API overview

API version: v2

The Sensu backend REST API provides access to Sensu workflow configurations and monitoring event data. For information about the Sensu agent API, see the agent reference.

URL format

Sensu API endpoints use the standard URL format /api/{group}/{version}/namespaces/{namespace} where:

  • {group} is the API group: core.
  • {version} is the API version: v2.
  • {namespace} is the namespace name. The examples in these API docs use the default namespace. The Sensu API requires the authenticated user to have the correct access permissions for the namespace specified in the URL. If the authenticated user has the correct cluster-wide permissions, you can leave out the /namespaces/{namespace} portion of the URL to access Sensu resources across namespaces. See the RBAC reference for more information about configuring Sensu users and access controls.

NOTE: The authentication API, authentication providers API, and health API do not follow this standard URL format.

Data format

The Sensu API uses JSON-formatted requests and responses. In terms of sensuctl output types, the Sensu API uses the json format, not wrapped-json.


The Sensu Go API is versioned according to the format v{majorVersion}{stabilityLevel}{iterationNumber}, in which v2 is stable version 2. The Sensu API guarantees backward compatibility for stable versions of the API.

Sensu does not guarantee that an alpha or beta API will be maintained for any period of time. Consider alpha versions under active development — they may not be published for every release. Beta APIs are more stable than alpha versions, but they offer similarly short-lived lifespans and also are not guaranteed to convert programmatically when the API is updated.

Request size limit

API request bodies are limited to 0.512 MB in size.

Access control

With the exception of the health API and metrics API, the Sensu API requires authentication using a JSON Web Token (JWT) access token. Use the authentication API and your Sensu username and password to generate access tokens and refresh tokens. The Sensu API docs use $SENSU_ACCESS_TOKEN to represent a valid access token in API requests.

Authentication quickstart

To set up a local API testing environment, save your Sensu credentials and token as environment variables:

# Requires curl and jq

export SENSU_ACCESS_TOKEN=`curl -X GET -u "$SENSU_USER:$SENSU_PASS" -s http://localhost:8080/auth | jq -r ".access_token"`

Basic authentication using the authentication API

The /auth API endpoint lets you generate short-lived API tokens using your Sensu username and password.

  1. Retrieve an access token for your user. For example, to generate an access token using example admin credentials:

    curl -u 'YOUR_USERNAME:YOUR_PASSWORD' http://localhost:8080/auth
    The access token should be included in the output, along with a refresh token:
      "access_token": "eyJhbGciOiJIUzI1NiIs...",
      "expires_at": 1544582187,
      "refresh_token": "eyJhbGciOiJIUzI1NiIs..."

  2. Use the access token in the authentication header of the API request. For example:

    curl -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \

  3. Refresh your access token every 15 minutes. Access tokens last for approximately 15 minutes. When your token expires, you should see a 401 Unauthorized response from the API. To generate a new access token, use the /auth/token API endpoint, including the expired access token in the authorization header and the refresh token in the request body:

    curl -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \
    -H 'Content-Type: application/json' \
    -d '{"refresh_token": "eyJhbGciOiJIUzI1NiIs..."}' \
    The new access token should be included in the output:
      "access_token": "eyJhbGciOiJIUzI1NiIs...",
      "expires_at": 1561055277,
      "refresh_token": "eyJhbGciOiJIUzI1NiIs..."

Generate an API token using sensuctl

You can also generate an API access token using the sensuctl command line tool. The user credentials that you use to log in to sensuctl determine your permissions to get, list, create, update, and delete resources with the Sensu API.

  1. Install and log in to sensuctl.

  2. Retrieve an access token for your user:

    cat ~/.config/sensu/sensuctl/cluster|grep access_token
    The access token should be included in the output:
    "access_token": "eyJhbGciOiJIUzI1NiIs...",

  3. Copy the access token into the authentication header of the API request. For example:

    curl -H "Authorization: Bearer eyJhbGciOiJIUzI1NiIs..." \

  4. Refresh your access token every 15 minutes. Access tokens last for approximately 15 minutes. When your token expires, you should see a 401 Unauthorized response from the API. To regenerate a valid access token, run any sensuctl command (like sensuctl event list) and repeat step 2.

Authenticate with an API key

Each Sensu API key (core/v2.APIKey) is a persistent UUID that maps to a stored Sensu username. The advantages of authenticating with API keys rather than access tokens include:

  • More efficient integration: Check and handler plugins and other code can integrate with the Sensu API without implementing the logic required to authenticate via the /auth API endpoint to periodically refresh the access token
  • Improved security: API keys do not require providing a username and password in check or handler definitions
  • Better admin control: API keys can be created and revoked without changing the underlying user’s password, but keep in mind that API keys will continue to work even if the user’s password changes

API keys are cluster-wide resources, so only cluster admins can grant, view, and revoke them.

