REST API

Script Strac Comply from CI, Postman, or any HTTP client. Authenticate with a Personal Access Token (see Authentication). Every endpoint below shows its parameters, required scope, and a copy-paste request in curl, JavaScript, and Python.

Conventions

Base URL

bash

https://comply.strac.io/api/v1

Most paths are tenant-scoped: /api/v1/companies/{companyId}/.... The companyId is validated against the bearer's organization — cross-tenant requests return 403 forbidden with a neutral message. PAT-management endpoints live under /api/companies/{companyId}/pats (Cognito-authed, not /api/v1).

Response envelope

Most responses are { success: true, data: ... }. A few keep legacy shapes (noted on the endpoint) — e.g. test results return { summary, results } and the audit log nests under data.entries. Errors follow RFC 6750: { error, error_description }.

Auth header

Send your PAT as a bearer token: Authorization: Bearer strac_pat_…. PAT mint / list / revoke use a Cognito session instead (you can't mint a PAT with a PAT).

Machine-readable spec

This reference is generated from a typed catalog, so the spec never drifts from the page. Import the OpenAPI 3.1 document into Postman, Insomnia, or an SDK generator, and point AI clients at llms.txt for discovery. The OpenAPI doc covers the REST surface only — MCP tools are JSON-RPC and live in the MCP reference.

Scopes

Least-privilege. Each endpoint lists the scope it requires; mint a PAT with only those.

Scope	Admits
compliance:read	Read controls, frameworks, audits, tests, and the audit log.
policies:read	Read policies and policy versions.
policies:write	Upload and update policies (draft state).
policies:approve	Approve a policy version (lifecycle write).
documents:read	Read documents and fetch presigned download URLs.
documents:write	Upload and publish document versions.
personnel:read	Read the employee directory.
audits:read	Read audit binders and evidence requests.
evidence:write	Attach evidence to controls; mark controls Not Applicable.

Tokens

POST

/api/companies/{companyId}/pats

Scope

any bearer

Role: owner / admin (to mint write scopes)Auth: Cognito session

Mint a Personal Access Token

Create a PAT for the REST API. Cognito-authenticated (you cannot mint a PAT with a PAT). The plaintext token is returned exactly once. Owners/admins can mint any scope; members and viewers can mint read-only scopes only.

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.

Body (Zod-strict — extra keys rejected)

Field	Type	Description
labelrequired	string, 1–80 chars	Shows in the admin UI and the audit log.
scopesrequired	string[] (non-empty)	Least-privilege scope set; each must be a canonical scope.
expiresInDaysrequired	integer	Token lifetime in days. 0 = never expires (service accounts).`03090365`

Request

bashPOST /api/companies/{companyId}/pats

curl -X POST 'https://comply.strac.io/api/companies/comp_demo/pats' \  -H 'Authorization: Bearer eyJraWQ...<cognito-id-token>' \  -H 'Content-Type: application/json' \  -d '{  "label": "CI deploy bot",  "scopes": [    "compliance:read",    "documents:write"  ],  "expiresInDays": 90}'

Response · 201

json

{  "success": true,  "data": {    "token": "strac_pat_xxxxxxxxxxxxxxxx_xxxxxxxxxxxxxxxx",    "pat": {      "patId": "<sha256-hash>",      "prefix": "strac_pat_a1b2",      "label": "CI deploy bot",      "scope": "compliance:read documents:write",      "expiresAt": 1787616000,      "email": "ci@example.com",      "createdAt": "2026-05-27T08:18:14.536Z",      "createdBy": "ci@example.com",      "lastUsedAt": null,      "revokedAt": null,      "status": "active"    }  }}

GET

/api/companies/{companyId}/pats

Scope

any bearer

Auth: Cognito session

List Personal Access Tokens

Returns token metadata only — never the secret. Owners/admins see every PAT in the org; members and viewers see only their own.

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.

