API Reference

Queue a new scan job for a domain. Returns 202 Accepted with an integer job_id for polling. Most scans complete in roughly 10-30 seconds.

Request Body

curl -X POST "https://api.compliancelayer.net/v1/scan" \
  -H "Authorization: Bearer cl_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"domain": "example.com"}'

Public scanner — no API key required. Runs a scan and returns a limited report synchronously (score, grade, module summaries, and top_issues). Rate limited to 5 scans per hour per IP.

curl -X POST "https://api.compliancelayer.net/v1/scan/free" \
  -H "Content-Type: application/json" \
  -d '{
    "domain": "example.com",
    "authorization": {"attested": true, "basis": "owner"}
  }'

# The authorization object is required on this endpoint. Omitting it, or
# sending "attested": false, returns 403. Basis must be one of:
# owner | written_authorization | authorized_agent

Get the status of a scan job. Poll this endpoint until status is "completed", then fetch the full report.

Path Parameters

Response Fields

curl "https://api.compliancelayer.net/v1/scan/jobs/12345" \
  -H "Authorization: Bearer cl_YOUR_API_KEY"

Get the complete scan report: per-module results, every issue, and compliance framework mappings. Returns 409 Conflict if the scan hasn't finished yet.

curl "https://api.compliancelayer.net/v1/scan/jobs/12345/report" \
  -H "Authorization: Bearer cl_YOUR_API_KEY"

Each entry in issues — and in every module's issues array — has exactly three fields: severity, finding, and remediation. Grades are A, B, C, D, or F; there are no + or - variants.

List your most recent scans with summary results. Takes no query parameters.

curl "https://api.compliancelayer.net/v1/scan/recent" \
  -H "Authorization: Bearer cl_YOUR_API_KEY"

List your scan history. Same response shape as /scan/recent — a scans array plus a total count.

Query Parameters

There is no offset, page, or cursor parameter — limit is the only control, so you cannot page beyond the most recent entries.

curl "https://api.compliancelayer.net/v1/scan/history?limit=100" \
  -H "Authorization: Bearer cl_YOUR_API_KEY"

Scan up to 50 domains in parallel and get them back ranked by risk. This is a quick 4-module assessment (DNS/email, SSL, headers, ports) rather than the full 15-module scan. Each domain consumes one scan from your monthly quota.

Request Body

curl -X POST "https://api.compliancelayer.net/v1/batch/scan" \
  -H "Authorization: Bearer cl_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "domains": ["vendor1.com", "vendor2.com"],
    "sort_by": "risk"
  }'

Compare 2-5 domains side by side. Returns ranked results with a winner, the score gap, and a per-module comparison. Also a 4-module assessment, and also 1 scan of quota per domain.

Request Body

Generate a PDF report for a completed scan. Returns a PDF file with executive summary, module scores, findings, and compliance framework mappings. Available on every plan, including Free — exports are bounded only by your scan quota, since a report can only be generated for a scan you have already run.

Path Parameters

# Download PDF report
curl "https://api.compliancelayer.net/v1/compliance/reports/12345/pdf" \
  -H "Authorization: Bearer cl_YOUR_API_KEY" \
  --output report.pdf

The PDF includes:

• Cover page with domain, grade, scan date, and QR verification code
• Executive summary with issue distribution and priority recommendations
• Module-by-module score breakdown (SSL, DNS, headers, ports, etc.)
• Detailed findings per module
• Compliance framework mapping (SOC 2, PCI DSS, HIPAA, NIST CSF, ISO 27001, CIS Controls v8)

Verify the authenticity of a ComplianceLayer PDF report. Public endpoint — no authentication required. Used by the QR code embedded in every PDF to let recipients confirm the report is genuine. Rate limited to 20 requests per minute per IP.

Path Parameters

# Public endpoint - no API key required
curl "https://api.compliancelayer.net/v1/verify/CL-7K2M9XQ4"

A malformed report ID returns the same 404 as an unknown one, so the ID format isn't leaked. There is no valid boolean in the response — a 200 means the report is genuine, a 404 means it isn't.

