Loading…
Docs
Q by Wentzel's customer-facing HTTP API as implemented in this private beta. There is no OpenAPI/Swagger spec and no published SDK. Paths below exist as App Router handlers under /api. This is not a GA marketplace.
Origin: https://q.wentzel.ai. JSON bodies use Content-Type: application/json.
Authenticated routes require a Better Auth session cookie (same session as the dashboard). A missing session returns HTTP 401 { "error": "Unauthorized" }. Q is in private beta: public self-serve sign-up is disabled. Request access from Contact.
Organization API keys can be created in dashboard Settings (QW-37, prefix q_, scopes scans:read, scans:write, pqc:read, *). They are not accepted as Authorization: Bearer on the routes in this catalog. Handlers call session lookup only.
Tenant data is scoped to the session's active organization (falling back to the user id). A missing row and a row owned by another organization both return 404.
| Method | Path | Auth | Rate limit | Summary |
|---|---|---|---|---|
| GET | /api/health | None (public) | No dedicated limiter in qRateLimitPolicies | Liveness envelope for uptime probes. Always HTTP 200. |
| POST | /api/contact | None (public) | 3 requests / 60s / IP | Public lead-capture form. Persists the submission and emails ops. |
| GET | /api/pqc/algorithms | None (public) | 60 requests / 60s / IP | Read-only cryptographic algorithm catalog with optional filters. |
| POST | /api/pqc/hndl-score | Better Auth session cookie | 30 requests / 60s / IP | Harvest Now, Decrypt Later score from seven 0–100 factor inputs. |
| POST | /api/pqc/mosca | Better Auth session cookie | 30 requests / 60s / IP | Mosca inequality: whether PQC migration should already have started. |
| POST | /api/pqc/qstrike | Better Auth session cookie + Enterprise plan | 30 requests / 60s / IP | QStrike Board Number. Enterprise plan required; otherwise 403. |
| GET | /api/pqc/cbom/[id] | Better Auth session cookie | No dedicated limiter in qRateLimitPolicies | CBOM for a PQC assessment. Optional CycloneDX JSON/XML export. |
| GET | /api/pqc/reports/[id] | Better Auth session cookie | No dedicated limiter in qRateLimitPolicies | PQC readiness report PDF for an assessment in the active org. |
| GET | /api/scans | Better Auth session cookie | 20 requests / 60s / IP | List org-scoped scans with optional status/priority pagination. |
| POST | /api/scans | Better Auth session cookie | 20 requests / 60s / IP | Create a scan. Monthly quota is enforced (402 when exceeded). |
| GET | /api/scans/[id] | Better Auth session cookie | 20 requests / 60s / IP | Scan detail with targets, results, and findings. Cross-org is 404. |
| POST | /api/scans/[id]/cancel | Better Auth session cookie | 20 requests / 60s / IP | Cancel a pending, queued, running, or paused scan. |
| GET | /api/scans/[id]/stream | Better Auth session cookie | 20 requests / 60s / IP | Server-Sent Events for scan progress. Org-scoped. |
| GET | /api/rules | Better Auth session cookie | 30 requests / 60s / IP | List DSL scanning rules for the active organization. |
| POST | /api/rules | Better Auth session cookie | 30 requests / 60s / IP | Create a DSL scanning rule (YAML body, org-scoped). |
| GET | /api/rules/[id] | Better Auth session cookie | 30 requests / 60s / IP | Read one DSL rule. Missing or other-org rows 404. |
| PUT | /api/rules/[id] | Better Auth session cookie | 30 requests / 60s / IP | Update a non-system DSL rule. System rules 403. |
| DELETE | /api/rules/[id] | Better Auth session cookie | 30 requests / 60s / IP | Delete a non-system DSL rule. System rules 403. |
Rate-limit numbers come from qRateLimitPolicies. Routes without a policy are listed as having no dedicated limiter — not as unlimited GA capacity. QStrike additionally requires the Enterprise plan (HTTP 403 otherwise).