# Strac Comply Developer Platform

> Compliance automation for SOC 2, ISO 27001, NIST CSF 2.0, and more. A PAT-authenticated REST API on comply.strac.io and a Model Context Protocol server on mcp.comply.strac.io expose your live compliance posture — controls, policies, documents, audits, automated tests, and personnel — and let AI agents write evidence back to the audit binder, with every write attributed in an append-only audit log.

## Documentation
- [Overview](https://comply.strac.io/docs): what the platform is and how to choose between a PAT and OAuth
- [Authentication](https://comply.strac.io/docs/authentication): minting a Personal Access Token and the OAuth 2.1 + PKCE flow for MCP clients
- [REST API reference](https://comply.strac.io/docs/api): every /api/v1 endpoint with curl, JavaScript, and Python samples
- [MCP reference](https://comply.strac.io/docs/mcp): every MCP tool with its input schema and an example tools/call
- [OpenAPI spec](https://comply.strac.io/openapi.json): machine-readable OpenAPI 3.1 document for the REST surface

## REST endpoints
- `POST /api/companies/{companyId}/pats` (scope: any) — Mint a Personal Access Token
- `GET /api/companies/{companyId}/pats` (scope: any) — List Personal Access Tokens
- `POST /api/companies/{companyId}/pats/{patId}/revoke` (scope: any) — Revoke a Personal Access Token
- `GET /api/v1/frameworks` (scope: compliance:read) — List framework controls
- `GET /api/v1/companies/{companyId}/controls` (scope: compliance:read) — List controls with completion
- `GET /api/v1/companies/{companyId}/controls/{controlId}` (scope: compliance:read) — One control + evidence summary
- `GET /api/v1/companies/{companyId}/controls/summary` (scope: compliance:read) — Framework rollup
- `POST /api/v1/companies/{companyId}/controls/{controlId}/mark-na` (scope: evidence:write) — Mark a control Not Applicable
- `POST /api/v1/companies/{companyId}/controls/{controlId}/restore` (scope: evidence:write) — Restore an N/A control to applicable
- `GET /api/v1/companies/{companyId}/policies` (scope: policies:read) — List policies + status
- `GET /api/v1/companies/{companyId}/policies/{policyId}` (scope: policies:read) — One policy + version history
- `POST /api/v1/companies/{companyId}/policies/{policyId}/versions` (scope: policies:write) — Upload a new policy version (draft)
- `POST /api/v1/companies/{companyId}/policies/{policyId}/versions/{versionId}/approve` (scope: policies:approve) — Approve a draft version → published
- `GET /api/v1/companies/{companyId}/documents` (scope: documents:read) — List catalog documents + status
- `GET /api/v1/companies/{companyId}/documents/{documentId}` (scope: documents:read) — One document + version history
- `GET /api/v1/companies/{companyId}/documents/{documentId}/versions/{versionId}/download-url` (scope: documents:read) — Presigned download URL for a version
- `POST /api/v1/companies/{companyId}/documents/{documentId}/versions/upload` (scope: documents:write) — Upload a new document version (draft)
- `POST /api/v1/companies/{companyId}/documents/{documentId}/versions/{versionId}/publish` (scope: documents:write) — Publish a document version
- `GET /api/v1/companies/{companyId}/audits` (scope: audits:read) — List audits + pending counts
- `GET /api/v1/companies/{companyId}/audits/{auditId}` (scope: audits:read) — One audit binder summary
- `GET /api/v1/companies/{companyId}/tests/results` (scope: compliance:read) — List automated test results
- `GET /api/v1/companies/{companyId}/employees` (scope: personnel:read) — Employee directory
- `GET /api/v1/companies/{companyId}/audit-log` (scope: compliance:read) — Append-only audit log of v1 writes