Public SVG security badge for a domain, suitable for embedding in a README or website. No authentication required. Badges are opt-in: the endpoint serves only domains whose owner has published a badge, and returns 404 otherwise. The default rendering is the ComplianceLayer card; the optional style query parameter accepts flat for a compact shields-style strip.

curl "https://api.compliancelayer.net/v1/badge/example.com.svg?style=flat"

Badge data as JSON (domain, grade, score, source). Unlike the SVG variant this endpoint requires authentication, and it answers only for domains monitored by your own account. The grade and score are read from the domain's last completed scan.

curl "https://api.compliancelayer.net/v1/badge/example.com.json" \
  -H "Authorization: Bearer cl_YOUR_API_KEY"

List all monitored domains for your account, along with how many of your plan's domain slots are in use.

curl "https://api.compliancelayer.net/v1/domains" \
  -H "Authorization: Bearer cl_YOUR_API_KEY"

Add a domain to continuous monitoring with scheduled scans.

Request Body

curl -X POST "https://api.compliancelayer.net/v1/domains" \
  -H "Authorization: Bearer cl_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "domain": "example.com",
    "scan_frequency": "daily",
    "alert_on_score_drop": true,
    "alert_threshold": 10
  }'

Publish or unpublish the public security badge for a monitored domain. Badges are opt-in: until published, GET /badge/:domain.svg returns 404 for the domain. See Security Badges.

curl -X PATCH "https://api.compliancelayer.net/v1/domains/42/badge" \
  -H "Authorization: Bearer cl_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"badge_enabled": true}'

Remove a domain from monitoring. Stops all scheduled scans. domain_id is the integer id from GET /domains.

Trigger an immediate scan for a monitored domain, outside its regular schedule. Consumes one scan from your monthly quota.

List alerts for monitored domains (score drops, critical findings, certificate expiry, config changes).

Query Parameters

curl "https://api.compliancelayer.net/v1/domains/alerts?unread_only=true&limit=20" \
  -H "Authorization: Bearer cl_YOUR_API_KEY"

Mark a single alert as read. alert_id is an integer.

Mark every alert on the account as read.

Delete an alert.

Alert counts for the account: total, unread, by_severity, and by_type.

Get which alert types are enabled: score_drop, critical_issue, cert_expiry, config_change.

Update alert preferences. Body takes the same four booleans, each defaulting to true.

curl -X PUT "https://api.compliancelayer.net/v1/settings/alert-preferences" \
  -H "Authorization: Bearer cl_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "score_drop": true,
    "critical_issue": true,
    "cert_expiry": true,
    "config_change": false
  }'

List your webhook endpoints.

Create a webhook endpoint. Maximum 1 active endpoint on Free, 5 on paid plans.

Request Body

The response includes the generated signing secret along with id, is_active, consecutive_failures, and delivery timestamps.

Get a single webhook endpoint. endpoint_id is an integer.

Update a webhook endpoint. All fields optional: url, description, enabled_events, is_active.

Delete a webhook endpoint.

Send a test event to the endpoint. Optional body field event_type (default scan.completed); an unrecognized value returns 400.

Recent delivery attempts for an endpoint. Optional limit query parameter (default 50).

List the event types you can subscribe to.

Delivery success and failure counts across your endpoints. Optional hours query parameter (default 24).

Create a new account. The response includes your api_key directly, so you can scan immediately without visiting the dashboard.

Request Body

Authenticate with email and password. Returns access_token, token_type, expires_in (86400 seconds), and csrf_token — no user object.

Get the current account: id, email, plan, api_key, scans_this_month, scan_limit, scans_remaining, domain_limit, and subscription status.

Issue a new API key. There is one key per account and no create, list, or revoke operation — regenerating invalidates the previous key instantly, with no overlap window.

Invalidate the current session. Does not affect your API key.

Change the password for the signed-in account.

Complete a password reset using a reset token and a new_password of at least 12 characters.

Usage totals for a period. Optional start_date and end_date query parameters in YYYY-MM-DD form.

Your plan's limits and current consumption, including whether you can still make requests and run scans right now.

Month-by-month usage history. Optional months query parameter (default 6).

Request counts broken down per endpoint. Optional days query parameter (default 30).

Create a Stripe checkout session to start a subscription.

Request Body

curl -X POST "https://api.compliancelayer.net/v1/billing/checkout" \
  -H "Authorization: Bearer cl_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "plan": "professional",
    "success_url": "https://yourapp.com/billing/success",
    "cancel_url": "https://yourapp.com/billing/cancel",
    "yearly": false
  }'

Omitting success_url or cancel_url returns 422 — both are required.

Create a Stripe customer portal session to manage an existing subscription.

Current subscription state: plan, status, scans_this_month, scan_limit, and domain_limit.

Public list of plans with pricing, scan allowances, rate limits, and feature flags. No authentication required.