Cybersecurity API
Classify security-relevant text into structured threat signals. Sentiqra's Cybersecurity API classifies submitted text against 200 indicators across 6 threat groups in 15 supported languages.
Use the results to enrich SIEM events, security tickets, email-analysis workflows, threat-intelligence reports, and analyst review.
POST /v1/analyze · REST · JSON · Bearer authentication
Scope
Sentiqra classifies security-related text. It does not independently inspect endpoints, packets, binaries, authentication history, or external threat-intelligence sources.
Make your first request
curl -X POST https://sentiqra.tech/v1/analyze \
-H "Authorization: Bearer $SENTIQRA_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"text": "Your account will be suspended today. Verify your password at this link.",
"language": "en",
"analyzers": [
"cybersecurity"
]
}'
Example response:
{
"language": "en",
"language_source": "declared",
"signals": [
{
"analyzer": "cybersecurity",
"code": "phishing_delivery",
"label": "Phishing Delivery",
"score": 0.94,
"level": "category"
},
{
"analyzer": "cybersecurity",
"code": "credential_lure",
"label": "Credential Lure",
"score": 0.93,
"level": "label",
"parent": "phishing_delivery"
},
{
"analyzer": "cybersecurity",
"code": "urgency_lure",
"label": "Urgency Lure",
"score": 0.89,
"level": "label",
"parent": "phishing_delivery"
}
],
"meta": {
"analyzers": [
{
"name": "cybersecurity",
"status": "completed",
"applicability": "analyzable",
"assessment": "signals_detected",
"signal_count": 3,
"billed": true
}
]
},
"usage": {
"analyzer_runs": 1
},
"verification": {
"configuration": "sqcfg_6X29ABXM",
"fingerprint": "fp_8a72...19f",
"input_commitment": "ic_31bd...a42",
"signature": "sig_ed25519_4c1f...e2a",
"key_id": "edk_af4f218e"
}
}
Don't have an API key? Generate one from the API Keys page in your dashboard.
Endpoint
/v1/analyze
Classifies security-relevant text and returns ranked threat groups and indicators.
Request
{
"text": "Your account will be suspended today. Verify your password at this link.",
"language": "en",
"analyzers": [
"cybersecurity"
]
}
Parameters
| Parameter | Type | Required | Default | Description |
|---|---|---|---|---|
| text | string | Yes | - | Text to analyze |
| language | string | No | "en" | Supported language code |
Advanced parameters →
Related endpoints
GET /v1/meta/domains/cybersecurity
Identifier, availability, and endpoint for this analyzer. Send a Bearer API key for taxonomy summary and supported languages.
GET /v1/meta/domains
Lists all analyzers with identifiers, status, and endpoints - no authentication required. Send a Bearer API key for taxonomy size and language counts.
What the API analyzes
Good inputs
- • Email subjects and bodies
- • Security-alert descriptions
- • Incident tickets
- • Threat-intelligence reports
- • Analyst notes
- • Chat or messaging content
- • Textual output from other security systems
Not directly analyzed
- • Packets
- • Executable files
- • Binary malware
- • Raw identity history
- • Network graphs
- • Live endpoint telemetry
Sentiqra classifies the information present in that text. For example, text saying that a YARA rule matched can be classified as a malware-analysis signal. Sentiqra does not itself execute the YARA rule. Likewise, text describing impossible travel can be classified as an authentication anomaly. Sentiqra does not independently inspect login history to establish impossible travel.
Response structure
groups
High-level security categories (level: "category").
{
"analyzer": "cybersecurity",
"code": "phishing_delivery",
"label": "Phishing Delivery",
"score": 0.94,
"level": "category"
}
signals
Label-level signals nested under a category.
{
"analyzer": "cybersecurity",
"code": "credential_lure",
"label": "Credential Lure",
"score": 0.93,
"level": "label",
"parent": "phishing_delivery"
}
parent
Category slug this label-level signal belongs to. Dotted form is group.label - e.g. phishing_delivery.credential_lure means credential_lure sits under phishing_delivery.
| Field | Type | Description |
|---|---|---|
| code | string | Stable machine identifier |
| label | string | Human-readable display name |
| parent | string | Parent category code (label-level only) |
| score | float | Signal-match strength (0.0–1.0) |
Important behavior
Determinism
For the same normalized input evaluated against the same pinned configuration and output profile, Sentiqra returns the same canonical signals. Version changes are explicit.
Confidence
A score expresses signal-match strength under a particular analyzer configuration. It is not a probability that the signal or a downstream action is correct. Validate action thresholds on representative labeled data.
Privacy
Submitted text is processed in memory and not retained. See data handling for exact retention behavior.
Limits
Character limit, RPS, and monthly quota depend on your plan. See pricing for current limits.
Signal scores
A score expresses signal-match strength under a particular analyzer configuration. It is not a probability that the signal or a downstream action is correct. Validate action thresholds on representative labeled data.
Paid API keys receive the continuous score (profile full.v1); anonymous, playground, demo, and free-tier responses return banded scores with a confidence band (profile reduced.v1). See Understanding signals for the profile and band table.
A score does not mean that a security incident is confirmed or that a downstream remediation action is correct. Set alerting, escalation, and automation thresholds according to:
- • Indicator type
- • Source reliability
- • Your false-positive tolerance
- • Other security evidence
- • Your own labeled evaluation data
Scores express signal-match strength under the analyzer configuration, not universal response thresholds. Validate routing thresholds by indicator and workflow using your own labeled data.
