API

API version: v2

The Sensu backend REST API provides access to Sensu workflow configurations and monitoring event data. For information about the Sensu agent API, see the agent reference.

If you have a healthy clustered backend, you only need to make Sensu API calls to any one of the cluster members. The cluster protocol will replicate your changes to all cluster members.

Available APIs

Access all of the data and functionality of Sensu’s first-class API clients, sensuctl and the web UI, with Sensu’s backend REST APIs. Use the Sensu APIs to customize your workflows and integrate your favorite Sensu features with other tools and products.

• APIKeys API
• Assets API
• Authentication API
• Authentication providers API
• Checks API
• Cluster API
• Cluster role bindings API
• Cluster roles API
• Datastore API
• Entities API
• Events API
• Federation API
• Filters API
• Handlers API
• Health API
• Hooks API
• License API
• Metrics API
• Mutators API
• Namespaces API
• Prune API
• Role bindings API
• Roles API
• Searches API
• Secrets API
• Silencing API
• Tessen API
• Users API
• Version API
• Web UI configuration API

URL format

Sensu API endpoints use the standard URL format /api/{group}/{version}/namespaces/{namespace} where:

• {group} is the API group: core.
• {version} is the API version: v2.
• {namespace} is the namespace name. The examples in these API docs use the default namespace. The Sensu API requires the authenticated user to have the correct access permissions for the namespace specified in the URL. If the authenticated user has the correct cluster-wide permissions, you can leave out the /namespaces/{namespace} portion of the URL to access Sensu resources across namespaces. See the RBAC reference for more information about configuring Sensu users and access controls.

Data format

The Sensu API uses JSON-formatted requests and responses. In terms of sensuctl output types, the Sensu API uses the json format, not wrapped-json.

Versioning

The Sensu Go API is versioned according to the format v{majorVersion}{stabilityLevel}{iterationNumber}, in which v2 is stable version 2. The Sensu API guarantees backward compatibility for stable versions of the API.

Sensu does not guarantee that an alpha or beta API will be maintained for any period of time. Consider alpha versions under active development — they may not be published for every release. Beta APIs are more stable than alpha versions, but they offer similarly short-lived lifespans and also are not guaranteed to convert programmatically when the API is updated.

Request size limit

API request bodies are limited to 0.512 MB in size.

Access control

With the exception of the authentication, health, and metrics APIs, the Sensu API requires authentication using a JSON Web Token (JWT) access token or API key.

Code examples in the Sensu API docs use the environment variable $SENSU_API_KEY to represent a valid API key in API requests.

Authentication quickstart

To set up a local API testing environment, save your Sensu credentials and token as environment variables:

# Requires curl and jq
export SENSU_USER=YOUR_USERNAME && SENSU_PASS=YOUR_PASSWORD

export SENSU_ACCESS_TOKEN=`curl -X GET -u "$SENSU_USER:$SENSU_PASS" -s http://localhost:8080/auth | jq -r ".access_token"`

The sensuctl reference demonstrates how to use the sensuctl env command to export your access token, token expiry time, and refresh token as environment variables.

Authenticate with the authentication API

Use the authentication API and your Sensu username and password to generate access tokens and refresh tokens. The /auth API endpoint lets you generate short-lived API tokens using your Sensu username and password.

1. Retrieve an access token for your user. For example, to generate an access token using example admin credentials:

   curl -u 'YOUR_USERNAME:YOUR_PASSWORD' http://localhost:8080/auth

   The access token should be included in the output, along with a refresh token:

   {
     "access_token": "eyJhbGciOiJIUzI1NiIs...",
     "expires_at": 1544582187,
     "refresh_token": "eyJhbGciOiJIUzI1NiIs..."
   }

   The access and refresh tokens are JWTs that Sensu uses to digitally sign the details of users’ authenticated Sensu sessions.

2. Use the access token in the authentication header of the API request. For example:

   curl -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
   http://127.0.0.1:8080/api/core/v2/namespaces/default/events

3. Refresh your access token every 15 minutes. Access tokens last for approximately 15 minutes. When your token expires, you should see a 401 Unauthorized response from the API. To generate a new access token, use the /auth/token API endpoint, including the expired access token in the authorization header and the refresh token in the request body:

   curl -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
   -H 'Content-Type: application/json' \
   -d '{"refresh_token": "eyJhbGciOiJIUzI1NiIs..."}' \
   http://127.0.0.1:8080/auth/token

   The new access token should be included in the output:

   {
     "access_token": "eyJhbGciOiJIUzI1NiIs...",
     "expires_at": 1561055277,
     "refresh_token": "eyJhbGciOiJIUzI1NiIs..."
   }

Generate an API token with sensuctl

You can also generate an API access token using the sensuctl command line tool. The user credentials that you use to configure sensuctl determine your permissions to get, list, create, update, and delete resources with the Sensu API.

