Skip to content
Keel Docs

REST API reference

The Keel REST API gives programmatic access to your workspace. Every request is scoped to the organization the API key belongs to, so the API never exposes more than the key already can.

The always-current, machine-readable definition lives at /api/v1/openapi.json on your workspace origin, and the in-app Integrations → API docs page renders it interactively. This page is a stable, human-readable overview of the same surface.

Base URL

Section titled “Base URL”
https://app.keelgrc.com

All paths below are relative to that origin (for example https://app.keelgrc.com/api/v1/me).

Authentication

Section titled “Authentication”

Create an API key in the app under Integrations (it is shown once, so store it securely). Send it on every request, using either header:

Terminal window
# Bearer token
curl https://app.keelgrc.com/api/v1/me \
  -H "Authorization: Bearer $KEEL_API_KEY"


# or the x-api-key header
curl https://app.keelgrc.com/api/v1/me \
  -H "x-api-key: $KEEL_API_KEY"

Keys are scoped to a single workspace (organization). Treat a key like a password; rotate it if it is exposed.

Endpoints

Section titled “Endpoints”
Method Path Purpose
GET /api/v1/me Connection test and the authenticated organization identity
GET /api/v1/controls List controls with status and owner (filter with ?q=)
GET /api/v1/readiness ISO 27001 readiness summary (counts and percentage)
GET /api/v1/tasks List open and completed tasks
POST /api/v1/tasks Create a task
GET /api/v1/evidence List evidence, newest first (filter with ?since=)
POST /api/v1/evidence Report evidence as a link (JSON) or a file (multipart)
GET /api/v1/risks List risks, most severe first
POST /api/v1/risks Create a risk
GET /api/v1/vendors List vendors (filter with ?q=)
POST /api/v1/vendors Create a vendor
GET /api/v1/people List directory people (filter with ?q=)
POST /api/v1/people Upsert a person by email (idempotent)
GET /api/v1/policies List policies (filter with ?q=)
POST /api/v1/policies Create a policy (idempotent on key)
GET /api/v1/hooks List webhook subscriptions
POST /api/v1/hooks Subscribe to events
DELETE /api/v1/hooks/{id} Unsubscribe a webhook

Examples

Section titled “Examples”

Check your connection and see which organization the key belongs to:

Terminal window
curl https://app.keelgrc.com/api/v1/me \
  -H "Authorization: Bearer $KEEL_API_KEY"

Read ISO 27001 readiness (useful for surfacing posture in your own dashboards):

Terminal window
curl https://app.keelgrc.com/api/v1/readiness \
  -H "Authorization: Bearer $KEEL_API_KEY"

Create a task:

Terminal window
curl -X POST https://app.keelgrc.com/api/v1/tasks \
  -H "Authorization: Bearer $KEEL_API_KEY" \
  -H "content-type: application/json" \
  -d '{"title":"Rotate database credentials","description":"Quarterly rotation"}'

Report a piece of evidence by link:

Terminal window
curl -X POST https://app.keelgrc.com/api/v1/evidence \
  -H "Authorization: Bearer $KEEL_API_KEY" \
  -H "content-type: application/json" \
  -d '{"url":"https://example.com/export.pdf","title":"MFA enforcement export"}'

Webhooks

Section titled “Webhooks”

Register a URL with POST /api/v1/hooks to receive event notifications when things change in your workspace, then wire them into Zapier or your own endpoint. List your subscriptions with GET /api/v1/hooks and remove one with DELETE /api/v1/hooks/{id}.

Next steps

Section titled “Next steps”