Settings & Preferences

Manage alert preferences, API keys, and account settings programmatically. Configure how and when you receive notifications about security events.

Alert Preferences

GET/settings/alert-preferences

Get current alert preferences for your account.

curl "https://api.compliancelayer.net/v1/settings/alert-preferences" \
  -H "Authorization: Bearer cl_YOUR_API_KEY"

These four booleans are the complete set. All of them default to true for a new account. They govern account-wide alerting; the per-domain score-drop threshold is set when you add a monitored domain — see Monitoring.

PUT/settings/alert-preferences

Update alert preferences. This is a partial update: send only the preferences you want to change, and the ones you omit keep their current values. The response is the full set of preferences after the update.

Request Body

ParameterTypeDescription
score_dropbooleanAlert when domain score drops significantly
critical_issuebooleanAlert on critical findings (expired certs, etc.)
cert_expirybooleanAlert when certificates are expiring soon
config_changebooleanAlert on security configuration changes
# Turn off config-change alerts, leave everything else untouched
curl -X PUT "https://api.compliancelayer.net/v1/settings/alert-preferences" \
  -H "Authorization: Bearer cl_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "config_change": false
  }'

API Key Management

POST/auth/api-key/regenerate

Regenerate your API key. The old key will be immediately revoked.

Warning: Regenerating your API key will immediately revoke the old key. All applications using the old key will stop working.
curl -X POST "https://api.compliancelayer.net/v1/auth/api-key/regenerate" \
  -H "Authorization: Bearer cl_YOUR_CURRENT_API_KEY"

Password Management

POST/auth/password/change

Change password for authenticated user. Requires current password for verification.

Request Body

ParameterTypeRequiredDescription
current_passwordstringYesCurrent password for verification
new_passwordstringYesNew password, minimum 12 characters (422 if shorter)
curl -X POST "https://api.compliancelayer.net/v1/auth/password/change" \
  -H "Authorization: Bearer cl_YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "current_password": "old_password_here",
    "new_password": "new_secure_password_123"
  }'
POST/auth/password/reset-request

Request a password reset email. Public endpoint (no authentication required).

curl -X POST "https://api.compliancelayer.net/v1/auth/password/reset-request" \
  -H "Content-Type: application/json" \
  -d '{
    "email": "user@example.com"
  }'
POST/auth/reset-password

Complete a password reset using the token from the email. Public endpoint. The token identifies the account, so no email address is needed.

Request Body

ParameterTypeRequiredDescription
tokenstringYesReset token from the email link
new_passwordstringYesMinimum 12 characters; shorter values are rejected with 422
curl -X POST "https://api.compliancelayer.net/v1/auth/reset-password" \
  -H "Content-Type: application/json" \
  -d '{
    "token": "reset_token_from_email",
    "new_password": "correct-horse-battery-staple"
  }'

A successful reset signs the user in: it returns access and CSRF tokens, sets the session cookies, and marks the email verified. An invalid or expired token returns 400.

Deprecated: POST /auth/password/reset-confirm still exists and additionally requires email in the body, but it is deprecated and does not sign the user in. Use /auth/reset-password for new integrations.

Logout

POST/auth/logout

Logout and clear session cookie (for web applications using JWT tokens).

curl -X POST "https://api.compliancelayer.net/v1/auth/logout" \
  -H "Authorization: Bearer YOUR_JWT_TOKEN"

Best Practices

1. Manage Alerts Based on Environment

async function configureAlertsForEnvironment(env) {
  const preferences = {
    production: {
      score_drop: true,
      critical_issue: true,
      cert_expiry: true,
      config_change: true
    },
    staging: {
      score_drop: false,
      critical_issue: true,
      cert_expiry: true,
      config_change: false
    },
    development: {
      score_drop: false,
      critical_issue: false,
      cert_expiry: false,
      config_change: false
    }
  };

  await updateAlertPreferences(preferences[env]);
}

// Configure for production
await configureAlertsForEnvironment('production');

2. Rotate API Keys Regularly

Implement a key rotation schedule:

async function rotateApiKey() {
  // Generate new key
  const response = await fetch(
    'https://api.compliancelayer.net/v1/auth/api-key/regenerate',
    {
      method: 'POST',
      headers: {
        'Authorization': `Bearer ${process.env.CURRENT_API_KEY}`
      }
    }
  );

  const { api_key } = await response.json();

  // Update environment variables
  console.log('New API Key:', api_key);
  console.log('Update your environment variables immediately!');

  // Return new key for deployment tools
  return api_key;
}

// Rotate every 90 days
const newKey = await rotateApiKey();

3. Use Strong Passwords

  • Minimum 12 characters — the API rejects anything shorter with 422
  • Length beats complexity; a passphrase of several words is both stronger and easier to type
  • Avoid common words and patterns
  • Use a password manager

Related Topics