Developer Portal

Compliance Intelligence API

Integrate the world's most comprehensive compliance knowledge graph into your applications. REST endpoints, MCP server support, and AI-ready data -- all in one API.

723

Frameworks

20,400+

Controls

332,000+

Mappings

Quick Start

Start querying compliance data in seconds. No API key required for public endpoints.

Get platform statistics

curl https://api.theartofservice.com/api/agent/stats

Search frameworks by name

curl https://api.theartofservice.com/api/agent/frameworks?q=ISO+27001

List frameworks with authentication

curl "https://api.theartofservice.com/api/licensing/frameworks?page=1&limit=10" \
  -H "Authorization: Bearer YOUR_API_KEY"

Endpoints

A comprehensive set of REST endpoints for querying frameworks, controls, mappings, and jurisdictions.

Licensing API

GET	/api/licensing/stats	Platform-wide statistics (framework, control, and mapping counts)
GET	/api/licensing/frameworks	Paginated list of all compliance frameworks
GET	/api/licensing/frameworks/{name}/domains	Domains for a specific framework
GET	/api/licensing/controls	Search and filter controls across frameworks
GET	/api/frameworks/controls/{code}	Full control detail including evidence_requirements (categories, artefacts, common gaps, verbatim source citations, confidence). Live across all 723 frameworks (526 source-grounded). 99.7% of catalogued controls carry structured auditor evidence (categories + artefacts + common gaps). Every catalogued control enriched against the canonical codes; programmatic audit shows zero invalid JSON, zero missing keys, zero empty fields, zero placeholder sources. Covers every major regime worldwide: NIST + ISO + FedRAMP, PCI + SWIFT + Basel + MAS TRM, HIPAA + FDA + GxP, GDPR + UK + 30+ national privacy laws, US state laws, CMMC, EU AI Act + Cyber Resilience Act, critical infrastructure (NIS2, NERC CIP, IEC 62443), and sectoral overlays (automotive, aerospace, healthcare, sustainability, AI).
GET	/api/licensing/mappings	Cross-framework control mappings
GET	/api/licensing/jurisdictions	Available jurisdictions and their framework counts

Agent API

GET	/api/agent/frameworks	List frameworks with optional search query
GET	/api/agent/frameworks/{name}	Full framework detail including domains and controls
GET	/api/agent/frameworks/{name}/controls	All controls for a given framework
GET	/api/agent/cross-map	Cross-framework mapping between two frameworks
GET	/api/agent/coverage/{name}	Coverage report for a framework across all mapped targets
POST	/api/agent/search	Full-text search across controls and frameworks

Evidence Requirements: Example Response

GET /api/frameworks/controls/AC.L2-3.1.1 returns the full control detail. The evidence_requirements field is populated today across 28 frameworks (2,819 controls at 91.4% average confidence): ISO 27001:2022 (93), CMMC 2.0 L1 (17) + L2 (110), NIST CSF 2.0 (106), NIST 800-53 R5 LOW (173) + MODERATE (275), NIST 800-171 R3 (97), NIST AI RMF + GenAI Profile (284), FedRAMP Moderate (238), PCI DSS 4.0 (248), HIPAA Security Rule (66), SOC 2 TSC (51), CIS Controls v8 (153), GDPR (35), CCPA/CPRA (32), NY DFS 23 NYCRR 500 (24), GLBA Safeguards Rule (19), NAIC MDL-668 (23), DORA (64), NIS2 (56), EU AI Act (28), ACSC Essential 8 (24), Australian ISM (186), UK Cyber Essentials (42), IRS Pub 1075 (176), NERC CIP (119), ISO 22301 (43), ISO 27017 (37). Expanding daily.

{
  "code": "AC.L2-3.1.1",
  "title": "Authorized Access Control",
  "nist_id": "3.1.1",
  "framework": "CMMC 2.0",
  "domain": "Access Control",
  "text_paraphrased": "Limit system access to authorized users, processes acting on behalf of authorized users, and devices (including other systems).",
  "evidence_requirements": {
    "categories": ["Access control policy", "User account provisioning", "Device authentication", "Process and service account control"],
    "artefacts": [
      "Access control policy referencing 3.1.1 and identifying the CUI boundary",
      "User account creation procedure with approval workflow",
      "HR-to-IAM integration evidence: new hire ticket, approver, account creation log",
      "Device authentication (802.1X, certificate-based, MDM enrolment)",
      "Service account inventory with owner and purpose",
      "Termination evidence: same-day or next-business-day disabling of departed users"
    ],
    "common_gaps": [
      "Account creation tickets without captured approval evidence",
      "Service accounts created ad hoc, no inventory or owner",
      "Device authentication only on corporate network, not on VPN",
      "HR-IAM reconciliation gap leaving former-employee accounts active"
    ],
    "sources": [
      "CMMC 2.0 Level 2 Assessment Guide",
      "NIST SP 800-171A Rev 2, 3.1.1[a]-[f] (six determination statements)",
      "NIST SP 800-53 Rev 5 AC-2, AC-3"
    ],
    "confidence": 97,
    "version": "1.0-verified",
    "updated_at": "2026-05-21"
  }
}

API Pricing

Start for free, scale when you are ready.

