EntityShield API surface
The production API base ishttps://api.entityshield.app. The API exposes 148 route mounts across 147 route files, grouped into public, admin, workspace, staff, and governance route families.
Public endpoints
These endpoints are mounted before the authentication middleware:
Inbound webhook receivers (for example, Stripe billing events) are also handled before the authentication middleware.
Try the health check with curl:
Authentication
Most application routes begin with/v1. The API applies Auth0 JWT verification to /v1/* after the public routes. Four token audiences are distinguished:
There is no general-purpose public API key issuance flow. Access is enforced by audience, tenant or workspace membership, and route-specific permissions.
Core admin route families
Workspace namespace
Workspace routes are scoped through workspace identity and membership. They are prefixed with/v1/workspace/portal/ and cover modules for operations, team, inbox, reputation, marketing, inventory, helpdesk, social, support, reports, settings, and AI:
Staff namespace
Staff routes are prefixed with/v1/staff/ and require staff-audience tokens. They support Pcnaid staff cross-tenant operations such as customer management, user management, and support.
Governance namespace
Governance routes are prefixed with/v1/governance/ and scoped by governance identity and entity membership. They include governance portal data, meetings, and video support.
Outbound webhooks
The webhook endpoints are managed at/v1/webhook-endpoints. Users with admin:webhooks can list events, create destinations, inspect deliveries, test, and replay:
Destination URLs are checked against the server’s SSRF guard. Delivery payloads are HMAC-SHA256 signed.
An OpenAPI document, stable public error-code catalog, public rate-limit contract, and third-party API key onboarding flow are not yet published.