1. Install and configure sensuctl.

2. Retrieve an access token for your user:

   cat ~/.config/sensu/sensuctl/cluster|grep access_token

   The access token should be included in the output:

   "access_token": "eyJhbGciOiJIUzI1NiIs...",

3. Copy the access token into the authentication header of the API request. For example:

   curl -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
   http://127.0.0.1:8080/api/core/v2/namespaces/default/events

4. Refresh your access token every 15 minutes. Access tokens last for approximately 15 minutes. When your token expires, you should see a 401 Unauthorized response from the API. To regenerate a valid access token, run any sensuctl command (like sensuctl event list) and repeat step 2.

Authenticate with an API key

Each Sensu API key (core/v2.APIKey) is a persistent UUID that maps to a stored Sensu username. The advantages of authenticating with API keys rather than access tokens include:

• More efficient integration: Check and handler plugins and other code can integrate with the Sensu API without implementing the logic required to authenticate via the /auth API endpoint to periodically refresh the access token
• Improved security: API keys do not require providing a username and password in check or handler definitions
• Better admin control: API keys can be created and revoked without changing the underlying user’s password, but keep in mind that API keys will continue to work even if the user’s password changes

API keys are cluster-wide resources, so only cluster admins can grant, view, and revoke them.

Configure an environment variable for API key authentication

Code examples in the Sensu API docs use the environment variable $SENSU_API_KEY to represent a valid API key in API requests.

Use sensuctl or the APIkeys API to generate an API key. Then, follow this example to export your API key to the SENSU_API_KEY environment variable you can use for API authentication:

export SENSU_API_KEY="83abef1e-e7d7-4beb-91fc-79ad90084d5b"

SET SENSU_API_KEY="83abef1e-e7d7-4beb-91fc-79ad90084d5b"

$Env:SENSU_API_KEY = "83abef1e-e7d7-4beb-91fc-79ad90084d5b"

Authorization header for API key authentication

Similar to the Bearer [token] Authorization header, Key [api-key] will be accepted as an Authorization header for authentication.

For example, a JWT Bearer [token] Authorization header might be:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/namespaces/default/checks

If you’re using Key [api-key] to authenticate instead, the Authorization header might be:

curl -H "Authorization: Key $SENSU_API_KEY" http://127.0.0.1:8080/api/core/v2/namespaces/default/checks

Example

This example uses the API key directly (rather than via an environment variable) to authenticate to the checks API:

$ curl -H "Authorization: Key 7f63b5bc-41f4-4b3e-b59b-5431afd7e6a2" http://127.0.0.1:8080/api/core/v2/namespaces/default/checks

HTTP/1.1 200 OK
[
  {
    "command": "check-cpu.sh -w 75 -c 90",
    "handlers": [
      "slack"
    ],
    "interval": 60,
    "publish": true,
    "subscriptions": [
      "linux"
    ],
    "metadata": {
      "name": "check-cpu",
      "namespace": "default",
      "created_by": "admin"
    }
  }
]

Pagination

The Sensu API supports response pagination for most core/v2 GET endpoints that return an array. You can request a paginated response with the limit and continue query parameters.

Limit query parameter

The following request limits the response to a maximum of two objects:

curl http://127.0.0.1:8080/api/core/v2/users?limit=2 -H "Authorization: Bearer $SENSU_ACCESS_TOKEN"

The response includes the available objects up to the specified limit.

Continue query parameter

If more objects are available beyond the limit you specified in a request, the response header includes a Sensu-Continue token you can use to request the next page of objects.

