Public audit API live — verified over TLS at api.uscomplianceapi.com

USComplianceAPI external integration reference

This page documents customer-facing API-key operations, anonymous website scans, and transcript webhooks. These access models are intentionally separate. Download the machine-readable contract before integrating.

Download OpenAPI 3.1 JSON

1. Public API-key compliance audits

Endpoint: POST https://api.uscomplianceapi.com/functions/complianceAudit

Auth: X-API-Key: TN_COMPLY_…. Send content and jurisdiction; optionally send industry (including retail) and an http(s) asset_url. The handler evaluates supplied content against the active database rulebook and does not fetch asset_url.

Live and verified: the platform serves function endpoints at /functions/<name> and offers no custom path rewrites, so /v1/compliance-audit is not available — use the route above.

curl -X POST https://api.uscomplianceapi.com/functions/complianceAudit \
  -H "Content-Type: application/json" \
  -H "X-API-Key: TN_COMPLY_XXXXXXXXXXXXXXXXXXXXXXXX" \
  -d '{
    "content": "Our retail chatbot says: Act now. Limited-time offer.",
    "jurisdiction": "ALL",
    "industry": "retail"
  }'

Success returns verdict, risk_score, statutes, penalty_exposure_usd, remediation, jurisdiction, and usage. Errors are JSON objects with stable codes: invalid_request (400), invalid_api_key (401), account_inactive (402), rate_limited/quota_exceeded (429), or service_unavailable (503). API keys are never returned or logged.

2. API-key account operations

POST https://api.uscomplianceapi.com/functions/agentSubscribe accepts X-API-Key for account operations; use that header for external integrations. The optional JSON api_key field remains only for existing Client Dashboard compatibility. Requests reject unknown fields: verify/get_logs allow only action and optional api_key; export_audit also allows optional month (YYYY-MM). Verification, activity logs, and CSV exports use the canonical Supabase account/key/activity records, so a rotated canonical key does not require a Base44 mirror.

  • { "action": "verify" } verifies account/plan status. Valid active and trialing accounts may use API-key audit calls. Verification is limited to 30 requests/minute per runtime-observed IP and returns a string-error JSON response with HTTP 429 when limited.
  • { "action": "get_logs" } returns that key account's activity log.
  • { "action": "export_audit", "month": "YYYY-MM" } returns a monthly CSV activity export; omit month for the current month.

Public content audits are durably and atomically limited to 60 accepted requests/minute per account and monthly plan quotas: Starter 1,000; Pro 10,000; Enterprise unlimited. The database records accepted calls and usage together. This is not a substitute for a distributed edge rate limit against unauthenticated or multi-key abuse; that infrastructure remains owner-controlled. Never place an API key in browser-delivered code, a URL, screenshots, or source control. Rotate a compromised key from the account portal.

3. Anonymous website scans

POST https://api.uscomplianceapi.com/functions/runWebsiteAudit accepts { "target_url": "https://…" } without a portal login or X-API-Key. Anonymous calls are IP-limited to 10 requests/minute per runtime-observed IP and are not attached to an account or monthly plan quota. The scanner respects robots rules and does not support JavaScript-rendered pages that expose no readable content or chat endpoint. Successful responses include scan_meta.rulebook_source: "database"; failed database loads return a safe error instead of using bundled rules.

4. Transcript webhook integrations

ManyChat, HubSpot, Meta (Instagram/Facebook DMs), CRMs, Zapier, Make, and n8n can submit conversation transcripts to POST https://api.uscomplianceapi.com/functions/webhookIngest.

Credential lifecycle: a customer creates a customer-created per-integration credential in the signed-in account portal. It uses account binding to that integration, shown as plaintext only during a one-time plaintext reveal, and then protected with hash-only storage plus a non-secret display prefix. Each integration supports independent rotation and revocation; credentials are never recoverable. Invalid, revoked, and unknown credentials receive the same non-enumerating 401 response. Authenticated requests are limited to 60 requests per minute per account and integration; an exhausted integration receives a sanitized HTTP 429 response with no account or credential details and may include Retry-After. Limiter failure fails closed with a sanitized HTTP 503.

Auth and scope: send the credential only in the x-webhook-secret header, never X-API-Key or a body field. This credential grants transcript-write-only access: it authenticates transcript ingestion for its bound account and integration, not general API access. Successful responses include scan_meta.rulebook_source: "database"; the marker is also retained in the persisted scan payload.

Security and redaction: submit only data needed for the audit. Transcripts may be persisted as scan evidence and used for report generation; redact SSNs, payment-card data, passwords, API keys, and unnecessary personal data before sending.

Pending owner-controlled rollout: this per-integration webhook credential flow is not yet published or migrated. Provisioning starts only after migration 020 (020_webhook_integrations.sql) is applied and the lifecycle and webhook functions (webhookIntegrations and webhookIngest) are applied and published. No provider migration may occur before those prerequisites are complete. After that precondition, the owner sequence is: provision a credential, update the provider, run a redacted test, observe attribution for the bound account/integration (account/integration attribution), then retire the shared path under owner control. Do not place the fake placeholder above in a provider; it is documentation only.

POST https://api.uscomplianceapi.com/functions/webhookIngest
Content-Type: application/json
x-webhook-secret: <FAKE_CREDENTIAL_NOT_REAL>

{
  "source": "ManyChat",
  "channel": "Instagram DM",
  "conversation_id": "ig-dm-8891",
  "messages": [
    { "sender": "bot", "text": "How can I help?", "timestamp": "2026-09-12T14:02:11Z" },
    { "sender": "user", "text": "Tell me about your privacy policy", "timestamp": "2026-09-12T14:02:20Z" }
  ]
}

Payloads must include source and a non-empty messages array; each message has exactly sender (bot or user), non-empty text, and optional ISO-8601 timestamp. Optional channel, account_id, and conversation_id are accepted; source/text fields are trimmed and senders are normalized internally. Aliases and unknown fields are rejected. A successful acknowledgement returns success: true, scan result ID, grade, score, finding counts, and processing time. Processing failures can return HTTP 200 with success: false to prevent platform retry storms; authentication and malformed payloads return 401/400, and an exhausted account/integration rate limit returns a sanitized 429.

Contract and deployment status

The downloadable OpenAPI document is the canonical external contract and lists every supported customer surface and its authentication model. Internal admin, billing, scheduler, report-generation, and service-to-service functions are intentionally excluded. The public audit and anonymous website-scan endpoints are live at api.uscomplianceapi.com (TLS-verified); this does not claim that the pending per-integration webhook credential flow is live. The platform provides no custom path rewrites, so /functions/<name> is the canonical route for each published surface. A controlled redacted API-key request with jurisdiction: "ALL" and industry: "retail" is the final acceptance check before onboarding customers. The separate webhook acceptance remains required for transcript integrations.