# Complytio API

Complytio exposes authenticated customer APIs for the web dashboard and native mobile app.

## Base URL

`https://www.complytio.com`

## API Families

- `GET /api/tasks` — list branch-scoped compliance checks.
- `GET /api/tasks/{id}` — read one task instance.
- `PATCH /api/tasks/{id}` — start or complete an authorised task instance.
- `GET /api/documents` — list branch-scoped document metadata.
- `GET /api/eho` — list branch-scoped EHO visit records.
- `GET /api/reports/stats` — read branch-scoped reporting statistics.

## Machine-readable specification

- OpenAPI 3.1: `https://www.complytio.com/openapi.json` — every operation has a unique
  `operationId`, typed parameters and an `x-required-permissions` extension listing the
  accepted permission scopes (also mirrored in RFC 9728 `scopes_supported` at
  `https://www.complytio.com/.well-known/oauth-protected-resource`).
- Developer portal: `https://www.complytio.com/developers`.
- Agent index: `https://www.complytio.com/llms.txt`.

## Rate limits

Documented API responses include `RateLimit-Limit`, `RateLimit-Remaining` and
`RateLimit-Reset` (seconds until reset). When a quota is exhausted, endpoints answer
`429 Too Many Requests` with `Retry-After`. Headline limits: general customer API 60
requests/minute per user; report statistics 5/minute; uploads 10/minute; support actions
10/10 minutes; AI assistant 20/10 minutes; auth mutations 5/minute.

## Authentication

- Web requests use the authenticated Complytio session cookie.
- Native mobile requests use a short-lived Bearer access token issued by the mobile login flow.
- Native Google, Apple, email-code and passkey sign-in uses the hosted web flow and then
  `POST /api/mobile/auth/exchange` with a single-use code returned to `complytio://auth/callback`.
- Customer APIs require an active authenticated company session and enforce company, branch, and permission scope server-side.
- These endpoints are not anonymous public APIs.

Complytio does not currently operate a public OAuth authorization server or MCP server. Agents should not assume that Google or Apple sign-in tokens can be used directly against these APIs.