Public audit API live — verified over TLS at api.uscomplianceapi.com

USComplianceAPI external integration reference

This page documents customer-facing API-key operations, anonymous website scans, and transcript webhooks. These access models are intentionally separate. Download the machine-readable contract before integrating.

Download OpenAPI 3.1 JSON

1. Public API-key compliance audits

Endpoint: POST https://api.uscomplianceapi.com/functions/complianceAudit

Auth: X-API-Key: TN_COMPLY_…. Send content and jurisdiction; optionally send industry (including retail) and an http(s) asset_url. The handler evaluates supplied content against the active database rulebook and does not fetch asset_url.

Live and verified: the platform serves function endpoints at /functions/<name> and offers no custom path rewrites, so /v1/compliance-audit is not available — use the route above.

curl -X POST https://api.uscomplianceapi.com/functions/complianceAudit \
  -H "Content-Type: application/json" \
  -H "X-API-Key: TN_COMPLY_XXXXXXXXXXXXXXXXXXXXXXXX" \
  -d '{
    "content": "Our retail chatbot says: Act now. Limited-time offer.",
    "jurisdiction": "ALL",
    "industry": "retail"
  }'

Success returns verdict, risk_score, statutes, penalty_exposure_usd, remediation, jurisdiction, and usage. Errors are JSON objects with stable codes: invalid_request (400), invalid_api_key (401), account_inactive (402), rate_limited/quota_exceeded (429), or service_unavailable (503). API keys are never returned or logged.

2. API-key account operations

POST https://api.uscomplianceapi.com/functions/agentSubscribe accepts X-API-Key for account operations; use that header for external integrations. The optional JSON api_key field remains only for existing Client Dashboard compatibility. Requests reject unknown fields: verify/get_logs allow only action and optional api_key; export_audit also allows optional month (YYYY-MM). Verification, activity logs, and CSV exports use the canonical Supabase account/key/activity records, so a rotated canonical key does not require a Base44 mirror.

  • { "action": "verify" } verifies account/plan status. Valid active and trialing accounts may use API-key audit calls. Verification is limited to 30 requests/minute per runtime-observed IP and returns a string-error JSON response with HTTP 429 when limited.
  • { "action": "get_logs" } returns that key account's activity log.
  • { "action": "export_audit", "month": "YYYY-MM" } returns a monthly CSV activity export; omit month for the current month.

Public content audits are durably and atomically limited to 60 accepted requests/minute per account and monthly plan quotas: Starter 1,000; Pro 10,000; Enterprise unlimited. The database records accepted calls and usage together. This is not a substitute for a distributed edge rate limit against unauthenticated or multi-key abuse; that infrastructure remains owner-controlled. Never place an API key in browser-delivered code, a URL, screenshots, or source control. Rotate a compromised key from the account portal.

3. Anonymous website scans

POST https://api.uscomplianceapi.com/functions/runWebsiteAudit accepts { "target_url": "https://…" } without a portal login or X-API-Key. Anonymous calls are IP-limited to 10 requests/minute per runtime-observed IP and are not attached to an account or monthly plan quota. The scanner respects robots rules and does not support JavaScript-rendered pages that expose no readable content or chat endpoint. Successful responses include scan_meta.rulebook_source: "database"; failed database loads return a safe error instead of using bundled rules.

4. Transcript webhook integrations

ManyChat, HubSpot, Meta (Instagram/Facebook DMs), CRMs, Zapier, Make, and n8n can submit conversation transcripts to POST https://api.uscomplianceapi.com/functions/webhookIngest.

Credential lifecycle: a customer creates a customer-created per-integration credential in the signed-in account portal. It uses account binding to that integration, shown as plaintext only during a one-time plaintext reveal, and then protected with hash-only storage plus a non-secret display prefix. Each integration supports independent rotation and revocation; credentials are never recoverable. Invalid, revoked, and unknown credentials receive the same non-enumerating 401 response. Authenticated requests are limited to 60 requests per minute per account and integration; an exhausted integration receives a sanitized HTTP 429 response with no account or credential details and may include Retry-After. Limiter failure fails closed with a sanitized HTTP 503.

Auth and scope: send the credential only in the x-webhook-secret header, never X-API-Key or a body field. This credential grants transcript-write-only access: it authenticates transcript ingestion for its bound account and integration, not general API access. Successful responses include scan_meta.rulebook_source: "database"; the marker is also retained in the persisted scan payload.

Security and redaction: submit only data needed for the audit. Transcripts may be persisted as scan evidence and used for report generation; redact SSNs, payment-card data, passwords, API keys, and unnecessary personal data before sending.

Deployment prerequisites complete: the owner reported on 2026-09-22 that migration 020 (020_webhook_integrations.sql) was applied and the lifecycle and webhook functions (webhookIntegrations and webhookIngest) were published. Customer cutover is still pending. The owner sequence is: provision a credential, update the provider, run a redacted test, observe attribution for the bound account/integration (account/integration attribution), then retire the shared path under owner control. Do not place the fake placeholder above in a provider; it is documentation only.

POST https://api.uscomplianceapi.com/functions/webhookIngest
Content-Type: application/json
x-webhook-secret: <FAKE_CREDENTIAL_NOT_REAL>

{
  "source": "ManyChat",
  "channel": "Instagram DM",
  "conversation_id": "ig-dm-8891",
  "messages": [
    { "sender": "bot", "text": "How can I help?", "timestamp": "2026-09-12T14:02:11Z" },
    { "sender": "user", "text": "Tell me about your privacy policy", "timestamp": "2026-09-12T14:02:20Z" }
  ]
}

Payloads must include source and a non-empty messages array; each message has exactly sender (bot or user), non-empty text, and optional timestamp in ISO-8601/RFC3339 or ManyChat/Facebook YYYY-MM-DD HH:mm:ss format. Optional channel, account_id, and conversation_id are accepted; source/text fields are trimmed and senders are normalized internally. Aliases and unknown fields are rejected. A successful acknowledgement returns success: true, scan result ID, grade, score, finding counts, and processing time. Processing failures can return HTTP 200 with success: false to prevent platform retry storms; authentication and malformed payloads return 401/400, and an exhausted account/integration rate limit returns a sanitized 429.

Contract and deployment status

The downloadable OpenAPI document is the canonical external contract and lists every supported customer surface and its authentication model. Internal admin, billing, scheduler, report-generation, and service-to-service functions are intentionally excluded. The public audit, anonymous website-scan, and published webhook function routes are available at api.uscomplianceapi.com; customer webhook onboarding is still pending credential provisioning and provider migration. The platform provides no custom path rewrites, so /functions/<name> is the canonical route for each published surface. A controlled redacted API-key request with jurisdiction: "ALL" and industry: "retail" is the final acceptance check before onboarding customers. The separate redacted webhook acceptance and account/integration attribution check remain required for transcript integrations.