Authentication

All API endpoints require authentication via a Supabase Auth bearer token. Include the token in the Authorization header of every request. Tokens are scoped to your organization via Row Level Security (RLS) policies.

curl -X GET https://complixo.com/api/controls \
  -H "Authorization: Bearer YOUR_SUPABASE_TOKEN" \
  -H "Content-Type: application/json"

Full API access requires the Consultant plan. Professional plan includes integrations API. All plans have read access to their own data.

Error Responses

All errors return a JSON object with an error field and an appropriate HTTP status code.

Status	Meaning
400	Bad Request -- invalid or missing parameters
401	Unauthorized -- invalid or missing token
403	Forbidden -- insufficient plan or role
404	Not Found -- resource does not exist or is not accessible
409	Conflict -- duplicate resource (e.g. link already exists)
429	Rate Limited -- too many requests (draft auto-save: 1 per 5s)
500	Internal Error -- server-side failure

// Example error response
{
  "error": "Title is required (max 150 chars)"
}

Applications

Manage AI systems and applications registered in your organization. Each application can be linked to frameworks for compliance tracking.

POST/api/systems

Starter+

Create a new application (AI system) in draft status.

Request Body

{
  "name": "Customer Support Chatbot",
  "description": "AI-powered customer service assistant",
  "purpose": "Automated customer support",
  "uses_ai": true,
  "use_case_tags": ["chatbot"],
  "deployment_type": "api",
  "jurisdiction": "EU"
}

Response

{ "id": "uuid-of-new-system" }

GET/api/systems/:id

Free+

Get full details of a specific application.

Response

{
  "id": "...",
  "name": "Customer Support Chatbot",
  "status": "draft",
  "uses_ai": true,
  "ai_act_category": "limited_risk",
  "version": 1,
  ...
}

PUT/api/systems/:id

Starter+

Update application details, classification, or status. Also supports draft auto-save.

Request Body

{
  "name": "Updated Name",
  "status": "approved",
  "ai_act_category": "high_risk"
}

Response

{ "success": true }

GET/api/systems/:id/pdf

Starter+

Export application compliance report as PDF. Includes all linked frameworks and checks.

Response

(Binary PDF file)

DELETE/api/systems/:id/frameworks/:fid

Starter+

Unlink a framework from an application.

Response

{ "success": true }

Frameworks

Browse built-in compliance frameworks (EU AI Act, GDPR, NIS2, DORA) and manage custom frameworks. Toggle framework visibility per organization.

GET/api/frameworks/:id

Free+

Get framework details. Built-in frameworks are accessible to all; custom frameworks only to the owning organization.

Response

{
  "id": "...",
  "name": "EU AI Act",
  "slug": "eu-ai-act",
  "is_builtin": true,
  "is_active": true,
  ...
}

PUT/api/frameworks/:id

Professional+

Update a custom framework (name, description, color, icon). Cannot edit built-in frameworks.

Request Body

{
  "name": "Internal Security Policy",
  "description": "Company security standards v2",
  "color": "#3B82F6"
}

Response

{ "id": "...", "name": "Internal Security Policy", ... }

PATCH/api/frameworks/:id

Starter+

Toggle framework visibility for your organization. Works for both built-in and custom frameworks.

Request Body

{ "is_visible": false }

Response

{ "ok": true }

DELETE/api/frameworks/:id

Professional+

Delete a custom framework. Built-in frameworks cannot be deleted.

Response

{ "success": true }

GET/api/frameworks/:id/templates

Free+

Get all compliance check templates for a framework.

Response

[
  {
    "id": "...",
    "title": "Data Protection Impact Assessment",
    "check_key": "dpia",
    "article_reference": "Art. 35",
    "guidance": "...",
    ...
  }
]

POST/api/frameworks/:id/templates

Professional+

Add a compliance check template to a custom framework.

Request Body

{
  "title": "Security Audit Check",
  "description": "Verify annual security audit completion",
  "article_reference": "Section 4.2",
  "guidance": "Review the latest audit report..."
}

Response

{ "id": "...", "title": "Security Audit Check", ... }

Controls

Manage compliance controls using a Common Control Framework approach. Map controls to multiple frameworks simultaneously to eliminate duplicate work.

