AICSArtificial Intelligence Control Standard
Enterprise API v1

Connect governance status to the systems your organization already uses.

The AICS Enterprise API provides approved organizations with scoped integration for governance status, mapped review scope, review outcomes, follow-up status, and document-change events.

Request API access review
Access limitation: Enterprise API access is enabled only for approved organizations. Organization approval and API-key creation are separate administrative actions; approval does not automatically generate credentials.

Documented capabilities

Read governance status

Authenticated organizations can read one reassessment status, deterministic control scope, review outcome, and follow-up task using governance:read.

Submit document-change events

Authorized integrations can submit one document-change event with events:write. The endpoint accepts event metadata, not document content.

Least-privilege scopes

Read and event-ingestion scopes do not imply one another. A key with only one scope cannot perform the other scope's operations.

Tenant-safe reads

Reassessment reads authenticate the API key and scope the query to the server-derived organization client. Cross-tenant records return the documented not-found response.

Endpoint inventory

  • GET /api/v1/enterprise/ping - authenticated connectivity check
  • POST /api/v1/events/document-changed - ingest one document-change event
  • GET /api/v1/reassessments/{reassessment_id} - read one reassessment status
  • GET /api/v1/reassessments/{reassessment_id}/controls - read deterministic review scope
  • GET /api/v1/reassessments/{reassessment_id}/review - read the review outcome, if present
  • GET /api/v1/reassessments/{reassessment_id}/follow-up - read the follow-up task, if present

Security and response limits

There is no customer list-all reassessment endpoint. Unsupported methods return 405 METHOD_NOT_ALLOWED; organization API access that is not approved returns 403 API_ACCESS_NOT_APPROVED. Credentials, API-key hashes, internal reviewer identities, proprietary evidence, and database errors are not part of the public contract.

Back to AICS overview