> ## Documentation Index > Fetch the complete documentation index at: https://docs.deeptrack.io/llms.txt > Use this file to discover all available pages before exploring further. # API reference, OpenAPI and Postman > Find your API address, import the Postman collection, generate a client from the OpenAPI spec, and look up every status code, scope and change in one place. ## What it's for This page is the reference for the whole Sentinel API. The guides walk you through each product, and the **API reference** section lists every endpoint with a playground to try it. Here you find: * **Your API address.** It's where every request goes. * **The OpenAPI spec.** A machine-readable description of every endpoint, field and response, in OpenAPI 3.1. Code generators, API gateways and testing tools read it. * **The Postman collection.** Every endpoint, ready to send from Postman, with example bodies. * **One table each** for status codes, scopes and pagination. * **How the API changes over time**, and the changelog. ## Who can use it * Everyone in your organization can open **API Keys** and see the API address and the download links. * **Admin** and **Developer** create the keys you need to call the API. See [Quick start](https://docs.deeptrack.io/sentinel/quickstart.md). * The OpenAPI spec and the Postman collection contain no keys or customer data. You can share them with your developers and integration partners. ## Step by step ### Find your API address 1. In the sidebar, under **Developer**, click **API Keys**. 2. At the top of the panel, find **API address**. Click the copy button next to it. 3. Every path in this manual goes after that address. For example, `POST /v1/verify/aml` becomes `/v1/verify/aml`. The examples in these docs use `https://robust-parakeet-542.convex.site`. If **API Keys** shows another address, use that one. ### Try the API in Postman 1. Download the [Postman collection](https://sentinel.deeptrack.io/developers/sentinel.postman_collection.json) (also linked on **API Keys** in Sentinel). 2. In Postman, click **Import** and choose the file. The collection **Sentinel API** appears, with one folder per product. 3. Open the collection, then **Variables**. `baseUrl` is filled in already; check it matches your API address. 4. Create a **test** key on **API Keys** (see [Quick start](https://docs.deeptrack.io/sentinel/quickstart.md)) and paste it into the `apiKey` variable. Test keys return sandbox results and are never charged. 5. Open a request, for example **AML → Screen a person or business**, and click **Send**. Every request already sends the key as `Authorization: Bearer {{apiKey}}`. Keep live keys out of shared Postman workspaces. Use a Postman environment that only you can see. ### Generate a client from the OpenAPI spec 1. Download the [OpenAPI spec](https://sentinel.deeptrack.io/developers/sentinel-openapi.yaml) (also linked on **API Keys** in Sentinel). The **API reference** section of these docs is built from the same file. 2. Give it to your code generator. For example, with OpenAPI Generator: ```bash theme={null} npx @openapitools/openapi-generator-cli generate \ -i sentinel-openapi.yaml \ -g typescript-fetch \ -o ./sentinel-client ``` Use `-g python`, `-g java` or `-g csharp` for other languages. The spec also imports into Swagger UI, Insomnia, Stoplight and most API gateways. 3. Set the generated client's base path to your API address and its bearer token to your key, read from an environment variable. Each operation in the spec carries `x-scope`, the scope its key needs. Media and file fields are base64 strings. All times are Unix milliseconds unless a field says ISO 8601. ## What each result means ### Endpoints and scopes | Scope | On screen | Endpoints | | - | - | - | | `verify:kyc` | Run KYC identity checks | `POST /v1/verify/idp` | | `verify:aml` | Run AML screenings | `POST /v1/verify/aml` | | `verify:document` | Run IDP document checks | `POST /v1/verify/document` | | `verify:kyb` | Run business (KYB) checks | `POST /v1/verify/kyb` | | `capture` | Create and manage capture links | `POST /v1/capture-links`, `GET /v1/capture-links`, `GET` and `DELETE /v1/capture-links/{id}` | | `monitoring` | Manage AML monitoring | `GET /v1/monitoring/subjects`, `GET` and `DELETE /v1/monitoring/subjects/{id}`, `POST /v1/transactions` | | `results:read` | Read check results | `GET /v1/verify`, `GET /v1/verify/{id}` | | `credits:read` | Read credits and usage | `GET /v1/credits`, `GET /v1/credits/ledger` | ### Status codes Every error is JSON with an `error` message. Validation errors also carry `details`, which says what each field takes. | Status | When | What to do | | - | - | - | | `200` | A read, or a cancel or removal, worked. | Nothing. | | `201` | A capture link was