Base URL
All endpoints are relative to
https://api.clawgrc.com/api/v1. For local development, use
http://localhost:8080/api/v1.
Authentication Method Path Description POST /auth/register — Register a new user (any authenticated Firebase user) POST GET /auth/me — Get the current authenticated user profile GET POST /auth/api-keys — Create a new API key (admin/owner only) POST GET /auth/api-keys — List API keys (admin/owner only) GET DELETE /auth/api-keys/:id — Revoke an API key (admin/owner only) DELETE
Compliance Engine Manage GRC frameworks, controls, evidence artifacts, policies, risks, reports, analytics, and tickets.
Frameworks Method Path Description GET /frameworks — List all frameworks with pagination and optional status filter GET POST /frameworks — Create a new compliance framework POST GET /frameworks/:id — Get framework details with control counts GET PUT /frameworks/:id — Update a framework PUT DELETE /frameworks/:id — Delete a framework DELETE GET /frameworks/:id/controls — List controls belonging to a framework GET
Controls Method Path Description GET /controls — List controls with framework, status, and priority filters GET POST /controls — Create a new control mapped to a framework POST GET /controls/:id — Get control details GET PUT /controls/:id — Update control status, priority, or evidence PUT GET /controls/:id/mappings — List cross-framework control mappings GET POST /controls/:id/mappings — Create a cross-framework control mapping POST
Evidence Method Path Description GET /evidence — List evidence items with status and source filters GET POST /evidence — Create a new evidence record POST GET /evidence/:id — Get evidence details with metadata GET PUT /evidence/:id — Update evidence metadata PUT DELETE /evidence/:id — Soft-delete an evidence item DELETE POST /evidence/upload-url — Get a presigned URL for file upload POST POST /evidence/:id/confirm — Confirm a completed file upload POST GET /evidence/:id/download — Get a presigned download URL GET
Policies Method Path Description GET /policies — List policies with status and type filters GET POST /policies — Create a new policy POST GET /policies/types — List available policy types GET GET /policies/:id — Get policy details with version history GET PUT /policies/:id — Update a policy PUT DELETE /policies/:id — Delete a policy DELETE POST /policies/:id/transition — Transition policy lifecycle status (draft → in_review → approved → published → archived) POST
Risks Method Path Description GET /risks — List risks with category and treatment filters GET POST /risks — Create a new risk entry POST GET /risks/summary — Get risk summary with AIRSS score distribution GET POST /risks/score — Calculate AIRSS score for given risk factors POST GET /risks/:id — Get risk details with linked findings and controls GET PUT /risks/:id — Update risk factors or treatment strategy PUT DELETE /risks/:id — Delete a risk entry DELETE
Reports & Analytics Method Path Description GET /reports — List generated compliance reports GET POST /reports — Generate a new compliance report POST GET /reports/:id — Get report details and download URL GET DELETE /reports/:id — Delete a generated report DELETE GET /analytics/compliance-score — Get overall compliance score and per-framework breakdown GET GET /analytics/control-coverage — Get control coverage statistics GET
Tickets Method Path Description GET /tickets — List remediation tickets with status and priority filters GET POST /tickets — Create a new remediation ticket POST GET /tickets/:id — Get ticket details GET PUT /tickets/:id — Update ticket status, priority, or assignee PUT DELETE /tickets/:id — Delete a ticket DELETE GET /tickets/:id/messages — List messages on a ticket GET POST /tickets/:id/messages — Add a message to a ticket POST
Search Method Path Description GET /search — Full-text search across all entity types (frameworks, controls, evidence, policies, risks, agents) GET
Monitoring Method Path Description POST /monitoring/drift-webhook — Receive configuration drift events from external monitoring systems POST
Organization Method Path Description GET /org — Get organization details GET PUT /org — Update organization settings (admin/owner only) PUT GET /org/members — List organization members GET POST /org/members/invite — Invite a new member (admin/owner only) POST POST /org/invites/accept — Accept an invite (public, token-based) POST PATCH /org/members/:id — Update a member's role (admin/owner only) PATCH DELETE /org/members/:id — Remove a member (admin/owner only) DELETE DELETE /org/invites/:id — Revoke a pending invite (admin/owner only) DELETE
Billing Method Path Description GET /billing/subscription — Get current subscription details GET POST /billing/checkout — Create a Stripe checkout session (admin/owner only) POST POST /billing/portal — Create a Stripe billing portal session (admin/owner only) POST POST /billing/webhook — Stripe webhook endpoint (Stripe-signed, no JWT) POST
Integrations Method Path Description GET /integrations — List connected integrations GET POST /integrations — Connect a new integration POST DELETE /integrations/:provider — Disconnect an integration DELETE PUT /integrations/aws/config — Configure AWS integration settings (admin/owner only) PUT POST /integrations/aws/test — Test AWS connection (admin/owner only) POST
Audit Log Method Path Description GET /audit-log — Query audit log entries with action, actor, resource, and date filters GET GET /audit-log/export — Export audit log as CSV GET
Security Engine Run security assessments, manage findings, and execute vulnerability scans.
