API reference, OpenAPI and Postman

What it’s for

This page is the reference for the whole Sentinel API. The guides walk you through each product, and the API reference section lists every endpoint with a playground to try it. Here you find:

Your API address. It’s where every request goes.
The OpenAPI spec. A machine-readable description of every endpoint, field and response, in OpenAPI 3.1. Code generators, API gateways and testing tools read it.
The Postman collection. Every endpoint, ready to send from Postman, with example bodies.
One table each for status codes, scopes and pagination.
How the API changes over time, and the changelog.

Who can use it

Everyone in your organization can open API Keys and see the API address and the download links.
Admin and Developer create the keys you need to call the API. See Quick start.
The OpenAPI spec and the Postman collection contain no keys or customer data. You can share them with your developers and integration partners.

Step by step

Find your API address

In the sidebar, under Developer, click API Keys.
At the top of the panel, find API address. Click the copy button next to it.
Every path in this manual goes after that address. For example, POST /v1/verify/aml becomes <your API address>/v1/verify/aml.

The examples in these docs use https://robust-parakeet-542.convex.site. If API Keys shows another address, use that one.

Try the API in Postman

Download the Postman collection (also linked on API Keys in Sentinel).
In Postman, click Import and choose the file. The collection Sentinel API appears, with one folder per product.
Open the collection, then Variables. baseUrl is filled in already; check it matches your API address.
Create a test key on API Keys (see Quick start) and paste it into the apiKey variable. Test keys return sandbox results and are never charged.
Open a request, for example AML → Screen a person or business, and click Send. Every request already sends the key as Authorization: Bearer {{apiKey}}.

Keep live keys out of shared Postman workspaces. Use a Postman environment that only you can see.

Generate a client from the OpenAPI spec

Download the OpenAPI spec (also linked on API Keys in Sentinel). The API reference section of these docs is built from the same file.
Give it to your code generator. For example, with OpenAPI Generator:

npx @openapitools/openapi-generator-cli generate \
  -i sentinel-openapi.yaml \
  -g typescript-fetch \
  -o ./sentinel-client

Use -g python, -g java or -g csharp for other languages. The spec also imports into Swagger UI, Insomnia, Stoplight and most API gateways.

Set the generated client’s base path to your API address and its bearer token to your key, read from an environment variable.

Each operation in the spec carries x-scope, the scope its key needs. Media and file fields are base64 strings. All times are Unix milliseconds unless a field says ISO 8601.

What each result means

Endpoints and scopes

Scope	On screen	Endpoints
`verify:kyc`	Run KYC identity checks	`POST /v1/verify/idp`
`verify:aml`	Run AML screenings	`POST /v1/verify/aml`
`verify:document`	Run IDP document checks	`POST /v1/verify/document`
`verify:kyb`	Run business (KYB) checks	`POST /v1/verify/kyb`
`capture`	Create and manage capture links	`POST /v1/capture-links`, `GET /v1/capture-links`, `GET` and `DELETE /v1/capture-links/{id}`
`monitoring`	Manage AML monitoring	`GET /v1/monitoring/subjects`, `GET` and `DELETE /v1/monitoring/subjects/{id}`, `POST /v1/transactions`
`results:read`	Read check results	`GET /v1/verify`, `GET /v1/verify/{id}`
`credits:read`	Read credits and usage	`GET /v1/credits`, `GET /v1/credits/ledger`

Status codes

Every error is JSON with an error message. Validation errors also carry details, which says what each field takes.

Status	When	What to do
`200`	A read, or a cancel or removal, worked.	Nothing.
`201`	A capture link was created.	Keep the `link` if you’ll send it yourself. It isn’t shown again.
`202`	A check or a batch of transactions was accepted.	Wait for the webhook, or fetch the `id`.
`400`	Invalid JSON, a missing or invalid field, or a bad `id`, `limit` or `before`.	Fix the request using `details`.
`401`	No key, a malformed header, or an unknown, revoked or expired key.	Check the `Authorization` header and the key’s status.
`402`	Not enough credits for the check (live keys only).	Top up. See Results and credits.
`403`	The key lacks the scope, the IP address isn’t on your allowlist, your plan doesn’t include the feature (transaction monitoring), or the account isn’t active.	Read `error`: it names the cause.
`404`	No check, capture link or monitored subject with that `id` in your organization.	Check the `id`.
`413`	A media field or file is over its size limit.	Compress or resize it.
`429`	A rate limit was hit, or a phone number got too many capture links.	Wait the `Retry-After` seconds, then retry.
`500`	Something failed on Sentinel’s side.	Retry with backoff. If it keeps happening, contact Deeptrack.

