Product
V1 · observation only
A small surface, deliberately.
Four public routes in total: enrol an installation, fetch its configuration, check the commercial bootstrap, and post telemetry. Everything else is either read-only or refused.
Public surface
Everything is closed until it is explicitly opened.
The default posture is private: a route is unreachable from the public internet unless it appears on an opt-in list. That is the inverse of the usual arrangement, and it is why the surface stays small.
| Method | Route | Credential | Purpose |
|---|---|---|---|
| POST | /v1/installations/enroll | admin key + IP allowlist | Registers an installation and issues its credentials once. |
| GET | /v1/installations/config | installation key + id | Returns the configuration for that installation only. |
| GET | /api/commercial/bootstrap | public | Platform status and mode. Safe to poll. |
| POST | /api/ea-telemetry/v1/ingest | telemetry key | The one write path a live fleet needs. Contract → |
Credentials
Three tiers, no shared secret.
A compromised terminal key must not become an operator key, so the two are never the same credential and never grant the same reach. Installation keys are 256-bit CSPRNG values, stored only as a SHA-256 hash, and returned exactly once at enrolment — we cannot show you a key again because we do not have it.
Admin access is doubly gated. The operator key is compared in constant time and the request source must also be on an IP allowlist. Failing either is a rejection, not a retry prompt.
| Tier | Header | Reach |
|---|---|---|
| telemetry | X-Sentinel-Telemetry-Key | Ingest only. Without a configured key, ingest is loopback-only. |
| installation | X-Sentinel-Installation-Id | Read its own configuration. Inactive tenant → 403 TENANT_INACTIVE. |
| operator | X-Sentinel-Admin-Key | Enrolment and dashboard mutations. Constant-time compare plus IP allowlist. |
Tenant isolation
Enforced by the database, not by a WHERE clause.
Tenant and audit tables run PostgreSQL row-level security with FORCE ROW LEVEL SECURITY, and the application role is NOBYPASSRLS — it cannot opt out even if application code asks it to. Session context is pinned transaction-locally, so connection pooling cannot leak one tenant’s context into another’s query.
Scoped honestly. That guarantee covers the enrolment and audit plane. The telemetry ingest path is not tenant-scoped today: it writes to a shared latest-value store under a single platform key. If per-tenant telemetry separation is a requirement for you, say so during the access conversation rather than assuming it.
X-Sentinel-Admin-Key: ••••••••
{
"tenantSlug": "northwall-desk",
"installationId": "b2f1…",
"telemetryKey": "shown once, stored as SHA-256",
"maxInstallations": 5,
"maxTradingAccounts": 25
}
Those two limits are recorded, not enforced. They exist as tenant fields and no code checks them at ingest or enrolment time. They describe a commercial agreement; they are not a technical quota. There is no rate limiting in the product either.
Operational posture
Hardened where it costs us something.
-
Refuses unsafe configuration
Startup validation rejects non-HTTPS public URLs, URLs carrying credentials, and hosts resolving to loopback or private ranges. Plain HTTP is permitted only on loopback. Bad config fails the boot, not the audit six months later.
-
Audited both ways
Every ingest attempt writes an audit entry — allowed and denied alike — with endpoint, actor, reason and account key. Enrolment records the source IP and whether the request was authorised.
-
Reads are never blocked
Observation mode only ever considers non-GET requests for blocking. Monitoring never breaks because the safety layer engaged.
Stack
Quantisentry on Sentinel Cloud.
Quantisentry is the commercial face operators deal with. Sentinel Cloud is the platform underneath: the API host, tenancy, observation middleware and the analytical engines.