GET/api/controls

Free+

List all controls for your organization. Filter by status, category, or framework.

Response

[
  {
    "id": "...",
    "title": "Access Control Policy",
    "category": "access_control",
    "status": "implemented",
    "mappings": [...],
    ...
  }
]

POST/api/controls

Starter+

Create a new control.

Request Body

{
  "title": "Access Control Policy",
  "description": "Organization-wide access management",
  "category": "access_control",
  "status": "not_started",
  "due_date": "2026-06-01"
}

Response

{ "id": "...", "title": "Access Control Policy", ... }

GET/api/controls/:id

Free+

Get control details with framework mappings and assigned profiles.

Response

{
  "id": "...",
  "title": "Access Control Policy",
  "mappings": [...],
  "owner_profile": { "id": "...", "full_name": "..." },
  ...
}

PUT/api/controls/:id

Starter+

Update a control.

Request Body

{
  "status": "implemented",
  "implementation_notes": "Implemented via SSO provider"
}

Response

{ "id": "...", "status": "implemented", ... }

DELETE/api/controls/:id

Starter+

Delete a control.

Response

{ "ok": true }

GET/api/controls/:id/mappings

Free+

Get all framework mappings for a control.

Response

[
  {
    "id": "...",
    "framework_id": "...",
    "framework": { "name": "GDPR", "slug": "gdpr" },
    "framework_reference": "Art. 32"
  }
]

POST/api/controls/:id/mappings

Starter+

Map a control to a framework. Creates the cross-framework link.

Request Body

{
  "framework_id": "uuid-of-framework",
  "framework_reference": "Art. 32"
}

Response

{ "id": "...", "framework_id": "...", ... }

DELETE/api/controls/:id/mappings?mapping_id=:mid

Starter+

Remove a framework mapping from a control.

Response

{ "ok": true }

Evidence

Manage compliance evidence with approval workflows. Evidence can be linked to controls and includes support for attachments, validity periods, and approval status.

GET/api/evidence

Free+

List all evidence items. Filter by evidence_type, approval_status, period_start, period_end.

Response

[
  {
    "id": "...",
    "title": "Q1 Access Review Export",
    "evidence_type": "export",
    "approval_status": "approved",
    "source": "manual",
    ...
  }
]

POST/api/evidence

Starter+

Create new evidence and optionally link to controls.

Request Body

{
  "title": "Q1 Access Review Export",
  "evidence_type": "export",
  "source": "manual",
  "period_start": "2026-01-01",
  "period_end": "2026-03-31",
  "control_ids": ["uuid-1", "uuid-2"]
}

Response

{ "id": "...", "title": "Q1 Access Review Export", ... }

GET/api/evidence/:id

Free+

Get evidence details with linked controls.

Response

{
  "id": "...",
  "title": "...",
  "approval_status": "pending",
  "evidence_controls": [{ "control_id": "..." }],
  ...
}

PUT/api/evidence/:id

Starter+

Update evidence details, approval status, or linked controls. Supports approval workflow (pending, under_review, approved, rejected, expired).

Request Body

{
  "approval_status": "approved",
  "control_ids": ["uuid-1"]
}

Response

{ "id": "...", "approval_status": "approved", ... }

DELETE/api/evidence/:id

Starter+

Delete evidence and its control links.

Response

{ "ok": true }

Risks

Manage the risk register with likelihood/impact scoring, treatment plans, and control linkage. Risk scores are computed automatically.

GET/api/risks

Free+

List all risks. Filter by category, status, treatment, min_score, max_score.

Response

[
  {
    "id": "...",
    "title": "Data Breach Risk",
    "category": "technical",
    "likelihood": "medium",
    "impact": "high",
    "risk_score": 12,
    "treatment": "mitigate",
    "status": "in_treatment",
    ...
  }
]

POST/api/risks

Starter+

Create a new risk entry.

Request Body

{
  "title": "Data Breach Risk",
  "category": "technical",
  "likelihood": "medium",
  "impact": "high",
  "treatment": "mitigate",
  "control_id": "uuid-of-mitigating-control"
}

Response

{ "id": "...", "risk_score": 12, ... }

GET/api/risks/:id

Free+

Get risk details with linked control and owner profile.

