID session or sen_ API token)"}. |
| 403 | Read-only token on a write method (API token lacks intel.write), or your account has no rights on that item. |
| 403 | Token sent to a route outside /api/v1/intel/… and /api/v1/auth/me (API token not valid for this route). |
Check who a token belongs to: GET /api/v1/auth/me returns {"authenticated": true, "user": {…}} (or authenticated: false without a valid token).
What a token can reach
| Read (intel.read) | Write as you (intel.write) |
|---|---|
GET /intel/feed, /intel/target/{type}/{id}, …/feed, …/contact-reports, …/shipsGET /intel/contact-reports, /intel/contact-reports/{id}, …/audit, …/commentsGET /intel/notes/{id}/comments, /intel/suggest, /intel/identitiesGET /intel/groups, /intel/groups/memberships, /intel/defaults, /intel/incoming, /intel/sources
|
Notes: POST /intel/target/{type}/{id}/notes, PATCH|DELETE /intel/notes/{id}Contact reports: POST /intel/contact-reports, PATCH|DELETE /intel/contact-reports/{id}Comments, tags ( PUT …/tags), reputation (PUT …/reputation), ships (PUT …/ships)Sharing: POST …/shares, DELETE /intel/shares/{id}, sharing groups, defaults, incoming prefs, source blocks
|
All paths are under /api/v1. The full list with request bodies is in Swagger UI under the Authenticated · Intel tag (bearer scheme senApiToken).
Mint, list, revoke (NAVCOM-ID session only)
Token management refuses API tokens (403: use a NAVCOM-ID session). Use Settings → Account on the signed-in site. These routes are not part of the published OpenAPI.
- Create:
POST /api/v1/intel/api-tokenswith{"name": "script", "scopes": ["intel.read", "intel.write"], "expires_in_days": 90}.expires_in_daysis30,90,365ornull(never); if you leave it out, the token expires in 90 days. Any other value returns 400. Response includestoken(shown once) andexpires_at(null= never). - List:
GET /api/v1/intel/api-tokens—id,name,scopes,created_at,last_used_at,expires_at,expired. The secret is never listed. - Revoke:
DELETE /api/v1/intel/api-tokens/{id}— later calls with that secret get 401.
Safety
- Do not put tokens in tickets, git, or public pages.
- Prefer read-only tokens until a script must write.
- Revoke a token as soon as it leaks; mint a new one.
- Prefer an expiry over never. Last-used and expiry dates on Settings → Account help you find abandoned keys.