17 AUG 2026API
Public API v1 and signed webhooks
Pull coverage, findings, the ledger and generated documents into your own systems, and stop polling: six events are delivered with an HMAC signature and retried for hours.
- A scan requested over the API is capacity-metered like any other, returning 409 rather than pretending.
The API cannot declare compliance.No endpoint resolves a finding, signs off a criterion or sets a compliance status. Those are earned by evidence.