For example, the following response indicates that more than two users are available because it provides a Sensu-Continue token in the response header:

HTTP/1.1 200 OK
Content-Type: application/json
Sensu-Continue: L2RlZmF1bU2Vuc3UtTWFjQ
Sensu-Entity-Count: 3
Sensu-Entity-Limit: 100
Sensu-Entity-Warning: 
Date: Fri, 14 Feb 2020 15:44:25 GMT
Content-Length: 132
[
  {
    "username": "alice",
    "groups": [
      "ops"
    ],
    "disabled": false
  },
  {
    "username": "bob",
    "groups": [
      "ops"
    ],
    "disabled": false
  }
]

To request the next two available users, use the Sensu-Continue token included in the response header:

curl http://127.0.0.1:8080/api/core/v2/users?limit=2&continue=L2RlZmF1bU2Vuc3UtTWFjQ \
-H "Authorization: Bearer $SENSU_ACCESS_TOKEN"

If the response header does not include a Sensu-Continue token, there are no further objects to return. For example, this response header indicates that no further users are available:

HTTP/1.1 200 OK
Content-Type: application/json
Sensu-Entity-Count: 3
Sensu-Entity-Limit: 100
Sensu-Entity-Warning: 
Date: Fri, 14 Feb 2020 15:46:02 GMT
Content-Length: 54
[
  {
    "username": "alice",
    "groups": [
      "ops"
    ],
    "disabled": false
  }
]

Response filtering

COMMERCIAL FEATURE: Access API response filtering in the packaged Sensu Go distribution. For more information, see Get started with commercial features.

The Sensu API supports response filtering for all GET endpoints that return an array. You can filter resources based on their labels with the labelSelector query parameter and based on certain pre-determined fields with the fieldSelector query parameter.

Label selector

The labelSelector query parameter allows you to group resources by the label attributes specified in the resource metadata object. All resources support labels within the metadata object.

Field selector

The fieldSelector query parameter allows you to organize and select subsets of resources based on certain fields. Here’s the list of available fields:

API-specific syntax

To create an API response filter, you’ll write a brief filter statement. The operators and examples sections demonstrate how to construct API response filter statements for different operators and specific purposes.

The filter statement construction is slightly different for different operators, but there are a few general syntax rules that apply to all filter statements.

Spaces in the filter statement

As shown in this example:

'fieldSelector=silenced.expire_on_resolve == true'

• Do not use spaces around the = between the selector type and the rest of the filter statement.
• Do use spaces around the operator (in this example, the ==).

Quotation marks around the filter statement

Place the entire filter statement inside single quotes:

'fieldSelector=linux in check.subscriptions'

Exception: If the filter statement contains a shell variable, you must use double quotation marks around the statement:

"labelSelector=host == $HOSTNAME"

If you use single quotes around a filter statement that contains a shell variable, the single quotes will keep the variable intact instead of expanding it.

Values that begin with a number or include special characters

If you are filtering for a value that begins with a number, place the value in double quotes:

'fieldSelector=entity.name == "1b04994n"'

Likewise, to use a label or field selector with string values that include special characters like hyphens and underscores, place the value in double quotes:

'labelSelector:region == "us-west-1"'

Operators

Sensu’s API response filtering supports two equality-based operators, two set-based operators, one substring matching operator, and one logical operator.

Equality-based operators

Sensu’s two equality-based operators are == (equality) and != (inequality).

For example, to retrieve only checks with the label type and value server:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/checks -G \
--data-urlencode 'labelSelector=type == "server"'

To retrieve checks that are not in the production namespace:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/checks -G \
--data-urlencode 'fieldSelector=check.namespace != "production"'

Set-based operators

Sensu’s two set-based operators for lists of values are in and notin.

For example, to retrieve checks with a linux subscription:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/checks -G \
--data-urlencode 'fieldSelector=linux in check.subscriptions'

To retrieve checks that do not use the slack handler:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/checks -G \
--data-urlencode 'fieldSelector=slack notin check.handlers'

The in and notin operators have two important conditions:

• First, they only work when the underlying value you’re filtering for is a string. You can filter for strings and arrays of strings with in and notin operators, but you cannot use them to filter for integer, float, array, or Boolean values.
• Second, to filter for a string, the string must be to the left of the operator: string [in|notin] selector. To filter for an array of strings, the array must be to the right of the operator: selector [in|notin] [string1,string2].

Substring matching operator

Sensu’s substring matching operator is matches.

For example, to retrieve all checks whose name includes linux:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/checks -G \
--data-urlencode 'fieldSelector=check.name matches "linux"'

Suppose you are using Sensu to monitor 1000 entities that are named incrementally and according to technology. For example, your webservers are named webserver-1 through webserver-25, and your CPU entities are named cpu-1 through cpu-300, and so on. In this case, you can use matches to retrieve all of your webserver entities:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/entities -G \
--data-urlencode 'fieldSelector=entity.name matches "webserver-"'

Similarly, if you have entities labeled for different regions, you can use matches to find the entities that are labeled for the US (e.g. us-east-1, us-west-1, and so on):

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/entities -G \
--data-urlencode 'labelSelector:region matches "us"'

The matches operator only works when the underlying value you’re filtering for is a string. You can filter for strings and arrays of strings with the matches operator, but you cannot use it to filter for integer, float, array, or Boolean values. Also, the string must be to the right of the operator: selector matches string.

