Quickstart Guide

Get started with ComplianceLayer in under 5 minutes. This guide will walk you through creating an account, getting your API key, running your first scan, and polling for results.

Want a scan right now?

Two shortcuts let you see real output before you write any integration code:

• No key at all: POST /v1/scan/free is a public endpoint that runs a scan and returns a limited report synchronously. It's rate-limited to 5 scans per hour per IP, and it requires an authorization object asserting that you own the target domain or are authorized to assess it.
• Signing up: POST /v1/auth/signup returns your api_key in the response body, so you can go from signup to first authenticated scan in one script.

# No API key required, but you must assert your authority to
# scan the target. Valid basis values: owner, written_authorization,
# authorized_agent. Requests without this are refused with 403.
curl -X POST "https://api.compliancelayer.net/v1/scan/free" \
  -H "Content-Type: application/json" \
  -d '{
    "domain": "example.com",
    "authorization": {"attested": true, "basis": "owner"}
  }'

# Response (abbreviated)
{
  "domain": "example.com",
  "score": 78,
  "grade": "B",
  "scanned_at": "2026-07-29T17:08:37Z",
  "total_issues": 25,
  "critical_issues": 1,
  "high_issues": 3,
  "top_issues": [
    {
      "severity": "critical",
      "finding": "HTTPS is not accessible (only HTTP available)",
      "remediation": "Enable HTTPS with a valid SSL certificate."
    }
  ]
}

Step 1: Create an Account

Sign up for a free account at compliancelayer.net/signup. The free tier includes:

• 10 scans per month
• 1 monitored domain
• 120 requests per minute (also 1,200 per hour, 5,000 per day, 5 concurrent)
• Full scan detail from all 15 security modules

Step 2: Get Your API Key

Your account has exactly one API key. Sign in at compliancelayer.net/login and open Settings → API Keys to view it. The key starts with cl_. If you created the account through POST /v1/auth/signup, the same key was already returned to you in the response body.

Step 3: Make Your First Request

Submit a scan request for any public domain. The API responds with 202 Accepted and an integer job_id that you'll use to poll for results.

# Submit scan request
curl -X POST "https://api.compliancelayer.net/v1/scan" \
  -H "Authorization: Bearer cl_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "domain": "example.com"
  }'

# Response — HTTP 202 Accepted
{
  "job_id": 12345,
  "legacy_scan_id": null,
  "domain": "example.com",
  "status": "queued",
  "source": "api",
  "queued_at": "2026-07-29T17:08:27Z",
  "started_at": null,
  "completed_at": null,
  "failure_reason": null,
  "requested_modules": [
    "dns_email", "ssl", "headers", "ports", "whois",
    "dnssec", "blacklists", "cookies", "subdomains", "tech",
    "waf", "breach", "reputation", "js", "tracker"
  ],
  "result": null
}

Step 4: Poll for Results

Most scans finish in roughly 10-30 seconds, though a slow or unresponsive domain can take longer. Poll the job status endpoint until the status field is completed, then fetch the full report.

# Check job status
curl "https://api.compliancelayer.net/v1/scan/jobs/12345" \
  -H "Authorization: Bearer cl_YOUR_API_KEY"

# Response (when completed)
{
  "job_id": 12345,
  "domain": "example.com",
  "status": "completed",
  "source": "api",
  "queued_at": "2026-07-29T17:08:27Z",
  "started_at": "2026-07-29T17:08:30Z",
  "completed_at": "2026-07-29T17:08:37Z",
  "failure_reason": null,
  "result": {
    "score": 78,
    "grade": "B",
    "risk_level": "low_medium",
    "total_issues": 25,
    "critical_issues": 1,
    "high_issues": 3,
    "medium_issues": 3,
    "low_issues": 4,
    "scan_duration_ms": 6693
  }
}

Step 5: Get the Full Report

Once status is completed, fetch GET /v1/scan/jobs/{job_id}/report for the detailed report: per-module scores and detail, every issue, compliance framework mappings, and recommendations. Requesting the report before the job finishes returns 409 Conflict.

curl "https://api.compliancelayer.net/v1/scan/jobs/12345/report" \
  -H "Authorization: Bearer cl_YOUR_API_KEY"

Understanding the Response

The full report includes:

• score (0-100): Overall security score, higher is better
• grade: Letter grade derived from the score — one of A, B, C, D, or F
• risk_level: e.g. low, low_medium, medium, high, critical
• modules: One entry per scanner (dns_email, ssl, headers, ports, and the rest of the 15), each with score, grade, weight, issues, and a module-specific detail object
• issues: All findings across modules. Each entry is { severity, finding, remediation }
• compliance: Framework mappings under the keys summary, categories, soc2, pci_dss, hipaa, nist, iso27001, and cis
• recommendations: Actionable steps to improve your score
• Plus total_issues, critical_issues, high_issues, medium_issues, low_issues, scanned_at, and scan_duration_ms

Rate Limits and Quotas

Two separate limits apply, and they fail differently:

• Request rate — the free plan allows 120 requests per minute (1,200 per hour, 5,000 per day, 5 concurrent). Exceeding it returns 429 with a retry_after field in the body; retrying after that delay succeeds.
• Scan quota — the free plan allows 10 scans per month and 1 monitored domain. Exhausting it also returns 429, but with no Retry-After. Retrying will not help until the next billing period or a plan upgrade.

Most responses carry x-ratelimit-limit, x-ratelimit-remaining, and x-ratelimit-reset headers — read them rather than assuming a fixed budget. See the error handling guide for how to tell the two 429s apart.

Alternative: Use via RapidAPI

ComplianceLayer is also available on the RapidAPI marketplace. If you prefer to manage subscriptions and billing through RapidAPI, subscribe there and use their unified API key instead. The endpoints and responses are identical.

Next Steps