Introduction

The Console API gives programmatic access to a workspace’s pentests, issues, fixes, attack surface, knowledge base and webhook endpoints. Every route is in the API reference in the sidebar.

To have findings pushed to you instead of polling GET /issues, register a webhook endpoint. For AI assistants, use the MCP Server, which signs in with OAuth.

Base URL

https://api.pensar.dev

Authentication

Send a workspace API key in either header:

The key belongs to one workspace, so requests never name a workspace.

Create an API key

1. In the Console, go to Settings → API keys.
2. Click Create API key, name it, and choose its scopes.
3. Copy the key. It is shown only once; a lost key has to be revoked and created again.

Scopes

Each route in the reference names the scope it requires, such as issues:read. A key without that scope receives 403.

Posting comments and changing the knowledge base also require a signed-in user credential. A workspace API key has no author to attribute the change to, so it receives 403 on those routes whatever its scopes.

Issue references

Routes with an {issueId} accept either the issue’s UUID or its label, such as VULN-000123. A value that is neither returns 400; a well-formed reference to no issue in the workspace returns 404.

Errors

Every non-2xx response has a JSON body with an error message:

{
  "error": "Issue not found or not in this workspace"
}