Build on SenseOn
Use SenseOn Connect to bring security cases and observations into the systems your team already runs. Read device and telemetry data, update cases, and work with AI-generated case summaries through an authenticated API.
Programmatic access to security operations data
SenseOn Connect is a bidirectional REST API covering cases, devices, observations, raw telemetry, and appliance settings. Authenticate with a Personal Access Token and work with the results in your own tooling. You can add notes, change case state, flag and assign cases, and retrieve or generate AI case summaries. Writing security observations requires prior approval from SenseOn.
What you need to integrate
The published contract for authentication, access, rate limits, and errors.
Base URL
https://<your-tenant>.senseon.io/api. Endpoints sit under /v1, for example GET /v1/settings.
Authentication
Use a Bearer Personal Access Token. Create one under Settings → Integrations → API Configuration. The token value is shown once.
Scopes
Grant only what the integration needs: cases_read, cases_write, cases_resolve_write, devices_read, observations_read, observations_write, telemetry_read, settings_read, and settings_write.
Rate limits
Each endpoint sits in one of three tiers: roughly 10, 60, or 600 requests per minute. Exceeding a tier returns 429 Too Many Requests.
Errors
Responses carry a machine-readable code, such as VALIDATION_ERROR or INVALID_CASE_ID. Some actions return 428 when step-up authentication is required.
Try it live
The in-platform reference lets you run requests against your own tenant and copy the cURL, using your token as the password.
Low-code with Zapier
Use the documented Zapier triggers and actions to connect case, observation, device, and Hunt Lab workflows. Authenticate with your platform code name and a Personal Access Token.
Write controls
Creating observations needs prior SenseOn approval. We review managed-service impact, correlation behaviour, and expected volume first.
Selected endpoints from the published reference
A representative selection from SenseOn Connect. Use the authenticated in-platform reference for the contract available on your tenant.
POST /v1/cases
List cases with a query body. Results include AI summaries that have already been generated.
GET /v1/cases/{case_id}
Retrieve full case detail, including a summary where one has already been generated.
PATCH /v1/cases/{case_id}/state
Update the state of a security case.
POST /v1/cases/{case_id}/summary
Generate or regenerate an AI case summary.
GET /v1/devices
Read registered device information. Use GET /v1/devices/{device_id} for one device.
POST /v1/observations/list
List security observations. Use GET /v1/observations/{observation_id} for one observation.
POST /v1/telemetry/query
Queue a raw telemetry query, then retrieve its result from GET /v1/telemetry/result/{query_id}. Queued queries return 202 Accepted.
GET and PUT /v1/settings
Read and update appliance settings by exact name or trailing wildcard. Updates are applied on an all-or-nothing basis.
Workflows covered by SenseOn Connect
Use the API where its published contract fits your workflow. Talk to SenseOn before relying on a capability outside that contract.
Case management
Read cases, add or change notes, update case state, flag cases, and manage assignments.
AI case summaries
Retrieve summaries that already exist, or request a new or regenerated summary for a case.
Device context
Read the device information available to your tenant.
Security observations
Read observations through the API. Creating observations is available only after SenseOn approval.
Raw telemetry
Run Hunt Lab queries, inspect the query queue, and retrieve query results.
Appliance settings
Read or update settings by name, with all-or-nothing writes.
Documented integrations
Use the Zapier integration for low-code workflows. SenseOn also documents Slack notifications through an incoming webhook.
Ready to integrate?
Start with the SenseOn Connect API reference. Talk to us if you need approved write access, or a capability the current API does not cover.