Request

bashGET /api/companies/{companyId}/pats

curl 'https://comply.strac.io/api/companies/comp_demo/pats' \  -H 'Authorization: Bearer eyJraWQ...<cognito-id-token>'

Response · 200

json

{  "success": true,  "data": {    "pats": [      {        "patId": "<sha256-hash>",        "prefix": "strac_pat_a1b2",        "label": "CI deploy bot",        "scope": "compliance:read documents:write",        "expiresAt": 1787616000,        "email": "ci@example.com",        "createdAt": "2026-05-27T08:18:14.536Z",        "createdBy": "ci@example.com",        "lastUsedAt": "2026-05-27T15:00:00.000Z",        "revokedAt": null,        "status": "active"      }    ]  }}

POST

/api/companies/{companyId}/pats/{patId}/revoke

Scope

any bearer

Role: owner / admin (or the token owner)Auth: Cognito session

Revoke a Personal Access Token

Soft-revoke (the row is preserved for the audit trail). The PAT stops working on the next request — no grace period. The optional reason lands in the audit log.

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.
patIdrequired	string	The PAT id (sha256 hash), not the plaintext token.

Body (Zod-strict — extra keys rejected)

Field	Type	Description
reasonoptional	string, 1–500 chars	Why the token was revoked (e.g. rotation, offboarding).

Request

bashPOST /api/companies/{companyId}/pats/{patId}/revoke

curl -X POST 'https://comply.strac.io/api/companies/comp_demo/pats/%3Csha256-hash%3E/revoke' \  -H 'Authorization: Bearer eyJraWQ...<cognito-id-token>' \  -H 'Content-Type: application/json' \  -d '{  "reason": "rotation"}'

Response · 200

json

{  "success": true,  "data": {    "revoked": true,    "alreadyRevoked": false,    "patId": "<sha256-hash>"  }}

Frameworks

GET

/api/v1/frameworks

Scope

compliance:read

Auth: PAT bearer

List framework controls

Returns the control catalog across active frameworks (or one framework via `?framework=`). Global, not tenant-scoped — a valid bearer is required to discourage scraping.

Query parameters

Field	Type	Description
frameworkoptional	string	Filter to one framework id (e.g. soc2). Omit for all.Default: `all`

Request

bashGET /api/v1/frameworks

curl 'https://comply.strac.io/api/v1/frameworks' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx'

Response · 200

json

{  "success": true,  "framework": "all",  "controls": [    {      "id": "soc2-cc6.1",      "frameworkId": "soc2",      "controlId": "CC6.1",      "title": "Logical access controls",      "category": "Logical & Physical Access",      "riskLevel": "high"    }  ]}

Controls

GET

/api/v1/companies/{companyId}/controls

Scope

compliance:read

Auth: PAT bearer

List controls with completion

All controls for the company with completion % and the binary readiness signal.

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.

Query parameters

Field	Type	Description
frameworkoptional	string	Filter by framework id (e.g. soc2).Default: `all`
categoryoptional	string	Filter by control category (exact match on the category field).
statusoptional	string	Exact-match on the workflow status label (URL-encode the space). NOT about people: Unassigned/Assigned/Needs reassignment track whether the control has TESTS linked to it, not who owns it — human ownership is the separate `assignedTo` field. Needs evidence and In progress are derived at read time from a stored Completed that readiness contradicts, so they never appear in stored data. The readiness signal is the separate `auditReadiness` field.`UnassignedAssignedNeeds reassignmentIn progressNeeds evidenceCompleted`

Request

bashGET /api/v1/companies/{companyId}/controls

curl 'https://comply.strac.io/api/v1/companies/comp_demo/controls' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx'

Response · 200

json

{  "success": true,  "count": 1,  "data": [    {      "id": "soc2-cc6.1",      "title": "Logical access controls",      "category": "Logical & Physical Access",      "status": "Needs evidence",      "framework": "SOC 2",      "frameworkId": "soc2",      "frameworkReference": "CC6.1",      "notApplicable": false,      "completionPercentage": 67,      "auditReadiness": "gap",      "testsPassed": 4,      "testsTotal": 5,      "linkedTestCount": 5,      "linkedPolicyCount": 1,      "linkedDocumentCount": 1,      "requiredTotal": 3,      "requiredMissing": 1,      "riskLevel": "high"    }  ]}

GET

/api/v1/companies/{companyId}/controls/{controlId}

Scope

compliance:read

Auth: PAT bearer

One control + evidence summary

A single control with its linked tests, policies, documents, and any Not-Applicable metadata.

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.
controlIdrequired	string	Control id, e.g. CC6.1. URL-encode `#` as %23.