Pagination

GET /v1/verify, GET /v1/credits/ledger, GET /v1/capture-links and GET /v1/monitoring/subjects return the newest first, a page at a time.

limit sets the page size, from 1 to 100. Without it you get 25 checks or ledger entries, or 50 capture links or monitored subjects.
Each answer ends with nextCursor. Send it back as before= to get the next page. It is null on the last page.

Retries and duplicates

Transactions are idempotent by externalId. Sending the same transaction again counts it in duplicates and doesn’t store it twice. Retrying a whole batch after a timeout is safe.
Checks are not deduplicated. Each POST /v1/verify/* that gets 202 is a new, charged check. If a request times out, list your recent checks with GET /v1/verify and look for it before you send it again.
Webhooks can arrive more than once. Use scan_id and event to recognise one you’ve handled. See Webhooks.

How the API changes

Everything under /v1 stays backward compatible. Changes are additive: new endpoints, new optional request fields, new response fields and new enum values.
Write your code to ignore response fields it doesn’t know, and to handle an unknown status, verdict or event as “needs a person to look”.
A change that would break an integration, such as removing or renaming a field, goes into a new version (/v2). /v1 keeps working, and Deeptrack tells your Admins in advance.
The OpenAPI spec’s info.version goes up with each change. The changelog below lists them.

Changelog

Version	Date	Change
1.0.0	2026-10-19	First published OpenAPI spec and Postman collection, covering KYC, KYB, documents, AML and monitoring, transactions, capture links, results and credits. The API address is shown on API Keys.

Common questions

Is the OpenAPI spec the source of truth?

Yes, together with these guides. Sentinel’s tests check that every endpoint the API serves is in the spec, and that the Postman collection matches it. Yes. It contains no keys, customer data or account details. Your partner still needs a key from your organization to call the API.

Will the API address change?

It may move to a dedicated api. address. If it does, the old one keeps working for a notice period, the new one appears on API Keys, and the change is listed in the changelog above.

Why does the spec show a different address from mine?

The spec and the collection carry Deeptrack’s production address. If API Keys shows another one, use that, and change baseUrl in Postman or the base path in your generated client.

Where are the request and response examples?

In the spec, on each operation, and in the guides with curl, Node and Python.

Get started

Guides

API reference

API reference, OpenAPI and Postman

What it’s for

Who can use it

Step by step

Find your API address

Try the API in Postman

Generate a client from the OpenAPI spec

What each result means

Endpoints and scopes

Status codes

Retries and duplicates

How the API changes

Changelog

Common questions

Is the OpenAPI spec the source of truth?

Will the API address change?

Why does the spec show a different address from mine?

Where are the request and response examples?

​What it’s for

​Who can use it

​Step by step

​Find your API address

​Try the API in Postman

​Generate a client from the OpenAPI spec

​What each result means

​Endpoints and scopes

​Status codes

​Pagination

​Retries and duplicates

​How the API changes

​Changelog

​Common questions

​Is the OpenAPI spec the source of truth?

​Can I share the spec with an integration partner?

​Will the API address change?

​Why does the spec show a different address from mine?

​Where are the request and response examples?

​Related guides

What it’s for

Who can use it

Step by step

Find your API address

Try the API in Postman

Generate a client from the OpenAPI spec

What each result means

Endpoints and scopes

Status codes

Pagination

Retries and duplicates

How the API changes

Changelog

Common questions

Is the OpenAPI spec the source of truth?

Can I share the spec with an integration partner?

Will the API address change?

Why does the spec show a different address from mine?

Where are the request and response examples?

Related guides