Response

{
  "id": "...",
  "title": "Data Breach Risk",
  "control": { "id": "...", "title": "Encryption Policy" },
  "owner_profile": { "id": "...", "full_name": "..." },
  ...
}

PUT/api/risks/:id

Starter+

Update a risk entry.

Request Body

{
  "status": "closed",
  "likelihood": "low"
}

Response

{ "id": "...", "status": "closed", ... }

DELETE/api/risks/:id

Starter+

Delete a risk entry.

Response

{ "ok": true }

Requirements

Define, track, and link compliance requirements with full traceability to frameworks, controls, test cases, and tasks.

GET/api/requirements

Free+

List all requirements. Filter by status, type, priority, application_id. Includes traceability link counts.

Response

[
  {
    "id": "...",
    "title": "DPIA Required for High-Risk AI",
    "requirement_type": "regulatory",
    "priority": "critical",
    "status": "approved",
    "link_counts": {
      "frameworks": 1,
      "controls": 2,
      "test_cases": 1,
      "tasks": 0
    },
    ...
  }
]

POST/api/requirements

Starter+

Create a new requirement.

Request Body

{
  "title": "DPIA Required for High-Risk AI",
  "requirement_type": "regulatory",
  "priority": "critical",
  "source": "EU AI Act Art. 27",
  "acceptance_criteria": "DPIA completed and reviewed"
}

Response

{ "id": "...", "title": "...", ... }

GET/api/requirements/:id

Free+

Get requirement details with owner, application, and traceability links.

Response

{
  "id": "...",
  "title": "...",
  "owner_profile": { ... },
  "application": { "id": "...", "name": "..." },
  "links": [...]
}

PUT/api/requirements/:id

Starter+

Update a requirement.

Request Body

{ "status": "verified", "priority": "high" }

Response

{ "id": "...", "status": "verified", ... }

DELETE/api/requirements/:id

Starter+

Delete a requirement and its traceability links.

Response

{ "ok": true }

GET/api/requirements/:id/links

Free+

Get all traceability links for a requirement, enriched with entity names.

Response

[
  {
    "id": "...",
    "linked_type": "control",
    "linked_id": "...",
    "linked_name": "Access Control Policy",
    "link_type": "implements",
    "direction": "outgoing"
  }
]

POST/api/requirements/:id/links

Starter+

Create a traceability link from a requirement to another entity.

Request Body

{
  "target_type": "control",
  "target_id": "uuid-of-control",
  "link_type": "implements"
}

Response

{ "id": "...", "source_type": "requirement", ... }

DELETE/api/requirements/:id/links?link_id=:lid

Starter+

Delete a traceability link from a requirement.

Response

{ "ok": true }

Testing

Control testing and check management. Manage control checks, deficiency tracking, and effectiveness monitoring.

GET/api/testing/strategies

Starter+

List test strategies. Filter by status (draft, active, archived).

Response

[
  {
    "id": "...",
    "title": "Q1 2026 Test Strategy",
    "status": "active",
    "scope": "...",
    "approach": "...",
    ...
  }
]

POST/api/testing/strategies

Starter+

Create a test strategy with IEEE 829 sections (objectives, risk analysis, environment, etc.).

Request Body

{
  "title": "Q1 2026 Test Strategy",
  "scope": "All high-risk AI systems",
  "approach": "Risk-based testing",
  "objectives": "Validate compliance controls",
  "entry_criteria": "Systems classified",
  "exit_criteria": "All critical tests pass"
}

Response

{ "id": "...", "title": "...", ... }

GET/api/testing/plans

Starter+

List test plans. Filter by status, strategy_id, application_id.

Response

[
  {
    "id": "...",
    "title": "GDPR Compliance Test Plan",
    "status": "ready",
    "strategy": { "id": "...", "title": "..." },
    "application": { "id": "...", "name": "..." },
    ...
  }
]

POST/api/testing/plans

Starter+

Create a test plan linked to a strategy and application.

Request Body

{
  "title": "GDPR Compliance Test Plan",
  "strategy_id": "uuid-of-strategy",
  "application_id": "uuid-of-app",
  "start_date": "2026-03-01",
  "end_date": "2026-03-31"
}

Response

{ "id": "...", "title": "...", ... }

GET/api/testing/cases

Starter+

List test cases. Filter by plan_id, folder, test_type (manual/automated/exploratory), priority.