Request

bashGET /api/v1/companies/{companyId}/controls/{controlId}

curl 'https://comply.strac.io/api/v1/companies/comp_demo/controls/CC6.1' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx'

Response · 200

json

{  "success": true,  "data": {    "id": "soc2-cc6.1",    "title": "Logical access controls",    "description": "The entity implements logical access security controls...",    "category": "Logical & Physical Access",    "status": "Needs evidence",    "framework": "SOC2",    "frameworkId": "soc2",    "frameworkReference": "CC6.1",    "completionPercentage": 67,    "auditReadiness": "gap",    "auditGaps": [      "No approved access-review policy within the review window"    ],    "testsPassed": 4,    "testsTotal": 5,    "notApplicable": false,    "markedNAAt": null,    "markedNABy": null,    "linkedTests": [      {        "testId": "aws-s3-encryption",        "name": "S3 Encryption Check",        "status": "failing"      }    ],    "linkedPolicies": [      {        "policyId": "POL-SEC-001",        "name": "Information Security Policy"      }    ],    "linkedDocuments": [      {        "documentId": "DOC-CC1-ORG-CHART",        "title": "Company Organization Chart"      }    ]  }}

GET

/api/v1/companies/{companyId}/controls/summary

Scope

compliance:read

Auth: PAT bearer

Framework rollup

Org-wide rollup: per-framework control counts + the tests / policies / documents / integrations evidence dimensions, plus overall totals. Can take 5–30s on large tenants. Two keys describe how the numbers were computed: `percentageBasis: "audit-ready-controls"` means every `percentage` is a ready-controls ratio (completed / applicable), not an evidence-weighted average; `personnelSignalBasis: "not-evaluated"` means this endpoint did not resolve the personnel background-check signal, so a control whose required background-check evidence would be credited from your People view reads unmet here while `GET /controls` — which does resolve it — may show it satisfied. Expect the two endpoints to differ by that amount if you have no background-check integration.

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.

Request

bashGET /api/v1/companies/{companyId}/controls/summary

curl 'https://comply.strac.io/api/v1/companies/comp_demo/controls/summary' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx'

Response · 200

json

{  "success": true,  "data": {    "frameworks": [      {        "frameworkId": "SOC2",        "total": 64,        "completed": 40,        "percentage": 65,        "percentageBasis": "audit-ready-controls",        "applicable": 62,        "notApplicable": 2,        "totalTests": 120,        "passingTests": 102,        "failingTests": 18,        "policies": {          "total": 14,          "approved": 11,          "needsAttention": 3        },        "documents": {          "total": 79,          "needsAttention": 12        },        "training": {          "completed": 18,          "assigned": 20,          "applicable": true        }      }    ],    "tests": {      "total": 120,      "passing": 102,      "failing": 18,      "errors": 0    },    "policies": {      "total": 14,      "approved": 11,      "needsAttention": 3    },    "integrations": {      "total": 3,      "connected": 3    },    "documents": {      "total": 79,      "needsAttention": 12    },    "total": 64,    "completed": 40,    "averageCompletion": 65,    "percentageBasis": "audit-ready-controls",    "personnelSignalBasis": "not-evaluated"  }}

POST

/api/v1/companies/{companyId}/controls/{controlId}/mark-na

Scope

evidence:write

Role: owner / adminAuth: PAT bearer

Mark a control Not Applicable

Marks a control N/A with a reason. Writes an append-only audit-log row (`v1_mark_control_na`).

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.
controlIdrequired	string	Control id, e.g. CC6.1.

Body (Zod-strict — extra keys rejected)

Field	Type	Description
reasonrequired	string, 10–500 chars	Why the control does not apply (the auditor sees this).

Request

bashPOST /api/v1/companies/{companyId}/controls/{controlId}/mark-na

curl -X POST 'https://comply.strac.io/api/v1/companies/comp_demo/controls/CC6.1/mark-na' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx' \  -H 'Content-Type: application/json' \  -d '{  "reason": "No customer-managed laptops; access is via SSO-only managed devices."}'

Response · 200

json

{  "success": true,  "data": {    "markedNAAt": "2026-05-27T16:00:00.000Z",    "markedNABy": "admin@example.com"  }}

POST

/api/v1/companies/{companyId}/controls/{controlId}/restore

Scope

evidence:write

Role: owner / adminAuth: PAT bearer

Restore an N/A control to applicable

Reverses a Not-Applicable marking. Writes an audit-log row (`v1_unmark_control_na`).

