The Compliance API is a read-only REST API. Compliance platforms and your own sync jobs use it to pull TigerGate evidence: findings with SLA dates, asset inventory, scan activity and framework control status. Compliance API covers what it offers and how to create a key. This section covers how to call it.

​
Base URL

The API is served from your region’s API host, under /api/v1/compliance. For us1 that is https://api.tigergate.dev/api/v1/compliance; for the other regions, use the API host from this table: A key works only in the region that created it. GET /whoami returns the exact base URL for a key as api_base_url.

​
First request

curl -H "Authorization: Bearer $TIGERGATE_COMPLIANCE_KEY" \
  https://api.tigergate.dev/api/v1/compliance/whoami

{
  "organization": { "id": "7c1e…", "name": "Acme", "region": "us1" },
  "api_base_url": "https://api.tigergate.dev/api/v1/compliance",
  "key": {
    "id": "b0a4…",
    "name": "Vanta – production",
    "prefix": "tgcmp_3f9a01c2",
    "integration": "vanta",
    "created_at": "2026-09-01T10:00:00.000Z",
    "expires_at": "2027-09-01T10:00:00.000Z"
  },
  "products": [
    {
      "product": "code_security",
      "label": "Code Security",
      "granted": true,
      "entitled": true,
      "available": true,
      "readable": true,
      "reason": null,
      "sync_semantics": "lifecycle",
      "ledger_state": null,
      "has_controls": false,
      "finding_types": ["sca", "secret"],
      "excluded_finding_types": [],
      "resources": { "mode": "selected", "count": 3, "stale": 0 },
      "tombstone_horizon_days": 90
    }
  ],
  "rate_limit": { "requests_per_minute": 600 },
  "sla_policy": { "critical": 15, "high": 30, "medium": 90, "low": 180, "source": "default" }
}
Then read findings for a product the key is granted: 
curl -H "Authorization: Bearer $TIGERGATE_COMPLIANCE_KEY" \
  "https://api.tigergate.dev/api/v1/compliance/findings?product=code_security&limit=100"

​
Conventions

  • One product per request. /findings, /assets and /scan-activity take a required product parameter. Loop over the products whoami reports as readable.
  • List envelope. Paged lists return { "items": [...], "page": { "size", "next_cursor", "has_more" }, "meta": {...} }. See Pagination and sync.
  • Timestamps are ISO 8601 in UTC. Send them the same way, for example 2026-09-01T00:00:00Z.
  • Ids are opaque. A finding’s id is stable across rescans; store it and upsert on it. Don’t parse it.
  • Multiple values are comma-separated: severity=critical,high.
  • Every response carries X-Request-Id. Include it when you contact support.

​
Versioning

The version is part of the path (/api/v1). Within v1, fields and endpoints may be added, and new values may appear in enumerations such as finding_type and status_detail. Clients should ignore unknown fields and tolerate unknown values. Fields are not removed or renamed within a version.