Assessments Method Path Description GET /assessments — List assessments with type and status filters GET POST /assessments — Create a new security assessment POST GET /assessments/:id — Get assessment with findings severity summary GET PUT /assessments/:id — Update assessment name, status, or configuration PUT
Findings Method Path Description GET /findings — List findings with severity, status, and assessment filters GET POST /findings — Create a security finding linked to an assessment POST GET /findings/:id — Get finding details with remediation guidance GET PUT /findings/:id — Update finding status or remediation notes PUT
Scans Method Path Description POST /scans — Trigger a security scan (DAST, API, cloud config) POST
Agent Protocol Register AI agents, log interactions with tamper-evident chain hashing, manage trust scores, and connect via MCP.
Agents Method Path Description GET /agents — List registered agents with type and status filters GET POST /agents — Register a new AI agent POST GET /agents/:id — Get agent details with trust score GET PUT /agents/:id — Update agent configuration or status PUT POST /agents/:id/invoke — Invoke a method on a registered agent POST POST /agents/discover — Find agents by capability and trust score POST
Interactions Method Path Description GET /agent-interactions — List agent interactions with chain hash verification GET POST /agent-interactions — Log a new agent interaction (auto chain-hashed) POST GET /agent-interactions/:id — Get interaction with chain integrity status GET
Trust Scoring Method Path Description GET /trust/:agentId/score — Get computed trust score for an agent GET GET /trust/:agentId/factors — Get detailed trust factor breakdown GET POST /trust/recalculate — Recalculate all trust scores for the organization POST
MCP Sessions Method Path Description POST /mcp/sessions — Create an MCP session (handshake) POST GET /mcp/sessions — List active MCP sessions for the organization GET POST /mcp/sessions/:id/messages — Send a tool invocation message to an MCP session POST DELETE /mcp/sessions/:id — Close an MCP session DELETE GET /mcp/tools — List all available MCP tool definitions GET
Common Patterns Pagination All list endpoints support page (1-based) and page_size (max 100) query parameters. Responses include total, page, and page_size fields.
curl -H "Authorization: Bearer $TOKEN" \
"https://api.clawgrc.com/api/v1/frameworks?page=2&page_size=10"Error Responses All errors follow a consistent JSON format:
{
"error": "not_found",
"message": "Framework f47ac10b-... not found",
"status": 404
}RBAC Roles The API Gateway enforces role-based access control. Each route requires specific roles:
Role Set Roles Used For Read (human) owner, admin, auditor, member, viewer GET endpoints Read (with agents) owner, admin, auditor, member, viewer, agent Agent protocol GET Write (human) owner, admin, member POST/PUT/DELETE Write (with agents) owner, admin, member, agent Agent protocol writes Admin only owner, admin API keys, org settings, integrations, billing
Interactive API Docs
Each backend service also exposes interactive documentation. When running locally, visit
http://localhost:8082/docs (Security Engine) or
http://localhost:8083/docs(Agent Protocol) for auto-generated OpenAPI documentation with “Try it out” functionality.