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.
controlIdrequired	string	Control id, e.g. CC6.1.

Request

bashPOST /api/v1/companies/{companyId}/controls/{controlId}/restore

curl -X POST 'https://comply.strac.io/api/v1/companies/comp_demo/controls/CC6.1/restore' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx'

Response · 200

json

{  "success": true}

Policies

GET

/api/v1/companies/{companyId}/policies

Scope

policies:read

Auth: PAT bearer

List policies + status

All policies with lifecycle status and review dates. `lifecycleStatus === "published"` is the signal that a policy is approved audit/portal evidence.

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.

Query parameters

Field	Type	Description
frameworkoptional	string	Filter by framework.

Request

bashGET /api/v1/companies/{companyId}/policies

curl 'https://comply.strac.io/api/v1/companies/comp_demo/policies' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx'

Response · 200

json

{  "success": true,  "data": [    {      "id": "POL-SEC-001",      "policyId": "POL-SEC-001",      "title": "Information Security Policy",      "framework": [        "SOC 2"      ],      "status": "compliant",      "lifecycleStatus": "published",      "currentVersion": "<version-uuid>",      "lastReviewDate": "2026-02-27T00:00:00.000Z",      "nextReviewDate": "2027-02-27T00:00:00.000Z",      "assignedTo": "ciso@example.com"    }  ]}

GET

/api/v1/companies/{companyId}/policies/{policyId}

Scope

policies:read

Auth: PAT bearer

One policy + version history

A single policy with its full version list (status, uploader, format, approval metadata).

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.
policyIdrequired	string	Policy id, e.g. POL-SEC-001.

Request

bashGET /api/v1/companies/{companyId}/policies/{policyId}

curl 'https://comply.strac.io/api/v1/companies/comp_demo/policies/POL-SEC-001' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx'

Response · 200

json

{  "success": true,  "data": {    "id": "POL-SEC-001",    "policyId": "POL-SEC-001",    "title": "Information Security Policy",    "framework": [      "SOC 2"    ],    "lifecycleStatus": "published",    "currentVersion": "<version-uuid>",    "currentVersionNumber": 3,    "linkedControls": [      "CC6.1",      "CC7.2"    ],    "versions": [      {        "id": "<version-uuid>",        "version": 3,        "status": "approved",        "uploadedAt": "2026-02-20T00:00:00.000Z",        "uploadedBy": "ciso@example.com",        "fileName": "infosec-policy-v3.pdf",        "contentFormat": "pdf",        "approvedAt": "2026-02-27T00:00:00.000Z",        "approvedBy": "ceo@example.com"      }    ]  }}

POST

/api/v1/companies/{companyId}/policies/{policyId}/versions

Scope

policies:write

Role: owner / adminAuth: PAT bearer

Upload a new policy version (draft)

Uploads a new version as a draft. Send the file base64-encoded (≤4 MB raw). Writes audit-log row `v1_upload_policy`.

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.
policyIdrequired	string	Policy id, e.g. POL-SEC-001.

Body (Zod-strict — extra keys rejected)

Field	Type	Description
fileNamerequired	string	File name with extension (.pdf, .docx, .doc).
fileContentrequired	string (base64)	Base64-encoded file bytes, ≤4 MB raw.
commentsoptional	string	Optional changelog note for this version.

Request

bashPOST /api/v1/companies/{companyId}/policies/{policyId}/versions

curl -X POST 'https://comply.strac.io/api/v1/companies/comp_demo/policies/POL-SEC-001/versions' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx' \  -H 'Content-Type: application/json' \  -d '{  "fileName": "infosec-policy-v4.pdf",  "fileContent": "JVBERi0xLjcK...<base64>",  "comments": "Annual review update"}'

Response · 200

json

{  "success": true,  "data": {    "id": "<version-uuid>",    "policyId": "POL-SEC-001",    "version": 4,    "status": "draft",    "uploadedAt": "2026-05-27T16:00:00.000Z",    "uploadedBy": "ciso@example.com",    "fileName": "infosec-policy-v4.pdf",    "contentFormat": "pdf"  }}

POST

/api/v1/companies/{companyId}/policies/{policyId}/versions/{versionId}/approve

Scope

policies:approve

Role: owner / adminAuth: PAT bearer

Approve a draft version → published

Approves a draft policy version, flipping the policy to `published`. Writes audit-log row `v1_approve_policy`.

