feat(cmd-k): Add DSN lookup API endpoint by sergical · Pull Request #108400 · getsentry/sentry

sergical · 2026-02-17T22:30:29Z

Summary

Adds a private API endpoint that resolves a Sentry DSN to its associated project and key metadata. This powers the command palette (Cmd+K) — users can paste a DSN and quickly navigate to the corresponding project.

Endpoint: GET /api/0/organizations/{org}/dsn-lookup/?dsn=<dsn>

Behavior:

Parses the DSN to extract the public key, then looks up the matching ProjectKey scoped to the requesting organization
Returns project slug, ID, name, platform, and key label/ID
Returns 404 for invalid DSNs, unknown keys, or keys belonging to projects outside the org

Access control:

OrganizationEndpoint base class enforces org membership
ProjectKey query is scoped by project__organization_id to prevent IDOR
Gated behind the organizations:cmd-k-dsn-lookup feature flag
Rate limited to 5 req/s per user

Context

Split from #108396 — this is the backend half. The frontend PR (command palette integration) will follow and reference this PR as a dependency.

Test plan

Backend tests pass (pytest tests/sentry/api/endpoints/test_dsn_lookup.py)
CI passes

Add a new API endpoint that allows looking up project DSNs by their public key portion. This powers the command palette DSN lookup feature behind the organizations:cmd-k-dsn-lookup feature flag.

Add DSN lookup functionality to both the new supercharged command palette and the legacy search modal. Users can paste a DSN and get quick navigation to the corresponding project. Depends on backend PR #108400.

github-actions · 2026-02-17T22:32:56Z

🚨 Warning: This pull request contains Frontend and Backend changes!

It's discouraged to make changes to Sentry's Frontend and Backend in a single pull request. The Frontend and Backend are not atomically deployed. If the changes are interdependent of each other, they must be separated into two pull requests and be made forward or backwards compatible, such that the Backend or Frontend can be safely deployed independently.

Have questions? Please ask in the #discuss-dev-infra channel.

src/sentry/api/endpoints/dsn_lookup.py

The endpoint was missing the organizations:cmd-k-dsn-lookup feature flag check, making it accessible to any authenticated user regardless of whether the feature was enabled for their org. Also removes a broken unauthenticated test (silo mode issue with client.logout in region silo) and adds a test for the flag-disabled case.

Fixes mypy union-attr errors where ProjectKey | None was accessed without narrowing.

JoshFerge

I believe this introduces a security vulnerability as is as we're not checking that the user has access to the project key. can we:

use ProjectEndpoint or OrganizationEndpoint, which makes sure the user making request has access to the org/project?
in the ProjectKey lookup, make sure we're adding project to the ORM query so we prevent IDOR attacks?

mind adding a bit of description to the PR / endpoint docstring? from reading this i'm not quite sure what the intended use of the endpoint is (a user gives a dsn and it gets back info about it?)

JoshFerge · 2026-02-17T22:42:39Z

src/sentry/api/endpoints/dsn_lookup.py

+
+        try:
+            parsed = urlparse(dsn)
+        except Exception:


blanket exception handling is not ideal. how exactly can urlparse error? I assume it returns an error more specific than Exception.

Good call — removed the try/except entirely. urlparse is extremely permissive and basically never raises; request.GET.get() always returns str | None and we already guard None/empty above. Invalid DSNs (like "not-a-dsn") just produce a parsed result with no username, which the if not public_key check handles.

JoshFerge

and if this is intended to be a user scoped endpoint, can we use UserEndpoint?

sentry/src/sentry/users/api/bases/user.py

Line 102 in 88684c1

class UserEndpoint(Endpoint):

Address security review feedback: - Switch from bare Endpoint to OrganizationEndpoint so auth and org access are handled by the base class - Scope ProjectKey query with project__organization_id to prevent IDOR - Move URL from /api/0/dsn-lookup/ to /api/0/organizations/{org}/dsn-lookup/ - Add endpoint docstring explaining the use case - Remove manual OrganizationMember check (now handled by base class)

src/sentry/api/endpoints/dsn_lookup.py

urlparse only raises for non-string input, but request.GET.get() always returns str | None and we already guard against None/empty. Invalid DSNs are handled by the subsequent `if not public_key` check.

sergical · 2026-02-17T22:58:07Z

Re: UserEndpoint suggestion — this endpoint is org-scoped: the feature flag is per-org, and the DSN belongs to a project within that org. We switched to OrganizationEndpoint (which enforces org membership) and scope the ProjectKey query by project__organization_id. So OrganizationEndpoint is the right fit here.

