Sonrai Security · Authentication Profile

Sonrai Security Authentication

Authentication

Sonrai Security secures its APIs with oauth2, openIdConnect, and http across 2 declared security schemes, as derived from its OpenAPI definitions. OAuth 2.0 is offered via the authorizationCode, deviceCode, and clientCredentials flow(s).

CompanySecurityCloud SecurityIdentity and Access ManagementCIEMCloud PermissionsLeast PrivilegeGraphQLIAM

Methods: oauth2, openIdConnect, http Schemes: 2 OAuth flows: authorizationCode, deviceCode, clientCredentials API key in:

Security Schemes

openIdConnect openIdConnect

bearerToken http

scheme: bearer

Source

Authentication Profile

generated: '2026-07-21'
method: searched
source: >-
  Observed Auth0 OIDC authorize/login flow on login.sonraisecurity.com,
  its /.well-known/openid-configuration, and the Sonrai CPF GraphQL API docs
  (docs.sonraisecurity.com/cpf/api/sonrai-graphql-api). Detailed API-token docs
  sit behind login in the gated /cpf developer section.
docs: https://docs.sonraisecurity.com/cpf/api/sonrai-graphql-api
summary:
  types: [oauth2, openIdConnect, http]
  api_key_in: []
  oauth2_flows: [authorizationCode, deviceCode, clientCredentials]
  notes: >-
    Interactive access to the Sonrai platform and its docs authenticates through
    an Auth0-hosted OpenID Connect identity provider. The GraphQL API is called
    with a bearer token over HTTPS. There is no unauthenticated public API
    surface; the GraphQL endpoint requires an authenticated token.
schemes:
  - name: openIdConnect
    type: openIdConnect
    openIdConnectUrl: https://login.sonraisecurity.com/.well-known/openid-configuration
    issuer: https://login.sonraisecurity.com/
    provider: Auth0
    endpoints:
      authorization: https://login.sonraisecurity.com/authorize
      token: https://login.sonraisecurity.com/oauth/token
      userinfo: https://login.sonraisecurity.com/userinfo
      device_authorization: https://login.sonraisecurity.com/oauth/device/code
      revocation: https://login.sonraisecurity.com/oauth/revoke
      jwks: https://login.sonraisecurity.com/.well-known/jwks.json
    scopes_supported:
      - openid
      - profile
      - offline_access
      - email
    code_challenge_methods_supported: [S256, plain]
    evidence: observed 302 to login.sonraisecurity.com/authorize with scope=openid+profile
  - name: bearerToken
    type: http
    scheme: bearer
    applies_to: Sonrai GraphQL API (https://app.sonraisecurity.com/graphql)
    evidence: >-
      CPF developer docs document a GraphQL API; the app.sonraisecurity.com/graphql
      endpoint responds (405 to unauthenticated probe) and the reference is gated
      behind the Auth0 login.

Work with this as data

Every security artifact here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for security posture

4 MCP tools reach this

find_securityBrowse and filter every security artifact in the catalog.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This security artifact

curl "https://apis.io/api/v1/security/sonrai-security-authentication"

All security posture

curl "https://apis.io/api/v1/security?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.