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.
policyIdrequired	string	Policy id, e.g. POL-SEC-001.
versionIdrequired	string	The draft version id to approve.

Request

bashPOST /api/v1/companies/{companyId}/policies/{policyId}/versions/{versionId}/approve

curl -X POST 'https://comply.strac.io/api/v1/companies/comp_demo/policies/POL-SEC-001/versions/%3Cversion-uuid%3E/approve' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx'

Response · 200

json

{  "success": true,  "message": "Policy version approved successfully"}

Documents

GET

/api/v1/companies/{companyId}/documents

Scope

documents:read

Auth: PAT bearer

List catalog documents + status

The canonical SOC 2 document catalog with control mappings and lifecycle status. Only `published` docs within their review window count toward completion.

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.

Request

bashGET /api/v1/companies/{companyId}/documents

curl 'https://comply.strac.io/api/v1/companies/comp_demo/documents' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx'

Response · 200

json

{  "success": true,  "data": [    {      "id": "DOC-CC1-ORG-CHART",      "name": "Organization Chart",      "frameworks": [        "SOC 2"      ],      "controlMappings": [        {          "controlId": "CC1.1",          "framework": "SOC 2",          "evidenceType": "required"        }      ],      "lifecycleStatus": "published",      "currentVersionId": "<version-uuid>",      "publishedAt": "2026-05-01T00:00:00.000Z",      "nextReviewDate": "2026-08-01T00:00:00.000Z"    }  ]}

GET

/api/v1/companies/{companyId}/documents/{documentId}

Scope

documents:read

Auth: PAT bearer

One document + version history

A single catalog document with its version list.

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.
documentIdrequired	string	Document id, e.g. DOC-CC1-ORG-CHART.

Request

bashGET /api/v1/companies/{companyId}/documents/{documentId}

curl 'https://comply.strac.io/api/v1/companies/comp_demo/documents/DOC-CC1-ORG-CHART' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx'

Response · 200

json

{  "success": true,  "data": {    "id": "DOC-CC1-ORG-CHART",    "name": "Organization Chart",    "lifecycleStatus": "published",    "versions": [      {        "id": "<version-uuid>",        "versionNumber": 2,        "status": "published",        "fileName": "org-chart-2026-05.xlsx",        "fileSize": 1048576,        "uploadedAt": "2026-05-01T00:00:00.000Z",        "uploadedBy": "people@example.com",        "publishedAt": "2026-05-01T00:00:00.000Z"      }    ]  }}

GET

/api/v1/companies/{companyId}/documents/{documentId}/versions/{versionId}/download-url

Scope

documents:read

Auth: PAT bearer

Presigned download URL for a version

Returns a presigned S3 URL (3600s TTL) for the version blob.

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.
documentIdrequired	string	Document id.
versionIdrequired	string	Version id.

Request

bashGET /api/v1/companies/{companyId}/documents/{documentId}/versions/{versionId}/download-url

curl 'https://comply.strac.io/api/v1/companies/comp_demo/documents/DOC-CC1-ORG-CHART/versions/%3Cversion-uuid%3E/download-url' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx'

Response · 200

json

{  "success": true,  "data": {    "downloadUrl": "https://s3.amazonaws.com/.../org-chart.xlsx?X-Amz-Signature=...",    "expiresIn": 3600  }}

POST

/api/v1/companies/{companyId}/documents/{documentId}/versions/upload

Scope

documents:write

Role: owner / adminAuth: PAT bearer

Upload a new document version (draft)

Uploads a new document version as a draft. Send the file base64-encoded (≤4 MB raw). Writes audit-log row `v1_upload_document`.

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.
documentIdrequired	string	Document id.

Body (Zod-strict — extra keys rejected)

Field	Type	Description
fileNamerequired	string	File name with extension (pdf/docx/xlsx/pptx/doc/xls/png/jpeg/gif/webp/csv/txt/md/json/zip).
fileTyperequired	string (MIME)	MIME type, e.g. application/pdf or application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.
fileContentrequired	string (base64)	Base64-encoded file bytes, ≤4 MB raw.
commentsoptional	string	Optional changelog note.

