Build on SentraBridge
from your own tools.

Get a token

Sign in, open Settings → API & AI assistants and choose New token. Name it, pick what it can do and when it expires. The token is shown once; SentraBridge keeps only a fingerprint.

A token acts as you, in the workspace you made it in. Its role is the lower of your role and the limit you picked, so a viewer token made by an admin can only look.

Revoke a token on the same page and it stops working at once. If your access to the workspace ends, so does the token.

Base URL and authentication

The base address is the one you sign in at: https://app.sentrabridge.com. Supported endpoints start with /v1 (with a token) or /public (no token).

Send the token in an Authorization: Bearer header on every call. Use HTTPS only, and keep tokens out of source control. Answers are JSON unless the reference says otherwise.

If your workspace limits sign-ins to certain networks, tokens must call from those networks too.

Errors

Errors use ordinary HTTP status codes and a JSON body with a message written for people. Show it to your users as it is.

Messages never include record contents or credentials. Errors from connected systems are redacted before they are saved or returned.

# 401
{
  "message": "Unauthenticated."
}

# 403
{
  "message": "Your role (viewer) can't do this. Ask an admin."
}

# 404
{
  "message": "Not found."
}

# 422
{
  "message": "The yaml field is required.",
  "errors": {
    "yaml": [
      "The yaml field is required."
    ]
  }
}

Versioning and stability

/v1 is the first supported version. Inside it we only add: new endpoints, new optional parameters and new fields. Write clients that ignore fields they don't know.

We don't remove or rename a documented endpoint or field, or change what it means, within /v1. A change like that would ship as a new version, announced ahead of time on this page.

Only what the API reference lists is supported. The web app uses other /v1 addresses; those are internal, unversioned and can change in any release.

The pass-through rule

SentraBridge moves records between systems without keeping them. The API follows the same rule: it returns settings, counts, record IDs, timings and redacted errors.

You can see that record BLD-2026-0001 was read and what ID it got in the next system. You can't fetch its contents, because SentraBridge doesn't have them.

Two endpoints do carry records. The Data API reads them live from the source for each call. Flow tests return the made-up records saved with the test.