Public API live — verified over TLS at api.uscomplianceapi.com

USComplianceAPI external integration reference

This page documents customer-facing API-key operations, anonymous website scans, and transcript webhooks. These access models are intentionally separate. Download the machine-readable contract before integrating.

Download OpenAPI 3.1 JSON

1. Public API-key compliance audits

Endpoint: POST https://api.uscomplianceapi.com/functions/complianceAudit

Auth: X-API-Key: TN_COMPLY_…. Send content and jurisdiction; optionally send industry (including retail) and an http(s) asset_url. The handler evaluates supplied content against the active database rulebook and does not fetch asset_url.

Live and verified: the platform serves function endpoints at /functions/<name> and offers no custom path rewrites, so /v1/compliance-audit is not available — use the route above.

curl -X POST https://api.uscomplianceapi.com/functions/complianceAudit \
  -H "Content-Type: application/json" \
  -H "X-API-Key: TN_COMPLY_XXXXXXXXXXXXXXXXXXXXXXXX" \
  -d '{
    "content": "Our retail chatbot says: Act now. Limited-time offer.",
    "jurisdiction": "ALL",
    "industry": "retail"
  }'

Success returns verdict, risk_score, statutes, penalty_exposure_usd, remediation, jurisdiction, and usage. Errors are JSON objects with stable codes: invalid_request (400), invalid_api_key (401), account_inactive (402), rate_limited/quota_exceeded (429), or service_unavailable (503). API keys are never returned or logged.

2. API-key account operations

POST https://api.uscomplianceapi.com/functions/agentSubscribe accepts X-API-Key for account operations; use that header for external integrations. The optional JSON api_key field remains only for existing Client Dashboard compatibility. Requests reject unknown fields: verify/get_logs allow only action and optional api_key; export_audit also allows optional month (YYYY-MM). Verification, activity logs, and CSV exports use the canonical Supabase account/key/activity records, so a rotated canonical key does not require a Base44 mirror.

  • { "action": "verify" } verifies account/plan status. Valid active and trialing accounts may use API-key audit calls. Verification is limited to 30 requests/minute per runtime-observed IP and returns a string-error JSON response with HTTP 429 when limited.
  • { "action": "get_logs" } returns that key account's activity log.
  • { "action": "export_audit", "month": "YYYY-MM" } returns a monthly CSV activity export; omit month for the current month.

Public content audits are durably and atomically limited to 60 accepted requests/minute per account and monthly plan quotas: Starter 1,000; Pro 10,000; Enterprise unlimited. The database records accepted calls and usage together. This is not a substitute for a distributed edge rate limit against unauthenticated or multi-key abuse; that infrastructure remains owner-controlled. Never place an API key in browser-delivered code, a URL, screenshots, or source control. Rotate a compromised key from the account portal.

3. Anonymous website scans

POST https://api.uscomplianceapi.com/functions/runWebsiteAudit accepts { "target_url": "https://…" } without a portal login or X-API-Key. Anonymous calls are IP-limited to 10 requests/minute per runtime-observed IP and are not attached to an account or monthly plan quota. The scanner respects robots rules and does not support JavaScript-rendered pages that expose no readable content or chat endpoint. Successful responses include scan_meta.rulebook_source: "database"; failed database loads return a safe error instead of using bundled rules.

4. Transcript webhook integrations

ManyChat, HubSpot, Meta (Instagram/Facebook DMs), CRMs, Zapier, Make, and n8n can submit conversation transcripts to POST https://api.uscomplianceapi.com/functions/webhookIngest.

Auth is separate: send the deployment-issued x-webhook-secret header, never X-API-Key or a body secret. The integration secret is verified but never returned or persisted with the scan. Successful responses include scan_meta.rulebook_source: "database"; the marker is also retained in the persisted scan payload.

Security and redaction: submit only data needed for the audit. Transcripts may be persisted as scan evidence and used for report generation; redact SSNs, payment-card data, passwords, API keys, and unnecessary personal data before sending.

POST https://api.uscomplianceapi.com/functions/webhookIngest
Content-Type: application/json
x-webhook-secret: <DEPLOYMENT_ISSUED_INGEST_SECRET>

{
  "source": "ManyChat",
  "channel": "Instagram DM",
  "conversation_id": "ig-dm-8891",
  "messages": [
    { "sender": "bot", "text": "How can I help?", "timestamp": "2026-09-12T14:02:11Z" },
    { "sender": "user", "text": "Tell me about your privacy policy", "timestamp": "2026-09-12T14:02:20Z" }
  ]
}

Payloads must include source and a non-empty messages array; each message has exactly sender (bot or user), non-empty text, and optional ISO-8601 timestamp. Optional channel, account_id, and conversation_id are accepted; source/text fields are trimmed and senders are normalized internally. Aliases and unknown fields are rejected. A successful acknowledgement returns success: true, scan result ID, grade, score, finding counts, and processing time. Processing failures can return HTTP 200 with success: false to prevent platform retry storms; authentication and malformed payloads return 401/400.

Contract and deployment status

The downloadable OpenAPI document is the canonical external contract and lists every supported customer surface and its authentication model. Internal admin, billing, scheduler, report-generation, and service-to-service functions are intentionally excluded. All documented endpoints are live at api.uscomplianceapi.com (TLS-verified); the platform provides no custom path rewrites, so /functions/<name> is the canonical route for every surface. A controlled redacted API-key request with jurisdiction: "ALL" and industry: "retail" is the final acceptance check before onboarding customers. The separate webhook acceptance remains required for transcript integrations.