Request

bashPOST /api/v1/companies/{companyId}/documents/{documentId}/versions/upload

curl -X POST 'https://comply.strac.io/api/v1/companies/comp_demo/documents/DOC-CC1-ORG-CHART/versions/upload' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx' \  -H 'Content-Type: application/json' \  -d '{  "fileName": "org-chart-2026-06.xlsx",  "fileType": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",  "fileContent": "UEsDBBQ...<base64>",  "comments": "Q2 reorg"}'

Response · 200

json

{  "success": true,  "data": {    "id": "<version-uuid>",    "documentId": "DOC-CC1-ORG-CHART",    "versionNumber": 3,    "status": "draft",    "fileName": "org-chart-2026-06.xlsx",    "uploadedAt": "2026-05-27T16:00:00.000Z",    "uploadedBy": "people@example.com"  }}

POST

/api/v1/companies/{companyId}/documents/{documentId}/versions/{versionId}/publish

Scope

documents:write

Role: owner / adminAuth: PAT bearer

Publish a document version

Archives the prior published version and publishes the target. Writes audit-log row `v1_publish_document`.

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.
documentIdrequired	string	Document id.
versionIdrequired	string	Version id to publish.

Request

bashPOST /api/v1/companies/{companyId}/documents/{documentId}/versions/{versionId}/publish

curl -X POST 'https://comply.strac.io/api/v1/companies/comp_demo/documents/DOC-CC1-ORG-CHART/versions/%3Cversion-uuid%3E/publish' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx'

Response · 200

json

{  "success": true,  "data": {    "id": "<version-uuid>",    "documentId": "DOC-CC1-ORG-CHART",    "versionNumber": 3,    "status": "published",    "publishedAt": "2026-05-27T16:00:00.000Z",    "publishedBy": "people@example.com"  }}

Audits

GET

/api/v1/companies/{companyId}/audits

Scope

audits:read

Auth: PAT bearer

List audits + pending counts

All audit binders with lifecycle, period, and pending-evidence breakdown.

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.

Request

bashGET /api/v1/companies/{companyId}/audits

curl 'https://comply.strac.io/api/v1/companies/comp_demo/audits' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx'

Response · 200

json

{  "success": true,  "data": [    {      "id": "<audit-uuid>",      "title": "SOC 2 Type 2 — 2026",      "frameworkAudits": [        {          "frameworkId": "soc2",          "framework": "SOC 2",          "periodStart": "2026-01-01T00:00:00.000Z",          "periodEnd": "2026-03-31T00:00:00.000Z",          "auditMode": "Type 2"        }      ],      "lifecycle": "in-flight",      "pendingRequestsCount": 5,      "pendingBreakdown": {        "awaitingAdmin": 2,        "awaitingAuditor": 3      },      "totalEvidenceCount": 127,      "approvedEvidenceCount": 120,      "createdAt": "2025-11-01T00:00:00.000Z"    }  ]}

GET

/api/v1/companies/{companyId}/audits/{auditId}

Scope

audits:read

Auth: PAT bearer

One audit binder summary

A single audit with sampled controls and per-control auditor status.

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.
auditIdrequired	string	Audit id (UUID).

Request

bashGET /api/v1/companies/{companyId}/audits/{auditId}

curl 'https://comply.strac.io/api/v1/companies/comp_demo/audits/%3Caudit-uuid%3E' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx'

Response · 200

json

{  "success": true,  "data": {    "id": "<audit-uuid>",    "title": "SOC 2 Type 2 — 2026",    "lifecycle": "in-flight",    "periodStart": "2026-01-01T00:00:00.000Z",    "periodEnd": "2026-03-31T00:00:00.000Z",    "auditorStatus": {      "CC6.1": {        "status": "submitted",        "verdict": null,        "notes": ""      }    },    "pendingRequestsCount": 5,    "totalEvidenceCount": 127,    "approvedEvidenceCount": 120  }}

Tests

GET

/api/v1/companies/{companyId}/tests/results

Scope

compliance:read

Auth: PAT bearer

List automated test results

Automated evidence-collection results with a summary header. Response is `{summary, results}` (not the `{success,data}` envelope).

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.

Query parameters

Field	Type	Description
statusoptional	string	Filter by result status.`passingfailingskippederrorall`Default: `all`
severityoptional	string	Filter by severity.`criticalhighmediumlowinfoall`Default: `all`
integrationIdoptional	string	Filter to one integration (e.g. aws-123456789012).

