Ingest API

Everything you can do with the upload page you can do from a script, using a token scoped to your tenant. This is how the CI gate works, and it is also how you would automate a nightly upload from a scanner with no connector.

The two base URLs

Sinterly has two hosts, and the ingest calls go to the pipeline rather than to the dashboard API. Getting this the wrong way round is the most common first mistake.

Host	Used for
`https://api.sinterly.com`	The dashboard API, including creating and revoking ingest tokens
`https://pipeline.sinterly.com`	Ingest: preview, commit and run status. This is `$SINTERLY_URL` in the examples below.

export SINTERLY_URL=https://pipeline.sinterly.com
export SINTERLY_TOKEN=stk_...

Create a token

Tokens are created by an AppSec Lead. The plaintext token is shown once and never again; only a hash is stored, so nobody, including us, can recover it later. If it is lost, revoke it and mint another.

curl -X POST https://api.sinterly.com/api/admin/tokens \
     -H "Authorization: Bearer <your session token>" \
     -H "Content-Type: application/json" \
     -d '{"name": "github-actions"}'

Tokens begin stk_. Revoking one is immediate, and revoked tokens keep their usage history for audit rather than being deleted.

The token identifies your tenant. There is no tenant parameter to get wrong, and a request that names a different tenant is refused.

Preview a file without writing anything

curl -X POST "$SINTERLY_URL/ingest/preview?format=sarif" \
     -H "Authorization: Bearer $SINTERLY_TOKEN" \
     --data-binary @results.sarif

Returns the finding count, severity breakdown and sample titles. Nothing is stored. Useful as a sanity check in a pipeline before committing.

Ingest a file

curl -X POST "$SINTERLY_URL/ingest/commit?format=sarif" \
     -H "Authorization: Bearer $SINTERLY_TOKEN" \
     --data-binary @results.sarif

{"status": "accepted", "run_id": "...", "tenant_id": "...", "timestamp": "..."}

Ingestion is asynchronous. The call returns immediately with a run identifier, because a real ingest takes minutes rather than seconds.

Check what happened

curl "$SINTERLY_URL/ingest/runs/$RUN_ID" \
     -H "Authorization: Bearer $SINTERLY_TOKEN"

Returns the run status and, once the run has finished, the gate verdict. The shape is documented in The CI gate.

Accepted formats and limits

Parameter	Values
`format`	`sarif`, `csv`, `otm`
Maximum file size	25 MB

Response codes

Code	Meaning
200	Preview or status returned
202	File accepted, ingestion started
400	Missing or malformed parameter
401	Token missing, unknown or revoked
403	The request named a tenant the token does not belong to
404	Unknown run, or a run belonging to another tenant
413	File larger than 25 MB
422	The file could not be parsed as the format you declared

Keeping the token safe

Store it as a secret in your CI system, never in the repository.
Use one token per pipeline, so a single revocation does not stop everything.
Revoke immediately if a build log ever prints it.

An ingest token can add findings to your tenant. It cannot read your findings, change settings, or act on anything else.