created. | Keep the `link` if you'll send it yourself. It isn't shown again. | | `202` | A check or a batch of transactions was accepted. | Wait for the webhook, or fetch the `id`. | | `400` | Invalid JSON, a missing or invalid field, or a bad `id`, `limit` or `before`. | Fix the request using `details`. | | `401` | No key, a malformed header, or an unknown, revoked or expired key. | Check the `Authorization` header and the key's status. | | `402` | Not enough credits for the check (live keys only). | Top up. See [Results and credits](https://docs.deeptrack.io/sentinel/results-and-credits.md). | | `403` | The key lacks the scope, the IP address isn't on your allowlist, your plan doesn't include the feature (transaction monitoring), or the account isn't active. | Read `error`: it names the cause. | | `404` | No check, capture link or monitored subject with that `id` in your organization. | Check the `id`. | | `413` | A media field or file is over its size limit. | Compress or resize it. | | `429` | A rate limit was hit, or a phone number got too many capture links. | Wait the `Retry-After` seconds, then retry. | | `500` | Something failed on Sentinel's side. | Retry with backoff. If it keeps happening, contact Deeptrack. | ### Pagination `GET /v1/verify`, `GET /v1/credits/ledger`, `GET /v1/capture-links` and `GET /v1/monitoring/subjects` return the newest first, a page at a time. * `limit` sets the page size, from 1 to 100. Without it you get 25 checks or ledger entries, or 50 capture links or monitored subjects. * Each answer ends with `nextCursor`. Send it back as `before=` to get the next page. It is `null` on the last page. ### Retries and duplicates * **Transactions** are idempotent by `externalId`. Sending the same transaction again counts it in `duplicates` and doesn't store it twice. Retrying a whole batch after a timeout is safe. * **Checks** are not deduplicated. Each `POST /v1/verify/*` that gets `202` is a new, charged check. If a request times out, list your recent checks with `GET /v1/verify` and look for it before you send it again. * **Webhooks** can arrive more than once. Use `scan_id` and `event` to recognise one you've handled. See [Webhooks](https://docs.deeptrack.io/sentinel/webhooks.md). ### How the API changes * Everything under `/v1` stays backward compatible. Changes are additive: new endpoints, new optional request fields, new response fields and new enum values. * Write your code to ignore response fields it doesn't know, and to handle an unknown `status`, `verdict` or event as "needs a person to look". * A change that would break an integration, such as removing or renaming a field, goes into a new version (`/v2`). `/v1` keeps working, and Deeptrack tells your Admins in advance. * The OpenAPI spec's `info.version` goes up with each change. The changelog below lists them. ### Changelog | Version | Date | Change | | - | - | - | | 1.0.0 | 2026-10-19 | First published OpenAPI spec and Postman collection, covering KYC, KYB, documents, AML and monitoring, transactions, capture links, results and credits. The API address is shown on **API Keys**. | ## Common questions ### Is the OpenAPI spec the source of truth? Yes, together with these guides. Sentinel's tests check that every endpoint the API serves is in the spec, and that the Postman collection matches it. ### Can I share the spec with an integration partner? Yes. It contains no keys, customer data or account details. Your partner still needs a key from your organization to call the API. ### Will the API address change? It may move to a dedicated `api.` address. If it does, the old one keeps working for a notice period, the new one appears on **API Keys**, and the change is listed in the changelog above. ### Why does the spec show a different address from mine? The spec and the collection carry Deeptrack's production address. If **API Keys** shows another one, use that, and change `baseUrl` in Postman or the base path in your generated client. ### Where are the request and response examples? In the spec, on each operation, and in the guides with curl, Node and Python. ## Related guides * [Quick start](https://docs.deeptrack.io/sentinel/quickstart.md) * [KYC API](https://docs.deeptrack.io/sentinel/kyc.md) * [Documents API](https://docs.deeptrack.io/sentinel/documents.md) * [AML and monitoring API](https://docs.deeptrack.io/sentinel/aml-and-monitoring.md) * [Transactions API](https://docs.deeptrack.io/sentinel/transactions.md) * [Results and credits](https://docs.deeptrack.io/sentinel/results-and-credits.md) * [Webhooks](https://docs.deeptrack.io/sentinel/webhooks.md) * [KYB and capture links API](https://docs.deeptrack.io/sentinel/kyb-and-capture-links.md) This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.