Developers and integrators
Connect Serendyp to your systems
Your ERP, core system, service desk or SIEM can receive new facts as they happen, query alerts and company profiles, and send decisions back to Serendyp without going through the screen. Everything stays scoped to your organization.
Four ways to integrate
Receive
HTTPS webhooks signed with HMAC-SHA256. Serendyp delivers your organization's notices to a URL you own, filtered by level and class.
Query
REST API with JSON responses: alerts, company profiles and external attack-surface findings.
Write
Close or reclassify alerts from your system, upload supplier, site or incident master lists, and submit your own findings. Every change is audited.
Upload files
XLSX, XLS, CSV or TXT with a header row, up to 20,000 rows per upload. Serendyp matches every row and re-evaluates it on each update.
Official SDK
Official API clients for JavaScript/TypeScript and Python, with no external dependencies. They use your organization's key, retry on their own after rate limits and transient errors, and cover queries, alerts and portfolio uploads.
Open the SDK guideJavaScript / TypeScript
npm package for Node 18+, browsers, Deno and Bun.
Python
Package for Python 3.8+, installable with pip.
What it covers
Context for a company or place, profiles, alerts and their status changes, portfolio uploads and submitting your own findings.
What can be connected
The platform is agnostic to the source system. Standard interfaces connect through the API; everything else through a custom connector within the project.
Standard
REST / JSON · HTTPS webhooks · XLSX and CSV.
Custom connector
Databases (read-only replica), SFTP and scheduled exports, messaging (Kafka, MQTT), GIS services (WMS/WFS, GeoJSON), video (RTSP/ONVIF) and IoT.
Systems without an API
Periodic export ingestion as a last resort.
Security
- Per-organization keys with two scopes: read only, or read and write.
- Keys and webhook secrets are shown once; only their hash is stored.
- Every webhook delivery is signed and timestamped to reject replays.
- Each organization's data is segregated: a key never reaches another organization's data.
- No personal data travels through the API or webhooks.
- Every status change is logged with the key that made it, the date and the note.
What your institution needs
Technology is not the barrier. Permissions, network access and your security review set the timeline.
Authorization
A contract or agreement covering data processing under applicable data-protection law.
Access
Your organization's administrator issues the key with the required scope and hands it over through a secure channel.
Network
An HTTPS URL to receive webhooks. For internal systems without internet egress: VPN, IP allowlist or an agent on your servers.
Security review
We answer questionnaires, penetration tests and in-country or on-premise hosting requirements.
Getting started
- 1Request access: we enable an organization account.
- 2Your administrator issues the key and shares the technical guide with your team.
- 3Your team runs a test query and registers the webhook with a test event.
- 4Your supplier, site or incident master list is connected.
The full technical guide
Endpoints, authentication, response formats, signature verification with Node and Python examples, retries and limits. Available to enabled accounts.
Every Serendyp finding is an indicator with a source and a date, not an accusation.