Getting started

Your first Sentra call

You have your API key. Here's how to verify an action and run something in a sandbox — in about two minutes.

What Sentra is. A checkpoint your app calls before a consequential action (a payment, a data write, running untrusted code). It replies allow / contain / block, and it can run untrusted payloads in a sealed sandbox. It sits alongside your existing security — it doesn't replace your firewall or WAF.

1. Your credentials

You received two things by email:

Your API key — a secret string starting with sk_sentra_. Keep it private, like a password; send it only over secure channels and never commit it to a repo.
Your credit balance — 1 credit = 1 verify (/evaluate); 5 credits = 1 sandbox run (/run_in_seed).

2. Base URL & authentication

All requests go to your Sentra base URL, and every request must include your key in the x-api-key header.

Base URL:  https://sentra-cohort-cognitiveguard-api-mcp.onrender.com
Header:    x-api-key: YOUR_API_KEY

A request with a missing or wrong key returns 401 invalid api key. First request after a quiet period may take a few seconds to warm up.

3. Verify an action — POST`/evaluate`

Ask whether an action should proceed. Returns a verdict and a risk score (0–1).

curl -X POST https://sentra-cohort-cognitiveguard-api-mcp.onrender.com/evaluate \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "session_id": "user-42",
    "source": "checkout-service",
    "resource": "payments-api",
    "action": "transfer:execute"
  }'

Response:

{ "verdict": "contain", "risk": 0.2667 }

How to act on the verdict:

Verdict	Meaning	What you do
`allow`	Authorized and clean	Proceed with the real action.
`contain`	No/invalid authorization, or caught misbehaving	Do not perform it for real — divert, refuse, or log.
`block`	High-risk	Reject outright.

To get an allow, include a valid capability token you were issued for that resource/action in a capability field. Without one, a request to a protected resource is contained by design.

4. Run untrusted code — POST`/run_in_seed`

Execute a payload you don't trust inside a sealed, disposable sandbox with no network access, and get back what it did.

curl -X POST https://sentra-cohort-cognitiveguard-api-mcp.onrender.com/run_in_seed \
  -H "x-api-key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "session_id": "user-42",
    "payload": "echo hello-from-inside-the-seed",
    "timeout": 20
  }'

Response:

{ "contained": true, "exit_code": 0, "observed": "hello-from-inside-the-seed\n" }

The sandbox can't reach the internet or any real system, and it's destroyed after the call — so even a hostile payload has nowhere to go. Try "payload": "curl -m 5 https://example.com || echo BLOCKED" and you'll get back BLOCKED.

5. Python

import requests

BASE = "https://sentra-cohort-cognitiveguard-api-mcp.onrender.com"
KEY  = "YOUR_API_KEY"

r = requests.post(f"{BASE}/evaluate",
    headers={"x-api-key": KEY},
    json={"session_id": "user-42", "source": "checkout-service",
          "resource": "payments-api", "action": "transfer:execute"})
print(r.json())   # {'verdict': 'contain', 'risk': 0.2667}

Credits & limits

Each /evaluate uses 1 credit; each /run_in_seed uses 5 credits.
Requests are rate-limited per source. If you exceed the limit you'll get 429 rate limit exceeded — back off and retry.
Running low or need more? Buy another pack on the pricing page, or email us for a top-up.

Need help?

Email mailframeapp@gmail.com — we're happy to help you get your first integration working.

Your first Sentra call

1. Your credentials

2. Base URL & authentication

3. Verify an action — POST/evaluate

4. Run untrusted code — POST/run_in_seed

5. Python

Credits & limits

Need help?

3. Verify an action — POST`/evaluate`

4. Run untrusted code — POST`/run_in_seed`