Request

bashGET /api/v1/companies/{companyId}/tests/results

curl 'https://comply.strac.io/api/v1/companies/comp_demo/tests/results?status=failing&severity=high' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx'

Response · 200

json

{  "summary": {    "total": 145,    "passing": 120,    "failing": 18,    "errors": 7,    "lastRun": "2026-05-27T14:32:00.000Z"  },  "results": [    {      "id": "<result-uuid>",      "testId": "aws-s3-encryption",      "testName": "S3 Encryption Check",      "status": "failing",      "severity": "high",      "category": "Security",      "integration": "aws",      "integrationId": "aws-123456789012",      "resourceId": "s3://acme-audit-logs",      "finding": "S3 bucket 'acme-audit-logs' does not have default encryption enabled.",      "executedAt": "2026-05-27T14:30:00.000Z",      "remediationSteps": [        "Enable SSE-S3 or SSE-KMS default encryption on the bucket."      ]    }  ]}

Personnel

GET

/api/v1/companies/{companyId}/employees

Scope

personnel:read

Auth: PAT bearer

Employee directory

A snapshot from the employees table (not a live IdP call), with status + department filters. Manual employment-status overrides set by an admin in the People page are honored — an overridden termination reads as terminated here even if the IdP still shows the account.

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.

Query parameters

Field	Type	Description
statusoptional	string	Filter by employment status.`activeterminatedall`Default: `active`
departmentoptional	string	Exact, case-sensitive department match.
limitoptional	integer	Max rows (capped at 2000).Default: `500`

Request

bashGET /api/v1/companies/{companyId}/employees

curl 'https://comply.strac.io/api/v1/companies/comp_demo/employees?status=active&department=Engineering' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx'

Response · 200

json

{  "success": true,  "total": 1,  "truncated": false,  "data": [    {      "employeeId": "<emp-uuid>",      "email": "alice@example.com",      "name": "Alice Smith",      "jobTitle": "Security Engineer",      "department": "Engineering",      "status": "active",      "hireDate": "2024-01-15",      "terminationDate": null    }  ]}

Audit Log

GET

/api/v1/companies/{companyId}/audit-log

Scope

compliance:read

Auth: PAT bearer

Append-only audit log of v1 writes

Every `/api/v1/*` write (and MCP write) lands here: actor, tool, resource, before/after state. Filter by tool or changeAuthor.

Path parameters

Field	Type	Description
companyIdrequired	string	Your organization id.

Query parameters

Field	Type	Description
tooloptional	string	Filter by tool name, e.g. v1_mark_control_na.
changeAuthoroptional	string	Filter by actor, e.g. pat:851b5b8dabaa.
limitoptional	integer	Max rows (capped at 200).Default: `50`

Request

bashGET /api/v1/companies/{companyId}/audit-log

curl 'https://comply.strac.io/api/v1/companies/comp_demo/audit-log?tool=v1_mark_control_na' \  -H 'Authorization: Bearer strac_pat_xxxxxxxxxxxx'

Response · 200

json

{  "success": true,  "data": {    "totalCount": 847,    "truncated": true,    "entries": [      {        "id": "<log-uuid>",        "tool": "v1_mark_control_na",        "resource": "CC6.1",        "resourceType": "control",        "action": "mark_control_na",        "changeAuthor": "pat:851b5b8dabaa",        "clientType": "pat",        "email": "admin@example.com",        "role": "admin",        "timestamp": "2026-05-27T14:32:00.000Z",        "beforeState": null,        "afterState": {          "markedNAAt": "2026-05-27T14:32:00.000Z",          "markedNABy": "admin@example.com",          "statusCode": 200        }      }    ]  }}

REST API

Conventions

Base URL

Response envelope

Machine-readable spec

Scopes

Tokens

Mint a Personal Access Token

List Personal Access Tokens

Revoke a Personal Access Token

Frameworks

List framework controls

Controls

List controls with completion

One control + evidence summary

Framework rollup

Mark a control Not Applicable

Restore an N/A control to applicable

Policies

List policies + status

One policy + version history

Upload a new policy version (draft)

Approve a draft version → published

Documents

List catalog documents + status

One document + version history

Presigned download URL for a version

Upload a new document version (draft)

Publish a document version

Audits

List audits + pending counts

One audit binder summary

Tests

List automated test results

Personnel

Employee directory

Audit Log

Append-only audit log of v1 writes

See also