Developers

Build against Complytio.

The same authenticated APIs that power the Complytio dashboard and native mobile app — documented with an OpenAPI specification, declared permission scopes and standard rate-limit headers.

Open the OpenAPI spec Read the API overview

Authentication

• Web clients use the authenticated Complytio session cookie (Auth.js).
• Mobile clients send a short-lived Bearer access token issued by the mobile login flow.
• Every endpoint enforces server-side company, branch and permission scoping.
• These are not anonymous public APIs; there is no public OAuth authorization server yet.

Rate limits

Responses include RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset headers; exhausted quotas answer 429 with Retry-After.

General customer API: 60 requests / minute / user
Report statistics: 5 requests / minute
File uploads: 10 requests / minute
Support actions: 10 requests / 10 minutes
AI assistant actions: 20 requests / 10 minutes
Auth mutations: 5 requests / minute

Documented endpoints

GET /api/tasks
GET · PATCH /api/tasks/{id}
GET /api/documents
GET /api/eho
GET /api/reports/stats

Each operation in the spec carries a unique operationId, typed parameters and an x-required-permissions extension listing the accepted scopes.

Machine-readable resources

/openapi.jsonMachine-readable API surface (operationIds, schemas, permissions)
/api.mdEndpoint families and auth model in plain text
/.well-known/oauth-protected-resourceRFC 9728 resource + scopes_supported declaration
/.well-known/api-catalogRFC 9727 linkset of documented APIs
/llms.txtProduct summary and URL map for AI agents
/sitemap.xmlAll public pages

Agent guidance

Request pages with Accept: text/markdown to get markdown variants of this site's key pages.

Unknown URLs return a real HTTP 404 — see llms.txt for the full index rather than probing paths.

Google or Apple sign-in tokens cannot be used directly against the API.

Quickstart

# Fetch the machine-readable API surface
curl https://www.complytio.com/openapi.json

# Authenticate like the mobile app does (after mobile login)
curl -H "Authorization: Bearer <access-token>" \
     "https://www.complytio.com/api/tasks?branchId=<id>&limit=50"

# Ask any page for markdown instead of HTML
curl -H "Accept: text/markdown" https://www.complytio.com/pricing

Talk to us about integrations Contact

Authentication

• Web clients use the authenticated Complytio session cookie (Auth.js).

• Mobile clients send a short-lived Bearer access token issued by the mobile login flow.

• Every endpoint enforces server-side company, branch and permission scoping.

• These are not anonymous public APIs; there is no public OAuth authorization server yet.

Rate limits

Responses include RateLimit-Limit, RateLimit-Remaining and RateLimit-Reset headers; exhausted quotas answer 429 with Retry-After.

General customer API

60 requests / minute / user

Report statistics

5 requests / minute

File uploads

10 requests / minute

Support actions

10 requests / 10 minutes

AI assistant actions

20 requests / 10 minutes

Auth mutations

5 requests / minute

Machine-readable resources

/openapi.jsonMachine-readable API surface (operationIds, schemas, permissions)

/api.mdEndpoint families and auth model in plain text

/.well-known/oauth-protected-resourceRFC 9728 resource + scopes_supported declaration

/.well-known/api-catalogRFC 9727 linkset of documented APIs

/llms.txtProduct summary and URL map for AI agents

/sitemap.xmlAll public pages

# Fetch the machine-readable API surface curl https://www.complytio.com/openapi.json # Authenticate like the mobile app does (after mobile login) curl -H "Authorization: Bearer <access-token>" \ "https://www.complytio.com/api/tasks?branchId=<id>&limit=50" # Ask any page for markdown instead of HTML curl -H "Accept: text/markdown" https://www.complytio.com/pricing