NOTE: API keys are not supported for authentication providers such as LDAP and OIDC.

API key authentication

Similar to the Bearer [token] Authorization header, Key [api-key] will be accepted as an Authorization header for authentication.

For example, a JWT Bearer [token] Authorization header might be:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN"

If you’re using Key [api-key] to authenticate instead, the Authorization header might be:

curl -H "Authorization: Key $SENSU_API_KEY"


$ curl -H "Authorization: Key 7f63b5bc-41f4-4b3e-b59b-5431afd7e6a2"

HTTP/1.1 200 OK
    "command": "check-cpu.sh -w 75 -c 90",
    "handlers": [
    "interval": 60,
    "publish": true,
    "subscriptions": [
    "metadata": {
      "name": "check-cpu",
      "namespace": "default"


The Sensu API supports response pagination for most core/v2 GET endpoints that return an array. You can request a paginated response with the limit and continue query parameters.

Limit query parameter

The following request limits the response to a maximum of two objects:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN"

The response includes the available objects up to the specified limit.

Continue query parameter

If more objects are available beyond the limit you specified in a request, the response header includes a Sensu-Continue token you can use to request the next page of objects.

For example, the following response indicates that more than two users are available because it provides a Sensu-Continue token in the response header:

HTTP/1.1 200 OK
Content-Type: application/json
Sensu-Continue: L2RlZmF1bU2Vuc3UtTWFjQ
Sensu-Entity-Count: 3
Sensu-Entity-Limit: 100
Date: Fri, 14 Feb 2020 15:44:25 GMT
Content-Length: 132
    "username": "alice",
    "groups": [
    "disabled": false
    "username": "bob",
    "groups": [
    "disabled": false

To request the next two available users, use the Sensu-Continue token included in the response header:

curl \
-H "Authorization: Bearer $SENSU_ACCESS_TOKEN"

If the response header does not include a Sensu-Continue token, there are no further objects to return. For example, this response header indicates that no further users are available:

HTTP/1.1 200 OK
Content-Type: application/json
Sensu-Entity-Count: 3
Sensu-Entity-Limit: 100
Date: Fri, 14 Feb 2020 15:46:02 GMT
Content-Length: 54
    "username": "alice",
    "groups": [
    "disabled": false

Response filtering

COMMERCIAL FEATURE: Access API response filtering in the packaged Sensu Go distribution. For more information, see Get started with commercial features.

The Sensu API supports response filtering for all GET endpoints that return an array. You can filter resources based on their labels with the labelSelector query parameter and based on certain pre-determined fields with the fieldSelector query parameter.

NOTE: To use label and field selectors in the Sensu dashboard, see dashboard filtering.

Label selector

The labelSelector query parameter allows you to group resources by the label attributes specified in the resource metadata object. All resources support labels within the metadata object.

Field selector

The fieldSelector query parameter allows you to organize and select subsets of resources based on certain fields. Here’s the list of available fields:

Resource Fields
Asset asset.name asset.namespace asset.filters
Check check.name check.namespace check.handlers check.publish check.round_robin check.runtime_assets check.subscriptions
ClusterRole clusterrole.name
ClusterRoleBinding clusterrolebinding.name clusterrolebinding.role_ref.name clusterrolebinding.role_ref.type
Entity entity.name entity.namespace entity.deregister entity.entity_class entity.subscriptions
Event event.name event.namespace event.check.handlers event.check.name event.check.publish event.check.round_robin event.check.runtime_assets event.check.status event.check.subscriptions event.entity.deregister event.entity.entity_class event.entity.name event.entity.subscriptions
Extension extension.name extension.namespace
Filter filter.name filter.namespace filter.action filter.runtime_assets
Handler handler.name handler.namespace handler.filters handler.handlers handler.mutator handler.type
Hook hook.name hook.namespace
Mutator mutator.name mutator.namespace mutator.runtime_assets
Namespace namespace.name
Role role.name role.namespace
RoleBinding rolebinding.name rolebinding.namespace rolebinding.role_ref.name rolebinding.role_ref.type
Secrets secret.name secret.namespace secret.provider secret.id
SecretsProviders provider.name provider.namespace
Silenced silenced.name silenced.namespace silenced.check silenced.creator silenced.expire_on_resolve silenced.subscription
User user.username user.disabled user.groups


Sensu’s API response filtering supports two equality-based operators, two set-based operators, and one logical operator.

operator description example
== Equality check.publish == true
!= Inequality check.namespace != "default"
in Included in linux in check.subscriptions
notin Not included in slack notin check.handlers
&& Logical AND check.publish == true && slack in check.handlers

Equality-based operators

Sensu’s two equality-based operators are == (equality) and != (inequality).

