Trappr
API Reference

Trappr API

REST API for all Trappr resources. Base URL: https://trappr.net

Version 1 · All endpoints under /api/v1/

Authentication

All API requests require a Bearer token in the Authorization header. Three token types are supported:

  • Org API key — full access to your organization. Found in Dashboard → Settings → API Keys.
  • Agent key (cht_ak_*) — scoped to one agent. Used by your agent process to call the gateway.
  • Gateway access key (cht_gw_*) — pinned to one provider with an optional model allow-list. Create in Dashboard → AI Gateway → Access Keys.
Authorization: Bearer <YOUR_API_KEY>

Canary tokens

POST/api/v1/tokensCreate token
appId stringrequired— App ID to associate the token with.
label stringrequired— Human-readable label for this token.
type enum— Token type. One of GENERIC, CREDIT_CARD, SSN, EMAIL, PHONE. Default: GENERIC.
Returns the created token including tokenString — paste this into your agent context.
GET/api/v1/tokens?appId=xxxList tokens
Returns all tokens for the given app.
DELETE/api/v1/tokens?id=xxxDelete token
Permanently deletes the token.

AI Gateway

POST/api/v1/gateway/chatChat completion

OpenAI-compatible chat completion endpoint. Routes to the configured provider, applies DLP masking, logs the call, and checks for canary triggers.

model stringrequired— Model name (e.g. gpt-4o) or "default" to use the provider's default model.
messages Message[]required— Array of { role, content } objects.
appId string— Required when using an org API key. Not needed for agent or gateway access keys.
providerId string— Pin to a specific provider. Optional — defaults to the app's first active provider.
stream boolean— Set true to receive an SSE stream. Trappr buffers the full response internally and re-emits as SSE.
GET/api/v1/gateway/logs?appId=xxxGateway logs
Returns paginated gateway call logs for an app. Supports limit, offset, providerId, and model filters.
POST/api/v1/gateway/keysCreate access key
appId stringrequired— App to scope the key to.
name stringrequired— Display name for this key.
providerId stringrequired— Provider this key is pinned to.
allowedModels string[]— Optional model allow-list. Empty array = all models allowed.
Returns the raw key (cht_gw_*) once — it is never retrievable again.
GET/api/v1/gateway/keys?appId=xxxList access keys
Returns all access keys for an app (never the raw key — only preview and metadata).
DELETE/api/v1/gateway/keys?id=xxx&appId=xxxRevoke access key
Immediately deactivates the key. Any in-flight requests using it will receive 401.

Providers

POST/api/v1/providersAdd provider
appId stringrequired— App to associate the provider with.
name stringrequired— Friendly name (e.g. "OpenAI prod").
provider enumrequired— One of OPENAI, ANTHROPIC, GOOGLE, MISTRAL, DEEPSEEK, CUSTOM.
apiKey stringrequired— Provider API key — encrypted at rest. Never returned.
baseUrl string— Custom base URL (required for CUSTOM providers).
defaultModel string— Default model to use when "default" is passed to the gateway.
GET/api/v1/providers?appId=xxxList providers
Returns all providers for an app with masked key previews.
GET/api/v1/providers/:id/modelsList available models
Fetches live model list from the provider's API using the stored key. Falls back to a static list if the provider API is unreachable.

Agents

POST/api/v1/agentsRegister agent
appId stringrequired— App to register the agent under.
agentName stringrequired— Display name.
platform enum— One of N8N, MAKE, LANGCHAIN, ZAPIER, DIFY, FLOWISE, CUSTOM.
description string— What this agent does.
Returns agentId and agentApiKey (cht_ak_*). The API key is shown once.
GET/api/v1/agents?appId=xxxList agents
Returns all agents for an app with status, tamper events, and last-seen timestamps.
GET/api/v1/agents/:idGet agent
Returns a single agent with full detail including canary token and fingerprint.
POST/api/v1/agents/:id/verifyVerify agent fingerprint
Re-computes and checks the agent fingerprint. Returns tamper status.

DLP

GET/api/v1/dlp?appId=xxxGet DLP config
Returns the DLP configuration for an app — enabled state, masking style, regex toggles, and dictionary terms.
PUT/api/v1/dlpUpdate DLP config
appId stringrequired— App to configure DLP for.
enabled boolean— Enable or disable DLP.
maskingStyle enum— CODE (e.g. [MASKED_EMAIL]), GENERIC (**REDACTED**), or RANDOM (random string).
regexEmails boolean— Mask email addresses.
regexIps boolean— Mask IP addresses.
regexSsns boolean— Mask SSNs.
regexCreditCards boolean— Mask credit card numbers.
regexPhones boolean— Mask phone numbers.

Incidents

GET/api/v1/incidents?appId=xxxList incidents
Returns all canary token trigger incidents for an app, ordered by severity and time.

Rate limits: 1000 requests per minute per org on API endpoints. The gateway chat endpoint has a separate limit of 500 req/min. Contact us for higher limits.