Response

[
  {
    "id": "...",
    "title": "Verify consent collection",
    "test_type": "manual",
    "priority": "high",
    "folder": "GDPR/Consent",
    ...
  }
]

POST/api/testing/cases

Starter+

Create a test case.

Request Body

{
  "title": "Verify consent collection",
  "plan_id": "uuid-of-plan",
  "test_type": "manual",
  "priority": "high",
  "preconditions": "User is on signup page",
  "expected_result": "Consent checkbox visible and functional",
  "folder": "GDPR/Consent"
}

Response

{ "id": "...", "title": "...", ... }

GET/api/testing/cycles

Starter+

List test cycles with run statistics. Filter by status, plan_id.

Response

[
  {
    "id": "...",
    "title": "Sprint 12 Execution",
    "status": "in_progress",
    "stats": { "passed": 5, "failed": 1, "not_run": 3 },
    ...
  }
]

POST/api/testing/cycles

Starter+

Create a test execution cycle.

Request Body

{
  "title": "Sprint 12 Execution",
  "plan_id": "uuid-of-plan",
  "status": "not_started"
}

Response

{ "id": "...", "title": "...", ... }

GET/api/testing/runs

Starter+

List test runs. Filter by cycle_id, case_id, status. Returns execution details.

Response

[
  {
    "id": "...",
    "test_case": { "id": "...", "title": "..." },
    "status": "passed",
    "run_number": 1,
    "executed_by": "...",
    ...
  }
]

POST/api/testing/runs

Starter+

Create a test run (execute a test case). Run number is auto-incremented.

Request Body

{
  "test_case_id": "uuid-of-case",
  "cycle_id": "uuid-of-cycle",
  "status": "passed",
  "actual_result": "Consent checkbox displayed correctly",
  "duration_seconds": 120
}

Response

{ "id": "...", "run_number": 1, "status": "passed", ... }

GET/api/testing/findings/:id

Starter+

Get finding details with related test run, assigned profile, and linked task.

Response

{
  "id": "...",
  "title": "Missing consent checkbox on mobile",
  "severity": "high",
  "status": "open",
  "test_run": { ... },
  "assigned_profile": { ... },
  "task": { ... }
}

PUT/api/testing/findings/:id

Starter+

Update a finding (severity, status, assignment, links).

Request Body

{
  "status": "resolved",
  "severity": "medium"
}

Response

{ "id": "...", "status": "resolved", ... }

DELETE/api/testing/findings/:id

Starter+

Delete a finding.

Response

{ "ok": true }

Tasks

Manage compliance tasks with multi-assignee support, priority levels, tags, and auto-completion tracking.

GET/api/tasks

Free+

List tasks. Filter by status, assigned_to, ai_system_id, priority, from_date, to_date.

Response

[
  {
    "id": "...",
    "title": "Complete DPIA for Chatbot",
    "status": "in_progress",
    "priority": "high",
    "assignees": [...],
    ...
  }
]

POST/api/tasks

Starter+

Create a task. Supports multiple assignees or assign_all for the whole team.

Request Body

{
  "title": "Complete DPIA for Chatbot",
  "priority": "high",
  "assignees": ["uuid-1", "uuid-2"],
  "ai_system_id": "uuid-of-system",
  "due_date": "2026-04-01",
  "tags": ["dpia", "gdpr"]
}

Response

{ "id": "...", "title": "...", ... }

GET/api/tasks/:id

Free+

Get task details with assignees.

Response

{
  "id": "...",
  "title": "...",
  "assignees": [
    { "profile_id": "...", "completed_at": null, "profile": { ... } }
  ],
  ...
}

PUT/api/tasks/:id

Starter+

Update a task. Supports status changes, assignee management, and individual completion (complete_for_me).

Request Body

{
  "status": "done",
  "priority": "urgent"
}

Response

{ "id": "...", "status": "done", ... }

DELETE/api/tasks/:id

Starter+

Delete a task.

Response

{ "ok": true }

GET/api/tasks/export?format=:fmt

Starter+

Export tasks as PDF, Excel, CSV, or Word. Format via query parameter.

