> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.pensar.dev/console/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.pensar.dev/console/_mcp/server.

# Introduction

> Authenticate with a workspace API key and call the Console API

The Console API gives programmatic access to a workspace's pentests, issues, fixes, attack surface, knowledge base and webhook endpoints. Every route is in the API reference in the sidebar.

To have findings pushed to you instead of polling `GET /issues`, register a [webhook endpoint](/console/features/webhooks). For AI assistants, use the [MCP Server](/console/integrations/mcp-server), which signs in with OAuth.

## Base URL

```
https://api.pensar.dev
```

## Authentication

Send a workspace API key in either header:

| Header                            | Example                                  |
| --------------------------------- | ---------------------------------------- |
| `Authorization: Bearer <api_key>` | `Authorization: Bearer sk-id__abc123...` |
| `x-api-key: <api_key>`            | `x-api-key: sk-id__abc123...`            |

The key belongs to one workspace, so requests never name a workspace.

### Create an API key

1. In the Console, go to **Settings** → **API keys**.
2. Click **Create API key**, name it, and choose its scopes.
3. Copy the key. It is shown only once; a lost key has to be revoked and created again.

### Scopes

Each route in the reference names the scope it requires, such as `issues:read`. A key without that scope receives `403`.

Posting comments and changing the knowledge base also require a signed-in user credential. A workspace API key has no author to attribute the change to, so it receives `403` on those routes whatever its scopes.

## Issue references

Routes with an `{issueId}` accept either the issue's UUID or its label, such as `VULN-000123`. A value that is neither returns `400`; a well-formed reference to no issue in the workspace returns `404`.

## Errors

Every non-2xx response has a JSON body with an `error` message:

```json
{
  "error": "Issue not found or not in this workspace"
}
```

| Status | Meaning                                                                |
| ------ | ---------------------------------------------------------------------- |
| 400    | The request is invalid; `error` names the field                        |
| 401    | The API key is missing or invalid                                      |
| 403    | The key lacks the route's scope, or the action needs a user credential |
| 404    | The resource does not exist in this workspace                          |
| 409    | The request conflicts with the resource's current state                |
| 500    | Internal server error                                                  |