Logical operator

Sensu’s logical operator is && (AND). Use it to combine multiple statements separated with the logical operator in field and label selectors.

For example, the following cURL request retrieves checks that are not configured to be published and include the linux subscription:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/checks -G \
--data-urlencode 'fieldSelector=check.publish != true && linux in check.subscriptions'

To retrieve checks that are not published, include a linux subscription, and are in the dev namespace:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/checks -G \
--data-urlencode 'fieldSelector=check.publish != true && linux in check.subscriptions && dev in check.namespace'

Combined selectors

You can use field and label selectors in a single request. For example, to retrieve only checks that include a linux subscription and do not include a label for type server:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/checks -G \
--data-urlencode 'fieldSelector=linux in check.subscriptions' \
--data-urlencode 'labelSelector=type != "server"'

Examples

Values with special characters

To use a label or field selector with string values that include special characters like hyphens and underscores, place the value in single or double quotes:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -X GET http://127.0.0.1:8080/api/core/v2/entities -G \
--data-urlencode 'labelSelector=region == "us-west-1"'

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/entities -G \
--data-urlencode 'fieldSelector="entity:i-0c1f8a116b84ea50c" in entity.subscriptions'

Use selectors with arrays of strings

To retrieve checks that are in either the dev or production namespace:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/checks -G \
--data-urlencode 'fieldSelector=check.namespace in [dev,production]'

Filter events by entity or check

To retrieve events for a specific check (checkhttp):

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/events -G \
--data-urlencode 'fieldSelector=checkhttp in event.check.name'

Similary, to retrieve only events for the server entity:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/events -G \
--data-urlencode 'fieldSelector=server in event.entity.name'

Filter events by severity

Use the event.check.status field selector to retrieve events by severity. For example, to retrieve all events at 2 (CRITICAL) status:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/events -G \
--data-urlencode 'fieldSelector=event.check.status == "2"'

Filter all incidents

To retrieve all incidents (all events whose status is not 0):

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/events -G \
--data-urlencode 'fieldSelector=event.entity.status != "0"'

Filter checks, entities, or events by subscription

To list all checks that include the linux subscription:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/checks -G \
--data-urlencode 'fieldSelector=linux in check.subscriptions'

Similarly, to list all entities that include the linux subscription:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/entities -G \
--data-urlencode 'fieldSelector=linux in entity.subscriptions'

To list all events for the linux subscription, use the event.entity.subscriptions field selector:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/events -G \
--data-urlencode 'fieldSelector=linux in event.entity.subscriptions'

Filter silenced resources and silences

Filter silenced resources by namespace

To list all silenced resources for a particular namespace (in this example, the default namespace):

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN http://127.0.0.1:8080/api/core/v2/silenced -G \
--data-urlencode 'fieldSelector=silenced.namespace == "default"'

Likewise, to list all silenced resources except those in the default namespace:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN http://127.0.0.1:8080/api/core/v2/silenced -G \
--data-urlencode 'fieldSelector=silenced.namespace != "default"'

To list all silenced events for all namespaces:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/events -G \
--data-urlencode 'fieldSelector=event.is_silenced == true'

Filter silences by creator

To list all silences created by the user alice:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/silenced -G \
--data-urlencode 'fieldSelector=silenced.creator == "alice"'

To list all silences that were not created by the admin user:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/silenced -G \
--data-urlencode 'fieldSelector=silenced.creator != "admin"'

Filter silences by silence subscription

To retrieve silences with a specific subscription (in this example, linux):

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/silenced -G \
--data-urlencode 'fieldSelector=silenced.subscription == "linux"'

Another way to make the same request is:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" http://127.0.0.1:8080/api/core/v2/silenced -G \
--data-urlencode 'fieldSelector=linux in silenced.subscription'

Filter silenced resources by expiration

To list all silenced resources that expire only when a matching check resolves:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN http://127.0.0.1:8080/api/core/v2/silenced -G \
--data-urlencode 'fieldSelector=silenced.expire_on_resolve == true'