Free

$0/mo

No credit card needed

✓100 queries / month
✓Public endpoints (agent API)
✓Framework and control search

Get Started Free

Professional

$49/mo

Billed monthly

✓10,000 queries / month
✓All endpoints (licensing + agent)
✓Cross-framework mappings
✓Priority support

Start Free Trial

Enterprise

Custom

Tailored to your needs

✓Unlimited queries
✓Dedicated support
✓White-label option
✓SLA guarantee

Contact Sales

AI Agent Integration

Connect your AI agents directly to the compliance knowledge graph via the Model Context Protocol (MCP) or OpenAI plugin interface.

MCP Server

The MCP endpoint exposes compliance data as tools that any MCP-compatible client can call. Point your agent at:

https://api.theartofservice.com/mcp

Claude Desktop Configuration

Add the following to your Claude Desktop claude_desktop_config.json:

{
  "mcpServers": {
    "compliance": {
      "url": "https://api.theartofservice.com/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_API_KEY"
      }
    }
  }
}

OpenAI Plugin Support

The API is compatible with the OpenAI plugin specification. Point your plugin manifest at https://api.theartofservice.com/.well-known/ai-plugin.json to enable compliance queries from ChatGPT and other OpenAI-compatible platforms.

For Agent Skill Builders

Building a Claude skill, custom GPT, or Copilot agent for a compliance use case? Plug into the MCP and your agent gets 718 human-edited frameworks, 20,400+ controls with auditor evidence blocks, and 332,000+ cross-framework mappings as queryable tools. You build the agent layer. We are the source-grounded data layer.

Source-grounded against the published standard text. Human edited, not LLM-generated.

MCP Tool Catalog

Ten tools your agent can call against the live compliance knowledge graph. Each one is documented at the MCP endpoint and discoverable via standard MCP introspection.

MCP	agent_platform_stats	Live counts: frameworks, controls, mappings, domains. No auth required.
MCP	agent_pricing_info	Current pricing tiers, rate limits, your usage if authenticated.
MCP	agent_search_frameworks	Search by name, keyword, or jurisdiction. Returns matching frameworks with metadata.
MCP	agent_get_framework	Full framework detail: description, jurisdiction, version, domains with counts.
MCP	agent_get_framework_controls	All controls in a framework, optional domain filter for large frameworks.
MCP	agent_get_control	Single control by code. Title, description, domain, framework, evidence requirements.
MCP	agent_get_control_cross_references	All controls in other frameworks that map to a given control via MAPS_TO.
MCP	agent_search	Full-text search across control titles, descriptions, or framework metadata.
MCP	agent_coverage_report	How many controls in framework X map to controls in every other framework.
MCP	agent_cross_framework_map	Complete control-to-control mapping between any two frameworks.

30-Second Quickstart (Python)

Minimal Python that hits the agent API via REST. Get an API key from your account settings after registering.

import requests

API_KEY = "tas_your_key_here"
BASE = "https://api.theartofservice.com/api/agent"

# Get framework detail
r = requests.get(
    f"{BASE}/frameworks/NIST SP 800-161",
    headers={"Authorization": f"Bearer {API_KEY}"},
)
framework = r.json()
print(f"{framework['name']}: {framework.get('description', '')[:120]}")

# Pull full control detail including evidence_requirements
# (Use /api/agent/controls/ for anonymous + free + pro tiers.
# /api/frameworks/controls/ is the licensing-tier sibling for enterprise.)
r = requests.get(
    f"{BASE}/controls/GV.OV-01",
    headers={"Authorization": f"Bearer {API_KEY}"},
)
control = r.json()
ev = control.get("evidence_requirements", {})
print(f"Auditor wants: {', '.join(ev.get('artefacts', [])[:3])}")
print(f"Common gaps: {', '.join(ev.get('common_gaps', [])[:3])}")

Working Example Skill

A complete reference implementation on GitHub. Apache 2.0 licensed. Demonstrates connecting to the MCP, querying NIST SP 800-161 for third-party risk evaluation, pulling evidence requirements, and producing a compliance brief. Clone, customize, ship.

github.com/GJB65/compliance-mcp-skill-example

Claude skill template. Python. Reads MCP, writes a structured control-evidence brief. Connects via your API key.

View on GitHub

Pricing Fit

For solo and small-team agent builders, the Professional tier at $49/mo covers most production-grade skills (10,000 calls/month included, overage at $0.005/call). If you are wrapping the corpus into a product you resell to your clients and want white-label or volume licensing, talk to us about the Enterprise tier.

Ready to Build?

Create a free account to get your API key and start integrating compliance intelligence into your applications today.

Create Free Account Try the API