Response

(Binary file in requested format)

Traceability Links

Cross-link any entity (requirement, risk, control, test case, task, evidence, framework, finding) for full traceability across your compliance program.

GET/api/links?entity_type=:type&entity_id=:id

Free+

Get all traceability links for an entity, enriched with names.

Response

[
  {
    "id": "...",
    "linked_type": "test_case",
    "linked_id": "...",
    "linked_name": "Verify DPIA completion",
    "link_type": "verifies",
    "direction": "outgoing"
  }
]

POST/api/links

Starter+

Create a traceability link between any two entities.

Request Body

{
  "source_type": "control",
  "source_id": "uuid",
  "target_type": "risk",
  "target_id": "uuid",
  "link_type": "mitigates"
}

Response

{ "id": "...", "source_type": "control", ... }

DELETE/api/links?link_id=:id

Starter+

Delete a traceability link.

Response

{ "ok": true }

Organization & Export

Manage organization profile and export compliance data in multiple formats (PDF, Excel, CSV, Word).

GET/api/organizations/profile

Free+

Get organization profile including sector, jurisdiction, and compliance settings.

Response

{
  "id": "...",
  "name": "Acme Corp",
  "sector": "technology",
  "default_jurisdiction": "EU",
  "org_profile": { ... }
}

PUT/api/organizations/profile

Starter+

Update organization profile and compliance settings.

Request Body

{
  "name": "Acme Corp",
  "sector": "finance",
  "org_profile": { "employee_count": "50-250" }
}

Response

{ "id": "...", "name": "Acme Corp", ... }

GET/api/organizations/pdf?format=:fmt

Starter+

Export organization-wide compliance report. Supports PDF, Excel, CSV, and Word formats.

Response

(Binary file in requested format)

GET/api/account/export

Free+

Export all personal account data (GDPR data portability).

Response

(JSON export of all account data)

Integrations

Manage external integrations including Jira, Slack, Teams, webhooks, and API keys. Professional plan or higher required.

GET/api/integrations

Professional+

List all integrations for your organization.

Response

[
  {
    "id": "...",
    "name": "Jira Cloud",
    "type": "jira",
    "status": "active",
    ...
  }
]

POST/api/integrations

Professional+

Create a new integration. Admin role required.

Request Body

{
  "name": "Slack Notifications",
  "type": "slack",
  "description": "Post compliance alerts to #compliance channel",
  "config": { "webhook_url": "https://hooks.slack.com/..." }
}

Response

{ "id": "...", "status": "inactive", ... }

GET/api/integrations/:id

Professional+

Get integration details.

Response

{
  "id": "...",
  "name": "Slack Notifications",
  "type": "slack",
  "status": "active",
  "config": { ... },
  ...
}

PUT/api/integrations/:id

Professional+

Update an integration. Admin role required.

Request Body

{
  "status": "active",
  "config": { "webhook_url": "https://..." }
}

Response

{ "id": "...", "status": "active", ... }

DELETE/api/integrations/:id

Professional+

Delete an integration. Admin role required.

Response

{ "success": true }

Audit Trail

All API actions are automatically logged in a hash-chained, tamper-proof audit trail. Export available for administrators.

GET/api/admin/audit/export?format=:fmt

Professional+

Export audit log. Filter by org, action, entity, date range. Supports CSV and JSON. Admin only.

Response

(CSV or JSON audit log export)

Rate Limits & Data Isolation

Row Level Security: All data access is enforced at the database level via Supabase RLS policies. Your API token can only access data belonging to your organization -- there is no risk of cross-tenant data leakage.

Rate Limiting: Draft auto-save endpoints are rate limited to 1 request per 5 seconds per user per resource. Export endpoints are subject to plan-based quotas.

Audit Trail: All write operations (POST, PUT, PATCH, DELETE) are automatically logged in the hash-chained audit trail with actor, timestamp, and change details.

Ready to integrate?

Full API access is available on the Consultant plan. Start with a free account and upgrade when you are ready.

Get Started Free View Plans

API Documentation

Authentication

Error Responses

Applications

Frameworks

Controls

Evidence

Risks

Requirements

Testing

Tasks

Traceability Links

Organization & Export

Integrations

Audit Trail

Rate Limits & Data Isolation

Ready to integrate?