> ## Documentation Index
> Fetch the complete documentation index at: https://docs.base44.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance API for security partners

> Integrate a security product with the Compliance API to inventory the security posture of a customer's Base44 workspace

The Base44 Compliance API lets security partners inventory the security posture of a customer's Base44 workspace. It's a read-only, workspace-scoped REST API designed for recurring scans, typically daily. It reports posture, not activity: what exists in a workspace and how it's configured. For event data, use the public [Audit Logs API](https://docs.base44.com/developers/references/audit-logs-api/get-started/overview.md) with an `audit_logs:read` scope on the same customer key.

## Who this is for

This reference is written for security partners: vendors that work with Base44 and with customers to analyze a workspace. When these pages say "you", they mean the partner.

Two parties are involved in every integration:

* **Security partners** register with Base44, sign a token on every request, and call the API to run the analysis.
* **Customers** are Base44 customers who want their workspace analyzed. They don't call the API. They create the workspace API key, choose which data it can read, and send it to their partner.

## Design principles

* **Read-only by construction:** Every endpoint is a `GET`. No write or delete surface exists.
* **Customer-granted access, partner-proven identity:** The customer issues the key that selects their workspace, and you prove who you are with a signature. Base44 issues you no secret at all. See [Authentication](https://docs.base44.com/developers/references/compliance-api/get-started/authentication.md).
* **Posture metadata only:** Secret values, key material, tokens, entity records, function source, agent instructions, file contents, and conversation content are never returned under any scope. See [Privacy and gaps](https://docs.base44.com/developers/references/compliance-api/get-started/privacy-and-gaps.md).
* **Single-call completeness:** Every resource is a flat, workspace-wide paginated list of full objects, with no per-object `GET` anywhere. App-internal resources are flattened to workspace-level lists with an `app_id`, so a workspace with thousands of apps is one paginated walk per endpoint.
* **Effective, not just configured:** Where an admin-configured setting can differ from what's enforced, the API reports the effective value, with the configured value alongside where the two can diverge.
* **Honest gaps:** Where a commonly requested field doesn't exist in the product, the field is present and `null` with a documented meaning. It's never omitted and never fabricated.

> [!NOTE]
>
> The Compliance API is available on **Enterprise** workspaces, and this is enforced on every request.

## Endpoints

Paths are relative to the base URL `https://app.base44.com/api/v1/compliance`, and each begins with the workspace ID.

| Path | Returns | Required scope |
| - | - | - |
| `/{workspace_id}` | [Workspace identity and security configuration](https://docs.base44.com/developers/references/compliance-api/get-started/workspace-and-members.md) | `compliance:inventory:read` |
| `/{workspace_id}/members` | [Member directory](https://docs.base44.com/developers/references/compliance-api/get-started/workspace-and-members.md) | `compliance:members:read` |
| `/{workspace_id}/apps` | [All apps, including standalone agents](https://docs.base44.com/developers/references/compliance-api/get-started/apps-and-domains.md) | `compliance:inventory:read` |
| `/{workspace_id}/domains` | [Custom serving and email domains](https://docs.base44.com/developers/references/compliance-api/get-started/apps-and-domains.md) | `compliance:inventory:read` |
| `/{workspace_id}/api-keys` | [Workspace API key metadata](https://docs.base44.com/developers/references/compliance-api/get-started/keys-data-and-functions.md) | `compliance:inventory:read` |
| `/{workspace_id}/entities` | [Entity schemas and row-level security](https://docs.base44.com/developers/references/compliance-api/get-started/keys-data-and-functions.md) | `compliance:inventory:read` |
| `/{workspace_id}/functions` | [Deployed backend functions and actors](https://docs.base44.com/developers/references/compliance-api/get-started/keys-data-and-functions.md) | `compliance:inventory:read` |
| `/{workspace_id}/secrets` | [Secret metadata, never values](https://docs.base44.com/developers/references/compliance-api/get-started/keys-data-and-functions.md) | `compliance:inventory:read` |
| `/{workspace_id}/integrations` | [Third-party connections](https://docs.base44.com/developers/references/compliance-api/get-started/integrations-and-agents.md) | `compliance:inventory:read` |
| `/{workspace_id}/agents` | [Agents and their channel vocabulary](https://docs.base44.com/developers/references/compliance-api/get-started/integrations-and-agents.md) | `compliance:inventory:read` |
| `/{workspace_id}/security-findings` | [Security scanner findings](https://docs.base44.com/developers/references/compliance-api/get-started/security-findings.md) | `compliance:findings:read` |

Interactive documentation is at `/docs` under the base URL, and the machine-readable schema is at `/openapi.json`. The OpenAPI document is the authoritative field-level reference and includes the partner-token security scheme.

## What's not in v1

* **Activity and event feed:** The public Audit Logs API already covers it, behind an `audit_logs:read` scope the customer can add to the same key.
* **Content access:** Chat transcripts and file contents are excluded from all v1 scopes.
* **Writes or deletes of any kind.**
* **Webhooks and push:** Pull-based polling is the delivery model for v1.

## Getting started

**To connect to a customer's workspace:**

1. Generate a key pair, and send Base44 your name, slug, contact address, and public key. This is a one-time step. See [Authentication](https://docs.base44.com/developers/references/compliance-api/get-started/authentication.md).
2. Base44 registers you and returns your `client_id`.
3. Base44 enables the Compliance API for the customer's workspace.
4. The customer mints a workspace API key with the scopes they choose to grant, and sends it to you out of band.
5. Call `GET /{workspace_id}` with both credentials to confirm the connection.
6. Walk each list endpoint your scopes allow, following `next_cursor` to exhaustion.

Deduplicate on `id`, treat a `403` as "not granted by customer" rather than an empty result, and treat `null` as unknown rather than off. Full response shapes for every endpoint are in the OpenAPI document at `/openapi.json`.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.