Security primitives API

The security primitives API for teams that get audited

Generate cryptographically secure credentials, validate strength against compliance policies, and check breach exposure in one API integration. Every call produces machine-readable audit documentation your compliance team can hand directly to any auditor.

Get Your Free API Key Read the API Reference

NIST 800-63B SOC2 Aligned Breach Detection Audit Log Included
Try it now
curl -X POST https://api.sixsensesolutions.net/v1/generate \
  -H "Authorization: Bearer your_api_key" \
  -H "Content-Type: application/json" \
  -d '{"length":20,"quantity":1,"compliance":"NIST","options":{"uppercase":true,"lowercase":true,"numbers":true,"symbols":true,"exclude_ambiguous":true}}'
# Returns passwords with entropy_bits and compliance_profile documented

The compliance gap most teams discover too late

MSPs, fintech teams, healthcare IT, and DevSecOps each feel this problem differently. The cost is the same: a failed audit, a breach, or both.

For managed service providers

One weak generation routine creates liability across every client

MSPs provisioning credentials for 10 to 200 client accounts cannot afford inconsistent security practices. One predictable token across one client environment creates exposure for all of them. The Six Sense API gives every client the same cryptographic standard with documented proof per call.

For fintech dev teams

SOC2 audits require proof of generation practices you probably do not have

Issuing API keys, tokens, and temporary codes at scale requires documented evidence that generation methods meet compliance standards. Cobbling together multiple libraries creates inconsistency that auditors flag. One API call replaces the entire stack with a single auditable integration.

For healthcare IT

HIPAA requires documented security controls that most generation processes lack

Temporary access codes for patient portals require documented security controls. Manual or undocumented generation processes create compliance gaps that surface during audits. Every Six Sense API call produces a timestamped, machine-readable record that satisfies HIPAA documentation requirements.

For DevSecOps teams

Stop manually policing insecure code in PR reviews

Math.random() ships because it is easy and invisible until an audit. The Six Sense API enforces NIST cryptographic standards at the API level so your team stops shipping credential debt and you stop catching it manually in code review.

Four endpoints. One integration. Complete audit coverage.

Replace your entire credential security stack with a single API key.

Live POST /v1/generate

Generate

Cryptographically secure credentials with NIST 800-63B compliance documentation in every response. Entropy bits, compliance profile, and generation timestamp returned automatically.

Live POST /v1/validate

Validate

Score credential strength and entropy against configurable compliance policies. Returns pass/fail with detailed analysis your auditors can verify. Supports NIST, SOC2, and custom policies.

Live POST /v1/breach-check

Breach Check

Check credentials against 850 million known breached passwords using k-anonymity. The plaintext value never leaves your environment. Returns exposure count and risk rating.

Live GET /v1/audit-log

Audit Log

Retrieve a tamper-evident log of all generation and validation events. Query by date range up to 90 days. Pro tier and above. The output compliance teams hand directly to auditors for SOC2, HIPAA, and government reviews.

The cost of inaction is not theoretical

This is what the credential security gap looks like in a real audit finding.

WITHOUT SIX SENSE
AUDIT FINDING - CRITICAL
Control: SC-28 / NIST 800-53
Finding: Credential generation function
math.random() identified in 47 files
across 12 microservices.
Impact: Generated secrets fail entropy
requirements for NIST 800-63B compliance.
Cryptographic randomness cannot be verified.
Evidence Required:
☐ Entropy calculation per credential
☐ Generation method documentation
☐ Compliance profile attestation
☐ Remediation timeline
Status: OPEN - 90 day remediation required
Estimated remediation cost: $180,000
WITH SIX SENSE
{
  "passwords": ["••••••••••••••••••••"],
  "meta": {
    "length": 20,
    "entropy_bits": 120.4,
    "generated_at": "2026-04-10T14:57:35Z",
    "compliance_profile": "NIST",
    "calls_remaining": 49999
  }
}
  • ✓ Entropy documented per credential
  • ✓ Generation method: crypto.randomInt() only
  • ✓ Compliance profile: NIST 800-63B verified
AUDIT FINDING CLOSED - Evidence provided automatically

Why Math.random() fails security audits

Math.random()

Not cryptographically secure

Predictable patterns. Fails NIST 800-63B.

crypto.randomInt()

Cryptographically secure

Uniform distribution. NIST 800-63B compliant.

The Six Sense API uses Node.js crypto.randomInt() exclusively. The source is auditable.

From weak generation to documented compliance in one API call

Step 1

Add the API call

Replace your existing credential generation with a POST request. Five lines of code.

Step 2

Choose your compliance profile

NIST 800-63B, SOC2, or custom. The profile enforces requirements automatically.

Step 3

Ship with documented proof

Every response includes entropy bits, compliance profile, and generation timestamp. Your auditors have everything they need.

Minimal integration code

const { passwords, meta } = await fetch(
  "https://api.sixsensesolutions.net/v1/generate",
  {
    method: "POST",
    headers: {
      "Authorization": "Bearer your_api_key",
      "Content-Type": "application/json"
    },
    body: JSON.stringify({
      length: 20, quantity: 1, compliance: "NIST",
      options: { uppercase: true, lowercase: true,
                 numbers: true, symbols: true,
                 exclude_ambiguous: true }
    })
  }
).then(r => r.json());

// meta.entropy_bits: 120
// meta.compliance_profile: "NIST"
// meta.generated_at: "2026-04-09T15:18:11.094Z"

What your auditors actually receive

Every API response includes documented proof. No additional tooling required.

Live API Response
{
  "passwords": ["••••••••••••••••••••"],
  "meta": {
    "length": 20,
    "entropy_bits": 120.4,
    "generated_at": "2026-04-09T15:18:11.094Z",
    "compliance_profile": "NIST",
    "calls_remaining": 49999
  }
}
entropy_bits: 120.4 Shannon entropy calculated per response. Your auditor has the math without asking your team.
compliance_profile: "NIST" Documents which standard was applied at generation time. Not retroactively.
generated_at: timestamp Cryptographic generation timestamp. Immutable proof of when the credential was created.

Built for teams that get audited

Every API response includes documented proof that generated credentials meet regulatory standards.

NIST 800-63B

Minimum 15 characters, full character set, ambiguous character exclusion, entropy documentation per response.

SOC2

Minimum 12 characters, uppercase, lowercase, and numbers required, ambiguous character exclusion, audit-ready response metadata.

Enterprise and Government

Custom compliance profiles, FedRAMP roadmap documentation, CMMC alignment in progress, dedicated support. Contact us for requirements.

Start free. Scale when your team needs to.

Free

$0/month

500 calls/month

Generate + Validate + Breach Check

NIST + SOC2 + strong profiles

Entropy documentation

No credit card

Get Free API Key

Pro

$29/month

50,000 calls/month

All four endpoints

All profiles

Entropy documentation

Email support

Contact Us

Business

$149/month

500,000 calls/month

All four endpoints + priority support

All profiles

Compliance documentation package

Contact Us

Enterprise

Custom pricing

Unlimited calls

Custom compliance profiles

FedRAMP roadmap

SBIR and government contract support

Dedicated account management

Contact Us

Pro, Business, and Enterprise plans are available now. Contact us to get started.

Get your free API key

500 calls per month. No credit card. Start generating compliant credentials in minutes.

Government and enterprise contracts

Six Sense Solutions is registered on SAM.gov and pursuing government contracts under NAICS codes 541519, 541512, and 541690. If you represent a government agency or enterprise organization with credential security requirements, contact us directly.

Contact Us for Enterprise Pricing