Developers · API
API documentation
Cytra does not offer a general-purpose public programmatic API today — no API keys, no token endpoint, and no published SDKs. The supported external surface is an authenticated attestation export for onboarded tenants. Broader programmatic access is on the roadmap, access to Cytra itself is sales-led, and the managed MCP gateway is in private beta; if you need integration now, talk to us and we'll scope it during onboarding.
Broader public API on the roadmap — not yet availableWhat exists today
Limited authenticated surfaces, one export API
Attestation export
Onboarded tenants can use their dashboard session to call GET /api/attestations and retrieve signed compliance-as-it-runs collector records for independent verification.
Dashboard session auth
The dashboard and its /api/* routes authenticate with BetterAuth session cookies; accounts are provisioned by invitation. These routes serve the dashboard and are not a supported public API — shapes may change without notice.
Internal agent protocol
Cytra-built collectors and on-prem agents authenticate with a per-agent HMAC scheme (signed, timestamped, replay-protected requests), provisioned during early-access onboarding. Not a general-purpose public API.
The attestation export is the supported external read surface for onboarded tenants. Dashboard routes and agent-control routes remain implementation surfaces unless otherwise documented.
Roadmap
What the planned public API will cover
Governance & policy
Manage policies, control mappings, and approval gates that the gateway enforces at runtime.
Managed MCP gateway
Broker scoped credentials and route governed AI/agent actions through the per-tenant policy engine.
Evidence & audit
Export the per-tenant, hash-chained, tamper-evident record of every governed action and denial.
Bias & fairness
Read fairness metrics and drift signals from scheduled measurement on configured eval datasets.
When the public API ships, this page will be replaced with the real reference — endpoints, authentication, rate limits, and language samples — generated from the served OpenAPI description.