Get a key from /admin/apikeys
Open /admin/apikeys, click Generate key, and copy the plaintext — we only show it once. The plaintext you copy should look like the placeholder below (yours will have a real workspace ID after the cr_ws_ prefix):
Lost it? Mint a new one — the SHA-256 hash is what we store, so the plaintext is unrecoverable.
Pass it in an Authorization: Bearer header
Every /api/v1 endpoint expects your key in an Authorization header. Replace the placeholder below with your real key and run it — you should get a 200 with a workflows array back.
# list your workspace's workflows (Team + Business) curl -sS \ -H "Authorization: Bearer cr_ws_REPLACE_WITH_YOUR_KEY_HERE…" \ https://cipherrun.polsia.app/api/v1/workflows
200 OK { "workflows": [ { "id": 1, "name": "Phishing Email Triage", "trigger_name": "email_received" }, { "id": 2, "name": "SaaS Misconfig Hunter", "trigger_name": "alert_triggered" } ] }
Pick a curl for your tier
Each tier unlocks deeper endpoints. The two examples below cover what Team and Business workspaces see — both routes are live now at https://cipherrun.polsia.app/api/v1, so you can copy-paste straight to a working call.
GET /api/v1/workflows returns the workflows configured under your workspace — one row per workflow with the trigger it fires on.
curl -sS \
-H "Authorization: Bearer cr_ws_REPLACE_WITH_YOUR_KEY_HERE…" \
https://cipherrun.polsia.app/api/v1/workflows
200 OK { "workflows": [ { "id": 1, "name": "Phishing Email Triage", "trigger_name": "email_received" }, { "id": 2, "name": "SaaS Misconfig Hunter", "trigger_name": "alert_triggered" }, { "id": 3, "name": "Threat Intel Enrichment", "trigger_name": "file_detected" } ] }
GET /api/v1/incidents returns the last 100 workflow runs for your workspace — the per-incident row your SOC 2 / HIPAA evidence collection needs. Status, duration, risk score, timestamp.
curl -sS \
-H "Authorization: Bearer cr_ws_REPLACE_WITH_YOUR_KEY_HERE…" \
https://cipherrun.polsia.app/api/v1/incidents
200 OK { "incidents": [ { "id": 8421, "workflow_slug": "phishing-triage", "status": "completed", "duration_ms": 7812, "score": 87, "started_at": "2026-07-22T14:32:01Z", "created_at": "2026-07-22T14:32:08Z" } ] }
This is the row your auditor opens when they ask for evidence of automated incident handling.
Now that you've hit /api/v1 from curl, you can wire it into a SIEM, a Slack bot, or a cron job. Mint additional keys with labels to keep them organized.