Skip to content

Commit fd5c752

Browse files
Add findings on unlisted Sentry API endpoints
Co-authored-by: daniel.szoke <daniel.szoke@sentry.io>
1 parent 6bab90f commit fd5c752

1 file changed

Lines changed: 32 additions & 0 deletions

File tree

findings.md

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
Unlisted relative Sentry API endpoints used by sentry-cli
2+
3+
- "/organizations/" (with pagination `?cursor=`)
4+
- Where: `src/api/mod.rs` in `AuthenticatedApi::list_organizations`
5+
- Note: Your list includes "/organizations/" but not explicitly the listing endpoint with pagination. Pagination query params are ignored per instructions; keeping here only to show callsite coverage.
6+
7+
- "/projects/{org}/{project}/releases/{version}/files/{file_id}/?download=1"
8+
- Where: `src/api/mod.rs` in `AuthenticatedApi::get_release_file`
9+
- Status: NOT in provided list (download variant)
10+
11+
- "/organizations/{org}/releases/{version}/files/{file_id}/?download=1"
12+
- Where: `src/api/mod.rs` in `AuthenticatedApi::get_release_file`
13+
- Status: NOT in provided list (download variant)
14+
15+
- "/monitors/{monitor_slug}/checkins/"
16+
- Where: Sent via the Envelopes API (DSN envelope endpoint). Tests mock this relative REST endpoint: `tests/integration/monitors.rs`
17+
- Status: NOT in provided list. Although CLI sends monitor check-ins as envelopes to the DSN endpoint, the relative check-ins endpoint appears in tests.
18+
19+
- "/projects/{org}/{project}/files/proguard-artifact-releases"
20+
- Where: `src/api/mod.rs` in `AuthenticatedApi::associate_proguard_mappings`
21+
- Status: In provided list
22+
23+
- "/projects/{org}/{project}/files/dsyms/"
24+
- Where: `src/api/mod.rs` in `RegionSpecificApi::upload_dif_archive`
25+
- Status: In provided list
26+
27+
- "/projects/{org}/{project}/releases/{release}/files/"
28+
- Where: `src/api/mod.rs` in `RegionSpecificApi::upload_release_file`
29+
- Status: In provided list
30+
31+
No other relative endpoints beyond those already listed were found in `src/` (including releases, deploys, issues, events, artifacts, chunk upload, assemble endpoints, regions, repos, monitors list, projects list). JavaScript wrapper code does not add additional relative API endpoints.
32+

0 commit comments

Comments
 (0)