Skip to main content
The Base44 Compliance API lets security partners inventory the security posture of a customer’s Base44 workspace. It’s a read-only, workspace-scoped REST API designed for recurring scans, typically daily. It reports posture, not activity: what exists in a workspace and how it’s configured. For event data, use the public Audit Logs API with an audit_logs:read scope on the same customer key.

​
Who this is for

This reference is written for security partners: vendors that work with Base44 and with customers to analyze a workspace. When these pages say “you”, they mean the partner. Two parties are involved in every integration:
  • Security partners register with Base44, sign a token on every request, and call the API to run the analysis.
  • Customers are Base44 customers who want their workspace analyzed. They don’t call the API. They create the workspace API key, choose which data it can read, and send it to their partner.

​
Design principles

  • Read-only by construction: Every endpoint is a GET. No write or delete surface exists.
  • Customer-granted access, partner-proven identity: The customer issues the key that selects their workspace, and you prove who you are with a signature. Base44 issues you no secret at all. See Authentication.
  • Posture metadata only: Secret values, key material, tokens, entity records, function source, agent instructions, file contents, and conversation content are never returned under any scope. See Privacy and gaps.
  • Single-call completeness: Every resource is a flat, workspace-wide paginated list of full objects, with no per-object GET anywhere. App-internal resources are flattened to workspace-level lists with an app_id, so a workspace with thousands of apps is one paginated walk per endpoint.
  • Effective, not just configured: Where an admin-configured setting can differ from what’s enforced, the API reports the effective value, with the configured value alongside where the two can diverge.
  • Honest gaps: Where a commonly requested field doesn’t exist in the product, the field is present and null with a documented meaning. It’s never omitted and never fabricated.
The Compliance API is available on Enterprise workspaces, and this is enforced on every request.

​
Endpoints

Paths are relative to the base URL https://app.base44.com/api/v1/compliance, and each begins with the workspace ID. Interactive documentation is at /docs under the base URL, and the machine-readable schema is at /openapi.json. The OpenAPI document is the authoritative field-level reference and includes the partner-token security scheme.

​
What’s not in v1

  • Activity and event feed: The public Audit Logs API already covers it, behind an audit_logs:read scope the customer can add to the same key.
  • Content access: Chat transcripts and file contents are excluded from all v1 scopes.
  • Writes or deletes of any kind.
  • Webhooks and push: Pull-based polling is the delivery model for v1.

​
Getting started

To connect to a customer’s workspace:
  1. Generate a key pair, and send Base44 your name, slug, contact address, and public key. This is a one-time step. See Authentication.
  2. Base44 registers you and returns your client_id.
  3. Base44 enables the Compliance API for the customer’s workspace.
  4. The customer mints a workspace API key with the scopes they choose to grant, and sends it to you out of band.
  5. Call GET /{workspace_id} with both credentials to confirm the connection.
  6. Walk each list endpoint your scopes allow, following next_cursor to exhaustion.
Deduplicate on id, treat a 403 as “not granted by customer” rather than an empty result, and treat null as unknown rather than off. Full response shapes for every endpoint are in the OpenAPI document at /openapi.json.