Latest push removes the blanket except Exception around urlparse as well.

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

src/sentry/api/endpoints/dsn_lookup.py

Only resolve DSNs for active projects, active keys, and user-facing keys. Prevents returning metadata for deleted projects, inactive keys, or internal keys (e.g. profiling, escalating_issues).

JoshFerge

looks good!

feat(cmd-k): Add DSN lookup API endpoint

740de9f

Add a new API endpoint that allows looking up project DSNs by their public key portion. This powers the command palette DSN lookup feature behind the organizations:cmd-k-dsn-lookup feature flag.

sergical requested review from a team as code owners February 17, 2026 22:30

github-actions bot added the Scope: Backend Automatically applied to PRs that change backend components label Feb 17, 2026

sergical mentioned this pull request Feb 17, 2026

feat(cmd-k): Add DSN lookup to both command palettes #108401

Open

3 tasks

🛠️ Sync API Urls to TypeScript

676a988

github-actions bot added the Scope: Frontend Automatically applied to PRs that change frontend components label Feb 17, 2026

sentry bot reviewed Feb 17, 2026

View reviewed changes

src/sentry/api/endpoints/dsn_lookup.py Outdated Show resolved Hide resolved

vercel bot deployed to Preview February 17, 2026 22:35 View deployment

vercel bot deployed to Preview February 17, 2026 22:39 View deployment

fix(cmd-k): Add None checks for key_set.first() in DSN lookup tests

366b9e5

Fixes mypy union-attr errors where ProjectKey | None was accessed without narrowing.

JoshFerge requested changes Feb 17, 2026

View reviewed changes

JoshFerge reviewed Feb 17, 2026

View reviewed changes

vercel bot deployed to Preview February 17, 2026 22:44 View deployment

sergical and others added 2 commits February 17, 2026 17:44

🛠️ Sync API Urls to TypeScript

e13d35f

vercel bot deployed to Preview February 17, 2026 22:50 View deployment

cursor bot reviewed Feb 17, 2026

View reviewed changes

src/sentry/api/endpoints/dsn_lookup.py Outdated Show resolved Hide resolved

src/sentry/api/endpoints/dsn_lookup.py Show resolved Hide resolved

sentry bot reviewed Feb 17, 2026

View reviewed changes

src/sentry/api/endpoints/dsn_lookup.py Show resolved Hide resolved

fix(cmd-k): Remove unnecessary try/except around urlparse in DSN lookup

035e74e

urlparse only raises for non-string input, but request.GET.get() always returns str | None and we already guard against None/empty. Invalid DSNs are handled by the subsequent `if not public_key` check.

vercel bot deployed to Preview February 17, 2026 22:59 View deployment

cursor bot reviewed Feb 17, 2026

View reviewed changes

src/sentry/api/endpoints/dsn_lookup.py Show resolved Hide resolved

fix(cmd-k): Filter DSN lookup by active status and user use_case

29da483

Only resolve DSNs for active projects, active keys, and user-facing keys. Prevents returning metadata for deleted projects, inactive keys, or internal keys (e.g. profiling, escalating_issues).

vercel bot deployed to Preview February 17, 2026 23:07 View deployment

Merge branch 'master' into sergical/cmd-k-dsn-lookup-backend

bef9195

vercel bot deployed to Preview February 17, 2026 23:21 View deployment

JoshFerge approved these changes Feb 17, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(cmd-k): Add DSN lookup API endpoint#108400

feat(cmd-k): Add DSN lookup API endpoint#108400
sergical wants to merge 9 commits intomasterfrom
sergical/cmd-k-dsn-lookup-backend

sergical commented Feb 17, 2026 •

edited

Loading

Uh oh!

github-actions bot commented Feb 17, 2026

Uh oh!

Uh oh!

JoshFerge left a comment

Uh oh!

JoshFerge Feb 17, 2026

Uh oh!

sergical Feb 17, 2026

Uh oh!

JoshFerge left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sergical commented Feb 17, 2026

Uh oh!

cursor bot left a comment

Uh oh!

Uh oh!

JoshFerge left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

sergical commented Feb 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Context

Test plan

Uh oh!

github-actions bot commented Feb 17, 2026

Uh oh!

Uh oh!

JoshFerge left a comment

Choose a reason for hiding this comment

Uh oh!

JoshFerge Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

sergical Feb 17, 2026

Choose a reason for hiding this comment

Uh oh!

JoshFerge left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

sergical commented Feb 17, 2026

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

JoshFerge left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sergical commented Feb 17, 2026 •

edited

Loading