200 indicators across 6 groups
The taxonomy contains 6 core groups with ~33 indicators each, plus an Other fallback group.
Selected indicators can be mapped to relevant MITRE ATT&CK techniques where applicable.
Deterministic classification
For the same normalized text evaluated against the same supported pinned configuration and output profile, Sentiqra returns the same canonical signals.
Version changes are explicit so historical and current analyzer behavior can be distinguished.
Supported languages
Cybersecurity currently supports 15 languages.
| Code | Language | Status |
|---|---|---|
| en | English | Production |
| fr | French | Production |
| de | German | Production |
| es | Spanish | Production |
| it | Italian | Production |
| pl | Polish | Production |
| no | Norwegian | Production |
| sv | Swedish | Production |
| da | Danish | Production |
| ja | Japanese | Production |
| ko | Korean | Production |
| fi | Finnish | Production |
| nl | Dutch | Production |
| zh | Chinese | Production |
| he | Hebrew | Production |
All languages this detector supports are enabled on every plan. Custom or restricted arrangements may scope language access - check the dashboard or GET /v1/account/entitlements for account-specific availability.
Detector does not support language → 400 unsupported_language
Detector supports language but the account is not entitled (restricted/custom arrangements only - GA plans include all supported languages) → 403 language_not_in_plan
Errors and limits
The API returns standard HTTP status codes:
| Code | Description |
|---|---|
| 400 | Invalid input |
| 401 | Authentication failure |
| 403 | Access unavailable |
| 413 | Input too large |
| 429 | Rate or quota exceeded |
| 500 | Internal error |
| 503 | Temporary service unavailable |
For retryable responses, follow documented backoff and Retry-After behavior.
| Header | Description |
|---|---|
| X-RateLimit-Limit | Max requests per second |
| X-RateLimit-Remaining | Remaining requests in current window |
| X-RateLimit-Reset | Unix timestamp when window resets |
Data handling
Sentiqra documents separately what crosses and remains within the service boundary:
Raw request content
Submitted text is processed in memory and not retained. No model training on your data.
Signal metadata
Individual signal results are not stored. Only aggregate counters are derived from them before the response is sent, apart from the bounded idempotency replay copy and webhook delivery payloads described in the retention schedule.
Operational metadata
Request status, key identifiers, latency, and billing information are logged for operational purposes.
Integrate with your existing stack
Sentiqra supplies structured classification evidence. Your security tools decide what happens next.
Security text / event description
↓
Sentiqra classification
↓
SIEM / SOAR / analyst workflow
↓
Customer-defined response
Sentiqra does not replace EDR, NDR, malware analysis, SIEM, or analyst judgment. Use structured classifications to enrich triage, routing, and investigation workflows.
Code examples
All examples use environment variables for API keys - do not hard-code keys in source.
curl -X POST https://sentiqra.tech/v1/analyze \
-H "Authorization: Bearer $SENTIQRA_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"text": "Your account will be suspended today. Verify your password at this link.",
"language": "en",
"analyzers": [
"cybersecurity"
]
}'
Reading Cybersecurity output
What you can safely infer from a result - and what you must not.
Intended task
Turn security-relevant text - reported phishing, incident notes, threat-intel prose - into structured threat indicators your SOC queue can route on.
Input requirements
text- the only field analyzed; up to 4,096 Unicode code points. Over the limit is rejected withinput_too_long, never truncated.language- must be a language this analyzer supports. Unsupported codes are rejected with400 unsupported_language, never analyzed as a different language.analyzers- include"cybersecurity"; up to 2 analyzers per request, one billed run each.- No context beyond
text- no user IDs, history, profiles, or attachments are read or inferred. - Analyzes message/report text only - headers, rendered URLs, attachments, and telemetry are out of scope.
Ordinary positive
“Your mailbox storage is full. Verify your password within 24 hours at the link below or your account will be suspended.”
Safe inference: The text matches documented phishing patterns. You can route it to a credential-threat lane and attach the receipt to the ticket.
Confusing negative · Quotation
“The lure read "verify your password within 24 hours" - the SOC confirmed the campaign on Tuesday.”
What happens: Phishing indicators can still fire on the quoted lure. The signal describes the language in the text - it is not evidence that an attack actually occurred, and not a verdict on the analyst's report.
Why it's tricky: The analyzer cannot distinguish a lure from someone quoting a lure. Signals on incident write-ups and forwarded phish are expected - triage by where the text came from, not just what it says.
What you can safely infer
- Which documented threat indicators the text matched, and at what signal-match strength.
- That the same input on the same pinned configuration replays identically for your incident record.
What you must not infer
- ✕That a flagged sender, domain, or account is actually malicious.
- ✕That a described incident actually happened - the signal describes the text, it does not verify events.
- ✕That unflagged text is benign - a missing signal means "not detected," never "safe."
- ✕Anything about your network state - the analyzer sees text, not logs or endpoints.
Boundary: Security-language signals are not proof of compromise. A phishing or credential-abuse signal means the submitted text matches documented attack language - it does not confirm that an attack occurred, that a credential leaked, or that a sender is malicious.
Next steps
Quickstart
Make your first cybersecurity request.
Threat groups
Browse the complete taxonomy.
Indicator dictionary
Search all 200 labels.
SDKs
Python, JavaScript, Go, and PHP.
Benchmarks
Review evaluation methodology.
Playground
Test detection live - no API key needed.
Request accessStart building for free.