Developers

API documentation

Run External Security and read only AI Buyer Journeys, inspect exact domain usage, and export both report types. The two modules share verified domains but keep separate results and meaning.

Get an API key Jump to endpoints

Authenticate

Create a key on the API page in your account, then send it as a bearer token on every request. The secret is shown once, so store it safely.

Read for free

Listing domains, usage, suites, results, and reports consumes no test allowance.

Server-enforced usage

Pentests use a $50 credit or Continuous quarterly allowance. Each complete Agent workflow uses one monthly agent run credit.

Base URL & authentication

All requests go to https://api.complyeah.com over HTTPS. Authenticate with the Authorization header:

curl https://api.complyeah.com/v1/scans \
  -H "Authorization: Bearer cmply_live_..."

Send an Idempotency-Key on run-creating requests. Ownership verification, product-specific authorization, exact-domain scope, and available quota are checked again by the worker before execution.

Endpoints

Method	Path	Description
GET	/v1/me	Confirm your key and identity.
GET	/v1/catalog	Read the versioned plan, quota, and test catalog.
GET	/v1/domains	List your domains and their verification status.
GET	/v1/domains/{id}/overview	Read independent Security and Agent Readiness state for a domain.
GET	/v1/domains/{id}/entitlements	Read server-calculated domain usage and remaining allowances.
GET	/v1/scans	List your scans.
POST	/v1/scans	Start a scan on a verified domain. A comprehensive scan spends one credit.
GET	/v1/agent-suites	List Agent Readiness suites and schedules.
POST	/v1/agent-suites	Create an editable suite from a bounded journey template.
POST	/v1/domains/{id}/agent-authorization	Record separate Agent Readiness authorization for a verified domain.
DELETE	/v1/domains/{id}/agent-authorization	Revoke Agent Readiness authorization and stop future runs.
POST	/v1/agent-runs	Queue a complete workflow and reserve one agent run credit.
GET	/v1/agent-runs/{id}	Read immutable run status and customer-safe timing metadata.
GET	/v1/agent-runs/{id}/results	Read answers, evidence, assertions, actions, failures, and remediation.
GET	/v1/agent-runs/{id}/report?format=json\|markdown\|pdf	Export an Agent Readiness report.
POST	/v1/agent-runs/{id}/share	Explicitly publish a private, expiring, sanitized report link.
DELETE	/v1/agent-runs/{id}/share	Revoke a published Agent Readiness report link.
GET	/v1/usage	List per-domain quota periods, reservations, and consumption.
GET	/v1/reports	List Security and Agent Readiness reports without a combined score.
GET	/v1/scans/{id}	Retrieve one scan and its status.
GET	/v1/scans/{id}/findings	List a scan's findings, each with a stable id for de-duplication.
POST	/v1/scans/{id}/reverify	Re-check individual fixes for free without spending a pentest allowance.
POST	/v1/scans/{id}/retest	Use this completed pentest's one included full retest within 60 days.

Start a scan

Pass a verified domain_id (from GET /v1/domains) and a tier. Omit the tier for a free shallow posture scan.

curl -X POST https://api.complyeah.com/v1/scans \
  -H "Authorization: Bearer cmply_live_..." \
  -H "Content-Type: application/json" \
  -d '{ "domain_id": "<your-domain-id>", "tier": "comprehensive" }'

Responses

Responses are JSON. Collections are wrapped in a data array so pagination can grow without breaking your integration.

{
  "data": [
    { "id": "…", "status": "complete", "tier": "comprehensive", "created_at": "…" }
  ]
}

Errors

Standard HTTP status codes; the body carries an error message.

401	Missing or invalid API key.
402	A comprehensive scan needs a scan credit.
403	The domain has no current authorization on file.
404	No such scan (or it isn't yours).
422	The domain's ownership isn't verified yet.
429	Rate limit or free-scan limit reached.

Model Context Protocol

Use complyeah from your AI assistant

complyeah-mcp is an open source Model Context Protocol server, so Claude Desktop, IDE assistants, and any MCP-compatible client can list your scans, read findings, and start a pentest, using the same API key. Add it to your client config:

{
  "mcpServers": {
    "complyeah": {
      "command": "npx",
      "args": ["-y", "complyeah-mcp"],
      "env": { "COMPLYEAH_API_KEY": "cmply_live_..." }
    }
  }
}

Tools: whoami, list_domains, list_scans, get_scan, get_findings, and trigger_scan. The key is read from the environment, never passed through the model. View on npm.

Get your API key

Create a key in your account, verify a domain, and run your first pentest from the command line.

Open your account