SENTINEL – Autonomous API Threat Discovery & Exploitation Prevention Agent

Inspiration

We were inspired by a major challenge in API security: even authenticated users can sometimes access data they are not authorized to see. Issues such as unauthorized record access, API enumeration, excessive requests, and undocumented endpoints can expose sensitive information.

Traditional security rules may not always understand the context behind requests. We wanted to design a smarter security system that could discover API endpoints, understand request behaviour, identify suspicious activities, and respond with appropriate risk-based controls.

What We Built

SENTINEL is designed as an autonomous API security gateway that provides dynamic API discovery, context-aware threat detection, and automated prevention.

Instead of depending on hardcoded endpoint rules, it uses OpenAPI/Swagger specifications to understand API structures. Incoming requests pass through an interception pipeline where token validation, risk evaluation, and security policies help identify potentially harmful activity.

The system also includes a monitoring dashboard for endpoint visibility, security alerts, request analytics, and audit information.

How We Built It

We designed SENTINEL using a modular architecture:

• React 18 + Vite: Interactive security dashboard and user interface.
• Python + FastAPI: Asynchronous API gateway and core security engine.
• Pydantic: Request validation and structured data handling.
• Redis: Sliding-window request tracking, rate limiting, and temporary blocking.
• PostgreSQL: Audit logs, endpoint inventory, and security policies.
• OpenAPI/Swagger: Dynamic API schema discovery.
• Ollama / LLM: Asynchronous threat explanations and incident summaries.
• Docker Compose: Containerized deployment.

A key architectural decision was to keep LLM-based reasoning outside the real-time request evaluation path. This allows security checks to operate independently without waiting for AI-generated explanations.

What We Learned

Through designing SENTINEL, we explored API security, reverse proxies, asynchronous request processing, dynamic API discovery, risk-based access control, and real-time monitoring.

We also learned how different components such as Redis, FastAPI, PostgreSQL, and LLMs can work together in a security-focused system.

Challenges We Faced

Some of the major challenges in designing SENTINEL were:

• Discovering undocumented or newly added API endpoints.
• Identifying suspicious behaviour hidden behind valid authentication.
• Evaluating request patterns without introducing unnecessary latency.
• Managing temporary blocks and request limits efficiently.
• Integrating AI-based explanations without making the request pipeline dependent on an LLM.
• Designing a reusable gateway that can adapt to different API environments.

Our Vision

Our vision is to make API security more intelligent, adaptive, and accessible. SENTINEL aims to move beyond static security rules towards autonomous threat discovery, explainable risk evaluation, and proactive prevention.

Built With

• compose
• css
• docker
• fastapi
• httpx
• llm
• ollama
• openapi
• postgresql
• pydantic
• python
• react.js
• redis
• rest
• swagger
• tailwind
• vanilla
• vite
• websockets