Introduction

ComplianceLayer is an External Security Scanning API that helps you assess and monitor security posture across your digital assets. Every scan runs 15 security modules covering DNS and email authentication, SSL/TLS, HTTP headers, open ports, WHOIS, DNSSEC, blacklists, cookies, subdomains, technology fingerprinting, WAF detection, breach exposure, reputation, JavaScript, and trackers.

What You Can Do

On-Demand Scanning

Scan any public domain instantly. Get a normalized 0-100 risk score with categorized findings in seconds.

Continuous Monitoring

Set up scheduled scans (hourly, daily, weekly) for domains you want to track. Get alerts when risk scores change.

Webhook Integration

Receive real-time notifications when scans complete or critical issues are detected. Perfect for CI/CD workflows.

Quick Example

Here's a simple request to scan a domain and retrieve results. The API queues a scan job and responds with 202 Accepted and an integer job_id you can poll.

curl -X POST "https://api.compliancelayer.net/v1/scan" \
  -H "Authorization: Bearer cl_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "domain": "example.com"
  }'

Python SDK

A Python SDK is available as a convenience wrapper around the REST endpoints. It submits the scan and polls until the report is ready, so you don't have to write the polling loop yourself.

pip install compliancelayer

scan() returns a ScanReport object, so read its fields as attributes (report.grade, report.score, report.issues) rather than by key. Each issue exposes severity, finding, and remediation. An AsyncComplianceLayer client is available with the same methods for asyncio code.

Version note: Install SDK 0.1.1 or newer from PyPI (pip install compliancelayer) — earlier releases do not work against the current API. The REST endpoints documented here remain the canonical interface, so for production integrations consider calling them directly using the cURL, Node.js, and Python examples above.

Try It Out

Use the Quickstart Guide to make your first API call in under a minute.

Base URL

All API requests should be made to:

https://api.compliancelayer.net/v1

Authentication

ComplianceLayer uses API keys for authentication. Include your API key in the Authorization header with the Bearer scheme. The X-API-Key header is supported as an alternative.

Authorization: Bearer cl_YOUR_API_KEY

Learn more about authentication →

Response Format

All API responses are JSON-encoded. Successful responses include the requested data. Every error response carries a single detail field. For most errors detail is a human-readable string; for 422 request-validation errors it is an array of { field, message } objects.

HTTP/1.1 401 Unauthorized

{
  "detail": "Invalid or missing authentication"
}

See the full error handling guide →

Next Steps

Quickstart Guide

Get up and running in 5 minutes with our step-by-step guide.

API Reference

Complete reference documentation for all endpoints and parameters.

Webhooks

Set up real-time event notifications for your workflows.

ConnectWise Integration

Auto-create service tickets from security findings. Includes bridge script and setup guide.

Support

Need help? We're here to assist: