/DOCS · QUICKSTART

Your first call to
/api/v1

Three steps. Two minutes. One working curl — copied from this page, pasted into your terminal, returned JSON.

→ Generate a key
STEP 1

Get a key from /admin/apikeys

Open /admin/apikeys, click Generate key, and copy the plaintext — we only show it once. The plaintext you copy should look like the placeholder below (yours will have a real workspace ID after the cr_ws_ prefix):

cr_ws_REPLACE_WITH_YOUR_KEY_HERE…

Lost it? Mint a new one — the SHA-256 hash is what we store, so the plaintext is unrecoverable.

STEP 2

Pass it in an Authorization: Bearer header

Every /api/v1 endpoint expects your key in an Authorization header. Replace the placeholder below with your real key and run it — you should get a 200 with a workflows array back.

# list your workspace's workflows (Team + Business)
curl -sS \
     -H "Authorization: Bearer cr_ws_REPLACE_WITH_YOUR_KEY_HERE…" \
     https://cipherrun.polsia.app/api/v1/workflows
EXPECTED RESPONSE
200 OK
{
  "workflows": [
    { "id": 1, "name": "Phishing Email Triage", "trigger_name": "email_received" },
    { "id": 2, "name": "SaaS Misconfig Hunter", "trigger_name": "alert_triggered" }
  ]
}
STEP 3

Pick a curl for your tier

Each tier unlocks deeper endpoints. The two examples below cover what Team and Business workspaces see — both routes are live now at https://cipherrun.polsia.app/api/v1, so you can copy-paste straight to a working call.

TEAM
List every workflow in your workspace

GET /api/v1/workflows returns the workflows configured under your workspace — one row per workflow with the trigger it fires on.

curl -sS \
     -H "Authorization: Bearer cr_ws_REPLACE_WITH_YOUR_KEY_HERE…" \
     https://cipherrun.polsia.app/api/v1/workflows
EXPECTED RESPONSE
200 OK
{
  "workflows": [
    { "id": 1, "name": "Phishing Email Triage",      "trigger_name": "email_received" },
    { "id": 2, "name": "SaaS Misconfig Hunter",      "trigger_name": "alert_triggered" },
    { "id": 3, "name": "Threat Intel Enrichment",    "trigger_name": "file_detected" }
  ]
}
BUSINESS
Pull the incident audit trail

GET /api/v1/incidents returns the last 100 workflow runs for your workspace — the per-incident row your SOC 2 / HIPAA evidence collection needs. Status, duration, risk score, timestamp.

curl -sS \
     -H "Authorization: Bearer cr_ws_REPLACE_WITH_YOUR_KEY_HERE…" \
     https://cipherrun.polsia.app/api/v1/incidents
EXPECTED RESPONSE
200 OK
{
  "incidents": [
    {
      "id": 8421,
      "workflow_slug": "phishing-triage",
      "status": "completed",
      "duration_ms": 7812,
      "score": 87,
      "started_at": "2026-07-22T14:32:01Z",
      "created_at": "2026-07-22T14:32:08Z"
    }
  ]
}

This is the row your auditor opens when they ask for evidence of automated incident handling.

You're authenticated. Go build.

Now that you've hit /api/v1 from curl, you can wire it into a SIEM, a Slack bot, or a cron job. Mint additional keys with labels to keep them organized.