REST API
Build on your compliance data
A versioned, server-to-server REST API at /api/v1. Read and write the records that run your programme, upload evidence, and wire Obligara into the tools and pipelines you already have.
# List risks with a scoped key
curl https://your-workspace/api/v1/risks
-H "Authorization: Bearer oblig_…"
{
"data": [
{ "ref": "RSK-001", "score": 12 }
],
"page": { "next": "…" }
}What’s in the API
Full read and write, not a read-only export
Read your records
Risks, controls, evidence, CAPAs, suppliers, assets, incidents and documents — with pagination, per-resource filters and full-text search.
Write back
Create and update risks, CAPAs, suppliers, assets and incidents, soft-archive records, and record control tests — with the same computed fields and side-effects as the app.
Upload & download files
Push evidence with a validated multipart upload (size + MIME + magic-byte sniff) and stream the artefact back down when you need it.
Links & tests
Link records across every entity type in both directions, and post control tests that snapshot the control as they land.
Built for production
The things a security team asks about an API
API keys & granular scopes
Per-key tokens with resource-level read/write scopes and a wildcard for full access. Create keys in Settings, see the secret once, and revoke any time.
Multi-tenant & audited
Every call runs inside your row-level-security boundary and is written to the audit log as an API actor — the same isolation and traceability as the app.
Rate limits & idempotency
Clear per-key and per-IP limits with standard X-RateLimit headers, and an Idempotency-Key on writes so a retried request never double-creates.
OpenAPI 3.1 + Swagger UI
A complete OpenAPI 3.1 spec plus interactive Swagger docs in your workspace, so client generation and hands-on exploration are one step.
Wire Obligara into your stack
Bring your use case — a data warehouse sync, a custom app, a CI check — and we’ll show you the API and the docs.