For example, to retrieve only checks with the label type and value server:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -G \
--data-urlencode 'labelSelector=type == "server"'

NOTE: Use the flag --data-urlencode in cURL to encode the query parameter. Include the -G flag so the request appends the query parameter data to the URL.

To retrieve checks that are not in the production namespace:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -G \
--data-urlencode 'fieldSelector=check.namespace != "production"'

Set-based operators

Sensu’s two set-based operators for lists of values are in and notin.

For example, to retrieve checks with a linux subscription:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -G \
--data-urlencode 'fieldSelector=linux in check.subscriptions'

To retrieve checks that do not use the slack handler:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -G \
--data-urlencode 'fieldSelector=slack notin check.handlers'

The in and notin operators have two important conditions:

  • First, they only work when the underlying value you’re filtering for is a string. You can filter for strings and arrays of strings with in and notin operators, but you cannot use them to filter for integer, float, array, or Boolean values.
  • Second, to filter for a string, the string must be to the left of the operator: string [in|notin] selector. To filter for an array of strings, the array must be to the right of the operator: selector [in|notin] [string1,string2].

Logical operator

Sensu’s logical operator is && (AND). Use it to combine multiple statements separated with the logical operator in field and label selectors.

For example, the following cURL request retrieves checks that are not configured to be published and include the linux subscription:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -G \
--data-urlencode 'fieldSelector=check.publish != true && linux in check.subscriptions'

To retrieve checks that are not published, include a linux subscription, and are in the dev namespace:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -G \
--data-urlencode 'fieldSelector=check.publish != true && linux in check.subscriptions && dev in check.namespace'

NOTE: Sensu does not have the OR logical operator.

Combined selectors

You can use field and label selectors in a single request. For example, to retrieve only checks that include a linux subscription and do not include a label for type server:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -G \
--data-urlencode 'fieldSelector=linux in check.subscriptions' \
--data-urlencode 'labelSelector=type != "server"'


Values with special characters

To use a label or field selector with string values that include special characters like hyphens and underscores, place the value in single or double quotes:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -X GET -G \
--data-urlencode 'labelSelector=region == "us-west-1"'
curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -G \
--data-urlencode 'fieldSelector="entity:i-0c1f8a116b84ea50c" in entity.subscriptions'

Use selectors with arrays of strings

To retrieve checks that are in either the dev or production namespace:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -G \
--data-urlencode 'fieldSelector=check.namespace in [dev,production]'

Filter events by entity or check

To retrieve events for a specific check (checkhttp):

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -G \
--data-urlencode 'fieldSelector=checkhttp in event.check.name'

Similary, to retrieve only events for the server entity:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -G \
--data-urlencode 'fieldSelector=server in event.entity.name'

Filter events by severity

Use the event.check.status field selector to retrieve events by severity. For example, to retrieve all events at 2 (CRITICAL) status:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -G \
--data-urlencode 'fieldSelector=event.check.status == "2"'

Filter all incidents

To retrieve all incidents (all events whose status is not 0):

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -G \
--data-urlencode 'fieldSelector=event.entity.status != "0"'

Filter checks, entities, or events by subscription

To list all checks that include the linux subscription:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -G \
--data-urlencode 'fieldSelector=linux in check.subscriptions'

Similarly, to list all entities that include the linux subscription:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -G \
--data-urlencode 'fieldSelector=linux in entity.subscriptions'

To list all events for the linux subscription, use the event.entity.subscriptions field selector:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -G \
--data-urlencode 'fieldSelector=linux in event.entity.subscriptions'

Filter silenced resources and silences

Filter silenced resources by namespace

To list all silenced resources for a particular namespace (in this example, the default namespace):

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN -G \
--data-urlencode 'fieldSelector=silenced.namespace == "default"'

Likewise, to list all silenced resources except those in the default namespace:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN -G \
--data-urlencode 'fieldSelector=silenced.namespace != "default"'

Filter silences by creator

To list all silences created by the user alice:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -G \
--data-urlencode 'fieldSelector=silenced.creator == "alice"'

To list all silences that were not created by the admin user:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -G \
--data-urlencode 'fieldSelector=silenced.creator != "admin"'

Filter silences by silence subscription

To retrieve silences with a specific subscription (in this example, linux):

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -G \
--data-urlencode 'fieldSelector=silenced.subscription == "linux"'

Another way to make the same request is:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN" -G \
--data-urlencode 'fieldSelector=linux in silenced.subscription'

NOTE: For this field selector, subscription means the subscription specified for the silence. In other words, this filter retrieves silences with a particular subscription, not silenced entities or checks with a matching subscription.

Filter silenced resources by expiration

To list all silenced resources that expire only when a matching check resolves:

curl -H "Authorization: Bearer $SENSU_ACCESS_TOKEN -G \
--data-urlencode 'fieldSelector=silenced.expire_on_resolve == true'