We are currently building something exciting and will be launching soon. Registration is temporarily closed. Launching soon — registration temporarily closed.

Cybersecurity API

Classify security-relevant text into structured threat signals. Sentiqra's Cybersecurity API classifies submitted text against 200 indicators across 6 threat groups in 15 supported languages.

Use the results to enrich SIEM events, security tickets, email-analysis workflows, threat-intelligence reports, and analyst review.

POST /v1/analyze · REST · JSON · Bearer authentication

Scope

Sentiqra classifies security-related text. It does not independently inspect endpoints, packets, binaries, authentication history, or external threat-intelligence sources.

Make your first request

curl -X POST https://sentiqra.tech/v1/analyze \
  -H "Authorization: Bearer $SENTIQRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "text": "Your account will be suspended today. Verify your password at this link.",
    "language": "en",
    "analyzers": [
        "cybersecurity"
    ]
}'

Example response:

{
    "language": "en",
    "language_source": "declared",
    "signals": [
        {
            "analyzer": "cybersecurity",
            "code": "phishing_delivery",
            "label": "Phishing Delivery",
            "score": 0.94,
            "level": "category"
        },
        {
            "analyzer": "cybersecurity",
            "code": "credential_lure",
            "label": "Credential Lure",
            "score": 0.93,
            "level": "label",
            "parent": "phishing_delivery"
        },
        {
            "analyzer": "cybersecurity",
            "code": "urgency_lure",
            "label": "Urgency Lure",
            "score": 0.89,
            "level": "label",
            "parent": "phishing_delivery"
        }
    ],
    "meta": {
        "analyzers": [
            {
                "name": "cybersecurity",
                "status": "completed",
                "applicability": "analyzable",
                "assessment": "signals_detected",
                "signal_count": 3,
                "billed": true
            }
        ]
    },
    "usage": {
        "analyzer_runs": 1
    },
    "verification": {
        "configuration": "sqcfg_6X29ABXM",
        "fingerprint": "fp_8a72...19f",
        "input_commitment": "ic_31bd...a42",
        "signature": "sig_ed25519_4c1f...e2a",
        "key_id": "edk_af4f218e"
    }
}

Don't have an API key? Generate one from the API Keys page in your dashboard.

Endpoint

POST /v1/analyze

Classifies security-relevant text and returns ranked threat groups and indicators.

Request

{
    "text": "Your account will be suspended today. Verify your password at this link.",
    "language": "en",
    "analyzers": [
        "cybersecurity"
    ]
}

Parameters

Parameter Type Required Default Description
textstringYes-Text to analyze
languagestringNo"en"Supported language code
Advanced parameters →

Related endpoints

GET /v1/meta/domains/cybersecurity

Identifier, availability, and endpoint for this analyzer. Send a Bearer API key for taxonomy summary and supported languages.

GET /v1/meta/domains

Lists all analyzers with identifiers, status, and endpoints - no authentication required. Send a Bearer API key for taxonomy size and language counts.

What the API analyzes

Good inputs

  • • Email subjects and bodies
  • • Security-alert descriptions
  • • Incident tickets
  • • Threat-intelligence reports
  • • Analyst notes
  • • Chat or messaging content
  • • Textual output from other security systems

Not directly analyzed

  • • Packets
  • • Executable files
  • • Binary malware
  • • Raw identity history
  • • Network graphs
  • • Live endpoint telemetry

Sentiqra classifies the information present in that text. For example, text saying that a YARA rule matched can be classified as a malware-analysis signal. Sentiqra does not itself execute the YARA rule. Likewise, text describing impossible travel can be classified as an authentication anomaly. Sentiqra does not independently inspect login history to establish impossible travel.

Response structure

groups

High-level security categories (level: "category").

{
    "analyzer": "cybersecurity",
    "code": "phishing_delivery",
    "label": "Phishing Delivery",
    "score": 0.94,
    "level": "category"
}

signals

Label-level signals nested under a category.

{
    "analyzer": "cybersecurity",
    "code": "credential_lure",
    "label": "Credential Lure",
    "score": 0.93,
    "level": "label",
    "parent": "phishing_delivery"
}

parent

Category slug this label-level signal belongs to. Dotted form is group.label - e.g. phishing_delivery.credential_lure means credential_lure sits under phishing_delivery.

Field Type Description
codestringStable machine identifier
labelstringHuman-readable display name
parentstringParent category code (label-level only)
scorefloatSignal-match strength (0.0–1.0)

Important behavior

Determinism

For the same normalized input evaluated against the same pinned configuration and output profile, Sentiqra returns the same canonical signals. Version changes are explicit.

Confidence

A score expresses signal-match strength under a particular analyzer configuration. It is not a probability that the signal or a downstream action is correct. Validate action thresholds on representative labeled data.

Privacy

Submitted text is processed in memory and not retained. See data handling for exact retention behavior.

Limits

Character limit, RPS, and monthly quota depend on your plan. See pricing for current limits.

Signal scores

A score expresses signal-match strength under a particular analyzer configuration. It is not a probability that the signal or a downstream action is correct. Validate action thresholds on representative labeled data.

Paid API keys receive the continuous score (profile full.v1); anonymous, playground, demo, and free-tier responses return banded scores with a confidence band (profile reduced.v1). See Understanding signals for the profile and band table.

