AgentCompliant Platform Reference

The fastest path from zero to a live compliance decision is a single POST to the Comply engine.

curl -sS -X POST "https://agentcompliant.ai/api/v1/compliance/check-action" \
  -H "Authorization: Bearer ac_live_YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "orgId": "org_123",
    "agentId": "agent_456",
    "actionType": "tool_call",
    "actionName": "send_email",
    "resourceType": "external_api",
    "input_summary": "Drafting outbound message to customer"
  }'

The response includes a decision (allow, warn, or block), the triggered rules, and a request ID you can match against the audit trail.

• API keys — Authorization: Bearer ac_live_…. Used for engine routes (agents, governance, compliance). Cannot call gateway-owned routes such as /v1/billing or/v1/api-keys.
• Clerk JWT — Authorization: Bearer <session_jwt>. Used by the dashboard; the gateway requires organization context.

All public routes are versioned under /v1. The interactive OpenAPI 3.1 spec is rendered at the bottom of this page and is also served at /api/openapi/gateway.

All plans include a 14-day free trial.

Agents move through five stages: planned → active → deprecated → retired → archived. Every transition is recorded as an event.

{
  "to_stage": "deprecated",
  "reason": "Superseded by v2 retrieval agent",
  "successor_agent_id": "agent_abc123",
  "metadata": { "ticket": "GOV-481" }
}

Declare upstream/downstream dependencies between agents and the systems they touch, then query the impact graph.

A 16-pattern detector with compound-boost scoring runs before any tool call. Severities arenone, low, medium, high, and critical. When the prompt_injection_detection flag is enabled, requests at high orcritical are blocked.

{
  "decision": "block",
  "severity": "high",
  "score": 0.87,
  "patterns_matched": ["override_instructions", "exfiltrate_secrets"],
  "compound_boost": 0.15,
  "request_id": "req_01HW…"
}

Build context-aware allow/deny policies (IP ranges, time windows, principal claims, resource tags) and evaluate them per call.

Define data-retention rules per resource type, then trigger immediate enforcement or rely on the scheduled run.

The kill switch, human-in-the-loop approvals, and anomaly detection remain available on every tier. See the dedicated guides for kill switch, HITL, and anomaly detection.

Per-call scan across toxicity, hate, harassment,self_harm, sexual, violence, profanity, andpii. Industry-gated detectors add PHI patterns for healthcare and PCI for financial. Detected PII is auto-redacted in content_preview before persistence.

v1 covers three dimensions — gender, race, and age — using keyword/lexicon analysis on agent outputs. Runs post-evaluation on a BullMQ worker so the synchronous path stays fast.

Z-score detection over daily baselines on latency, error_rate, andcompliance_score. Severities map to standard deviations:

• < 1σ — info
• 1–2σ — warn
• 2–3σ — critical
• > 3σ — emergency

Six dimensions roll up to a single grade: compliance, bias, drift,safety, prompt_injection, governance. Aggregated weekly via a BullMQ cron, with a SHA-512 verification hash for tamper evidence.

Generate audit-ready Markdown documents on demand — system cards, model cards, DPAs, privacy policies, safety cases, and transparency reports. Each artifact ships with a SHA-512 verification hash.

Supported types: system_card, model_card, dpa, privacy_policy, safety_case, transparency_report.

Every meaningful action is recorded as a usage event. Available on every tier — including Starter — so the audit trail begins on day one.

• compliance_check — every real-time check-action call
• compliance_violation — rule failures
• compliance_block — blocked outcomes
• prompt_injection — F7 detections
• content_safety — F4 scans
• bias_detection — F2 results
• drift_detection — F3 alerts
• risk_scorecard — F5 weekly aggregates
• agent_lifecycle — F10 transitions
• compliance_artifact — F6 generations