## MCP tools
- `list_frameworks` (scope: compliance:read) — Supported compliance frameworks
- `get_compliance_status` (scope: compliance:read) — Per-framework completion rollup
- `list_controls` (scope: compliance:read) — Controls catalog with completion
- `get_control` (scope: compliance:read) — One control + evidence summary
- `get_next_actions` (scope: compliance:read) — Next steps — the prioritized path to 100%
- `list_policies` (scope: policies:read) — All policies + status
- `get_policy` (scope: policies:read) — One policy + latest version
- `list_documents` (scope: documents:read) — Document catalog
- `list_employees` (scope: personnel:read) — Employee directory
- `list_lifecycle_checklists` (scope: personnel:read + compliance:read) — Onboarding/offboarding checklists
- `get_lifecycle_checklist` (scope: personnel:read + compliance:read) — One lifecycle checklist with items
- `list_inventory` (scope: compliance:read) — System inventory (audit-scope asset population)
- `list_saas_accounts` (scope: personnel:read + compliance:read) — SaaS account security posture (MFA/SSO/owner)
- `list_saas_apps` (scope: compliance:read) — Shadow-IT OAuth app discovery records
- `list_audits` (scope: audits:read) — Audit binders
- `get_audit` (scope: audits:read) — One audit binder + evidence/findings rollup
- `get_audit_verdicts` (scope: audits:read) — Per-control auditor verdicts for one audit
- `list_tests` (scope: compliance:read) — Automated test results (filterable)
- `get_test_result` (scope: compliance:read) — Drill-down on a single test result
- `rerun_test` (scope: tests:write) — Re-run one automated test against live data
- `get_test_execution` (scope: compliance:read) — Poll a test re-run by executionId
- `acknowledge_test` (scope: tests:write) — Propose accepting the risk on a failing test
- `list_test_evidence` (scope: compliance:read) — Reference/audit files attached to a test
- `begin_test_evidence_upload` (scope: evidence:write) — Start a presigned upload of test reference evidence
- `finalize_test_evidence_upload` (scope: evidence:write) — Finish a test-evidence upload → registered file
- `mark_control_na` (scope: evidence:write) — Mark a control Not Applicable
- `mark_evidence_na` (scope: evidence:write) — Mark a document, policy or integration slot Not Applicable
- `attach_evidence` (scope: evidence:write) — Attach a policy or document to a control
- `upload_document` (scope: documents:write) — Upload an ad-hoc document
- `upload_policy` (scope: policies:write) — Upload the first version of a policy (draft)
- `update_policy` (scope: policies:write) — Update a policy (optimistic-locked)
- `compare_policy` (scope: policies:read) — Structural diff vs the canonical required sections
- `approve_policy` (scope: policies:approve) — Approve a draft version → published
- `create_custom_policy` (scope: policies:write) — Create a custom policy + version + control mappings
- `begin_policy_upload` (scope: policies:write) — Start a presigned upload of a policy file
- `finalize_policy_upload` (scope: policies:write) — Finish a presigned policy upload → draft version
- `begin_policy_uploads` (scope: policies:write) — Start N presigned policy uploads in one call
- `finalize_policy_uploads` (scope: policies:write + policies:approve) — Finish N policy uploads → approved versions
- `begin_document_upload` (scope: documents:write) — Start a presigned upload of a document file
- `finalize_document_upload` (scope: documents:write) — Finish a presigned document upload → registered document
- `begin_document_uploads` (scope: documents:write) — Start N presigned document uploads in one call
- `finalize_document_uploads` (scope: documents:write) — Finish N document uploads → published catalog versions
- `publish_document` (scope: documents:write) — Publish a draft catalog-document version
- `add_document_link` (scope: documents:write) — Satisfy a catalog document slot with an external link
- `set_policy_coverage` (scope: policies:write) — Link a policy slot to be covered by another policy
- `suggest_policy_coverage` (scope: policies:read) — Start an AI coverage scan for one document (advisory)
- `get_policy_coverage` (scope: policies:read) — Poll an async coverage-suggestion job
- `ask_compliance_question` (scope: chat:ask) — Freeform Q&A grounded on live posture
- `connect_integration` (scope: compliance:read) — Start a nested-OAuth integration handoff
- `get_connection_status` (scope: compliance:read) — Poll an integration handoff to completion
- `list_integrations` (scope: compliance:read) — Already-connected integrations
- `import_vendors` (scope: vendors:write) — Bulk-import vendors from a GRC-platform export
- `run_vendor_risk_assessment` (scope: vendors:write) — Run the deterministic risk assessment for one vendor
- `run_vendor_risk_assessments` (scope: vendors:write) — Bulk-run the risk assessment across many vendors
- `record_vendor_security_review` (scope: vendors:write) — Record a completed vendor security review
- `attach_vendor_document` (scope: vendors:write) — Attach a compliance document FROM a vendor (inline, small files)
- `begin_vendor_document_upload` (scope: vendors:write) — Start a presigned upload of a vendor document (preferred)
- `finalize_vendor_document_upload` (scope: vendors:write) — Finish a presigned vendor-document upload → current evidence
- `import_risks` (scope: risks:write) — Bulk-import risk-register entries from a GRC export
- `import_test_runs` (scope: tests:write) — Import historic test runs so auditors can sample the pre-migration period
- `list_vendors` (scope: vendors:read) — List managed vendors
- `list_risks` (scope: risks:read) — List the risk register
- `list_audit_requests` (scope: audits:read) — An audit's evidence requests
- `get_audit_request` (scope: audits:read) — One request + attachable evidence
- `get_audit_request_attachment_download_url` (scope: audits:read) — Download an auditor's attachment
- `begin_audit_response_upload` (scope: audit-requests:write) — Upload a new file for a response
- `prepare_audit_request_response` (scope: audit-requests:write) — Prepare a DRAFT reply (does not send)
- `submit_audit_request_response` (scope: audit-requests:write) — Send a prepared draft to the auditor