A score does not mean that a security incident is confirmed or that a downstream remediation action is correct. Set alerting, escalation, and automation thresholds according to:

  • • Indicator type
  • • Source reliability
  • • Your false-positive tolerance
  • • Other security evidence
  • • Your own labeled evaluation data

Scores express signal-match strength under the analyzer configuration, not universal response thresholds. Validate routing thresholds by indicator and workflow using your own labeled data.

200 indicators across 6 groups

The taxonomy contains 6 core groups with ~33 indicators each, plus an Other fallback group.

Phishing & Social Engineering
Credential & Identity Abuse
Privilege Escalation
Persistence
Defense Evasion
Malware Execution
Lateral Movement
Network Command & Control
Data Access & Exfiltration
Cloud & SaaS Abuse

Selected indicators can be mapped to relevant MITRE ATT&CK techniques where applicable.

Deterministic classification

For the same normalized text evaluated against the same supported pinned configuration and output profile, Sentiqra returns the same canonical signals.

Version changes are explicit so historical and current analyzer behavior can be distinguished.

Supported languages

Cybersecurity currently supports 15 languages.

Code Language Status
en English Production
fr French Production
de German Production
es Spanish Production
it Italian Production
pl Polish Production
no Norwegian Production
sv Swedish Production
da Danish Production
ja Japanese Production
ko Korean Production
fi Finnish Production
nl Dutch Production
zh Chinese Production
he Hebrew Production

All languages this detector supports are enabled on every plan. Custom or restricted arrangements may scope language access - check the dashboard or GET /v1/account/entitlements for account-specific availability.

Detector does not support language → 400 unsupported_language
Detector supports language but the account is not entitled (restricted/custom arrangements only - GA plans include all supported languages) → 403 language_not_in_plan

View language coverage and benchmarks →

Errors and limits

The API returns standard HTTP status codes:

Code Description
400Invalid input
401Authentication failure
403Access unavailable
413Input too large
429Rate or quota exceeded
500Internal error
503Temporary service unavailable

For retryable responses, follow documented backoff and Retry-After behavior.

Header Description
X-RateLimit-LimitMax requests per second
X-RateLimit-RemainingRemaining requests in current window
X-RateLimit-ResetUnix timestamp when window resets
View current pricing and limits →

Data handling

Sentiqra documents separately what crosses and remains within the service boundary:

Raw request content

Submitted text is processed in memory and not retained. No model training on your data.

Signal metadata

Individual signal results are not stored. Only aggregate counters are derived from them before the response is sent, apart from the bounded idempotency replay copy and webhook delivery payloads described in the retention schedule.

Operational metadata

Request status, key identifiers, latency, and billing information are logged for operational purposes.

Integrate with your existing stack

Sentiqra supplies structured classification evidence. Your security tools decide what happens next.

Security text / event description
        ↓
Sentiqra classification
        ↓
SIEM / SOAR / analyst workflow
        ↓
Customer-defined response

Sentiqra does not replace EDR, NDR, malware analysis, SIEM, or analyst judgment. Use structured classifications to enrich triage, routing, and investigation workflows.

Code examples

All examples use environment variables for API keys - do not hard-code keys in source.

curl -X POST https://sentiqra.tech/v1/analyze \
  -H "Authorization: Bearer $SENTIQRA_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "text": "Your account will be suspended today. Verify your password at this link.",
    "language": "en",
    "analyzers": [
        "cybersecurity"
    ]
}'

Use an SDK

Official SDKs are available for Python, JavaScript, Go, and PHP.

View SDK preview →

Reading Cybersecurity output

What you can safely infer from a result - and what you must not.

Intended task

Turn security-relevant text - reported phishing, incident notes, threat-intel prose - into structured threat indicators your SOC queue can route on.

Input requirements

  • text - the only field analyzed; up to 4,096 Unicode code points. Over the limit is rejected with input_too_long, never truncated.
  • language - must be a language this analyzer supports. Unsupported codes are rejected with 400 unsupported_language, never analyzed as a different language.
  • analyzers - include "cybersecurity"; up to 2 analyzers per request, one billed run each.
  • No context beyond text - no user IDs, history, profiles, or attachments are read or inferred.
  • Analyzes message/report text only - headers, rendered URLs, attachments, and telemetry are out of scope.

Ordinary positive

“Your mailbox storage is full. Verify your password within 24 hours at the link below or your account will be suspended.”

phishing_delivery very high
credential_lure high
urgency_lure high

Safe inference: The text matches documented phishing patterns. You can route it to a credential-threat lane and attach the receipt to the ticket.

Confusing negative · Quotation

“The lure read "verify your password within 24 hours" - the SOC confirmed the campaign on Tuesday.”

What happens: Phishing indicators can still fire on the quoted lure. The signal describes the language in the text - it is not evidence that an attack actually occurred, and not a verdict on the analyst's report.

Why it's tricky: The analyzer cannot distinguish a lure from someone quoting a lure. Signals on incident write-ups and forwarded phish are expected - triage by where the text came from, not just what it says.

What you can safely infer

  • Which documented threat indicators the text matched, and at what signal-match strength.
  • That the same input on the same pinned configuration replays identically for your incident record.

What you must not infer

  • ✕That a flagged sender, domain, or account is actually malicious.
  • ✕That a described incident actually happened - the signal describes the text, it does not verify events.
  • ✕That unflagged text is benign - a missing signal means "not detected," never "safe."
  • ✕Anything about your network state - the analyzer sees text, not logs or endpoints.

Boundary: Security-language signals are not proof of compromise. A phishing or credential-abuse signal means the submitted text matches documented attack language - it does not confirm that an attack occurred, that a credential leaked, or that a sender is malicious.