Create a 90-day key
const r = await fetch('/api/v1/keys', {
method: 'POST',
credentials: 'include',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ name: 'prod-splunk-2026q2', expires_in_days: 90 }),
});
const { data, meta } = await r.json();
console.log(meta.warning); // "Store this API key securely..."
console.log(`Save: ${data.full_key}`); // sk_live_... (shown ONCE)curl --request POST \
--url https://socdefenders.ai/api/v1/keys \
--header 'Content-Type: application/json' \
--cookie sb-access-token= \
--data '
{
"name": "Production SIEM Integration",
"expires_in_days": 90
}
'import requests
url = "https://socdefenders.ai/api/v1/keys"
payload = {
"name": "Production SIEM Integration",
"expires_in_days": 90
}
headers = {
"cookie": "sb-access-token=",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://socdefenders.ai/api/v1/keys",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => 'Production SIEM Integration',
'expires_in_days' => 90
]),
CURLOPT_COOKIE => "sb-access-token=",
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://socdefenders.ai/api/v1/keys"
payload := strings.NewReader("{\n \"name\": \"Production SIEM Integration\",\n \"expires_in_days\": 90\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("cookie", "sb-access-token=")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://socdefenders.ai/api/v1/keys")
.header("cookie", "sb-access-token=")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"Production SIEM Integration\",\n \"expires_in_days\": 90\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://socdefenders.ai/api/v1/keys")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["cookie"] = 'sb-access-token='
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"Production SIEM Integration\",\n \"expires_in_days\": 90\n}"
response = http.request(request)
puts response.read_body{
"data": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>",
"key_preview": "sk_live_••••••••",
"scopes": [
"<string>"
],
"rate_limit_per_minute": 123,
"rate_limit_per_day": 123,
"total_requests": 123,
"last_used_at": "2023-11-07T05:31:56Z",
"created_at": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z",
"key": "sk_live_abc123def456..."
},
"meta": {
"warning": "Store this API key securely. It will not be shown again."
}
}{
"error": {
"code": "invalid_parameter",
"message": "Invalid IOC type: invalid",
"details": {
"valid_types": [
"ipv4",
"ipv6",
"domain",
"url",
"md5",
"sha1",
"sha256"
]
},
"request_id": "req_abc123"
}
}{
"error": {
"code": "missing_api_key",
"message": "API key is required. Include it in the Authorization header as \"Bearer sk_live_...\"",
"request_id": "req_abc123"
}
}API Keys
Mint a new API key
Generates a new API key. The full secret is returned exactly once — save it immediately; subsequent reads only return the prefix.
Key naming convention
Use descriptive, deployment-aware names. Good examples:
prod-splunk-2026q2staging-sentineltom-laptop-dev
Bad examples that make audit trails useless:
key1,my key,test
Expiration
Pass expires_in_days for time-bounded keys (recommended for any key handed to a partner or CI system). Omit for keys that never expire. You can revoke at any time via DELETE.
Tier and scopes
Tier inherits from your account subscription (free or pro). Scopes default to your tier’s full set; the response includes them so you know what the key can do.
POST
/
api
/
v1
/
keys
Create a 90-day key
const r = await fetch('/api/v1/keys', {
method: 'POST',
credentials: 'include',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ name: 'prod-splunk-2026q2', expires_in_days: 90 }),
});
const { data, meta } = await r.json();
console.log(meta.warning); // "Store this API key securely..."
console.log(`Save: ${data.full_key}`); // sk_live_... (shown ONCE)curl --request POST \
--url https://socdefenders.ai/api/v1/keys \
--header 'Content-Type: application/json' \
--cookie sb-access-token= \
--data '
{
"name": "Production SIEM Integration",
"expires_in_days": 90
}
'import requests
url = "https://socdefenders.ai/api/v1/keys"
payload = {
"name": "Production SIEM Integration",
"expires_in_days": 90
}
headers = {
"cookie": "sb-access-token=",
"Content-Type": "application/json"
}
response = requests.post(url, json=payload, headers=headers)
print(response.text)<?php
$curl = curl_init();
curl_setopt_array($curl, [
CURLOPT_URL => "https://socdefenders.ai/api/v1/keys",
CURLOPT_RETURNTRANSFER => true,
CURLOPT_ENCODING => "",
CURLOPT_MAXREDIRS => 10,
CURLOPT_TIMEOUT => 30,
CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
CURLOPT_CUSTOMREQUEST => "POST",
CURLOPT_POSTFIELDS => json_encode([
'name' => 'Production SIEM Integration',
'expires_in_days' => 90
]),
CURLOPT_COOKIE => "sb-access-token=",
CURLOPT_HTTPHEADER => [
"Content-Type: application/json"
],
]);
$response = curl_exec($curl);
$err = curl_error($curl);
curl_close($curl);
if ($err) {
echo "cURL Error #:" . $err;
} else {
echo $response;
}package main
import (
"fmt"
"strings"
"net/http"
"io"
)
func main() {
url := "https://socdefenders.ai/api/v1/keys"
payload := strings.NewReader("{\n \"name\": \"Production SIEM Integration\",\n \"expires_in_days\": 90\n}")
req, _ := http.NewRequest("POST", url, payload)
req.Header.Add("cookie", "sb-access-token=")
req.Header.Add("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)
defer res.Body.Close()
body, _ := io.ReadAll(res.Body)
fmt.Println(string(body))
}HttpResponse<String> response = Unirest.post("https://socdefenders.ai/api/v1/keys")
.header("cookie", "sb-access-token=")
.header("Content-Type", "application/json")
.body("{\n \"name\": \"Production SIEM Integration\",\n \"expires_in_days\": 90\n}")
.asString();require 'uri'
require 'net/http'
url = URI("https://socdefenders.ai/api/v1/keys")
http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true
request = Net::HTTP::Post.new(url)
request["cookie"] = 'sb-access-token='
request["Content-Type"] = 'application/json'
request.body = "{\n \"name\": \"Production SIEM Integration\",\n \"expires_in_days\": 90\n}"
response = http.request(request)
puts response.read_body{
"data": {
"id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
"name": "<string>",
"key_preview": "sk_live_••••••••",
"scopes": [
"<string>"
],
"rate_limit_per_minute": 123,
"rate_limit_per_day": 123,
"total_requests": 123,
"last_used_at": "2023-11-07T05:31:56Z",
"created_at": "2023-11-07T05:31:56Z",
"expires_at": "2023-11-07T05:31:56Z",
"key": "sk_live_abc123def456..."
},
"meta": {
"warning": "Store this API key securely. It will not be shown again."
}
}{
"error": {
"code": "invalid_parameter",
"message": "Invalid IOC type: invalid",
"details": {
"valid_types": [
"ipv4",
"ipv6",
"domain",
"url",
"md5",
"sha1",
"sha256"
]
},
"request_id": "req_abc123"
}
}{
"error": {
"code": "missing_api_key",
"message": "API key is required. Include it in the Authorization header as \"Bearer sk_live_...\"",
"request_id": "req_abc123"
}
}Authorizations
Session cookie (for API key management endpoints)
Body
application/json
⌘I