Queue a new scan job for a domain. Returns a job ID for polling. Scans typically complete within 30-60 seconds.

Request Body

curl -X POST "https://api.compliancelayer.net/v1/scan" \
  -H "Authorization: Bearer cl_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com"}'

Get the status of a scan job. Poll this endpoint until status is "completed", then fetch the full report.

Path Parameters

Response Fields

curl "https://api.compliancelayer.net/v1/scan/jobs/job_abc123def456" \
  -H "Authorization: Bearer cl_YOUR_API_KEY"

Get the complete scan report including all findings, module results, and compliance mappings. Only available after scan completes.

curl "https://api.compliancelayer.net/v1/scan/jobs/job_abc123def456/report" \
  -H "Authorization: Bearer cl_YOUR_API_KEY"

List your recent scans with summary results. Limited to 20 most recent scans.

curl "https://api.compliancelayer.net/v1/scan/recent" \
  -H "Authorization: Bearer cl_YOUR_API_KEY"

List your scan history with summary results. Returns up to 100 most recent scans.

curl "https://api.compliancelayer.net/v1/scan/history" \
  -H "Authorization: Bearer cl_YOUR_API_KEY"

Generate a PDF report for a completed scan. Returns a PDF file with executive summary, module scores, findings, and compliance framework mappings. Available on Professional and above plans.

Path Parameters

# Download PDF report
curl "https://api.compliancelayer.net/v1/compliance/reports/job_abc123def456/pdf" \
  -H "Authorization: Bearer cl_YOUR_API_KEY" \
  --output report.pdf

The PDF includes:

• Cover page with domain, grade, scan date, and QR verification code
• Executive summary with issue distribution and priority recommendations
• Module-by-module score breakdown (SSL, DNS, headers, ports, etc.)
• Detailed findings per module
• Compliance framework mapping (SOC 2, PCI DSS, HIPAA, NIST CSF, ISO 27001, CIS Controls v8)

Verify the authenticity of a ComplianceLayer PDF report. Public endpoint — no authentication required. Used by the QR code embedded in every PDF to let recipients confirm the report is genuine and unmodified.

Path Parameters

# Public endpoint - no API key required
curl "https://api.compliancelayer.net/v1/verify/cl_rpt_abc123def456"

List all monitored domains for your account.

curl "https://api.compliancelayer.net/v1/domains" \
  -H "Authorization: Bearer cl_YOUR_API_KEY"

Add a domain to continuous monitoring with scheduled scans.

Request Body

curl -X POST "https://api.compliancelayer.net/v1/domains" \
  -H "Authorization: Bearer cl_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "domain": "example.com",
    "scan_frequency": "daily",
    "alert_threshold": 10
  }'

Remove a domain from monitoring. Stops all scheduled scans.

Trigger an immediate scan for a monitored domain (outside of regular schedule).

List alerts for monitored domains (score drops, critical findings, etc.).

Create a new account. Returns a JWT token for immediate access.

Request Body

Authenticate with email and password. Returns a JWT token.

Get current user profile and subscription information.

Create a Stripe checkout session to start a subscription.

Request Body

Create a Stripe customer portal session to manage subscription.