curl --request POST \
  --url https://api.enkryptai.com/compliance/add-scan \
  --header 'Content-Type: application/json' \
  --header 'apikey: <api-key>' \
  --data '
{
  "scan_name": "ChatGPT Enterprise",
  "guardrails_name": "My Guardrail",
  "provider": "openai",
  "workspace_id": "00000000-0000-0000-0000-000000000000",
  "event_types": [
    "CONVERSATION_MESSAGE"
  ],
  "cursor_end_time": "2026-09-01T00:00:00Z",
  "compliance_api_key": "YOUR_PROVIDER_COMPLIANCE_KEY"
}
'

{
  "scan": {
    "scan_id": "11111111-2222-3333-4444-555555555555",
    "id": "00000000-1111-2222-3333-444444444444",
    "project_name": "default",
    "scan_name": "ChatGPT Enterprise",
    "created_by": "00000000-1111-2222-3333-444444444444",
    "updated_by": "00000000-1111-2222-3333-444444444444",
    "provider": "openai",
    "workspace_id": "00000000-0000-0000-0000-000000000000",
    "event_types": [
      "CONVERSATION_MESSAGE"
    ],
    "guardrails_name": "My Guardrail",
    "cursor_end_time": "2026-09-01T00:00:00Z",
    "cursor_file_id": null,
    "last_polled_at": "2026-09-23T10:00:00Z",
    "list_interval_s": 60,
    "pending_cap": 5000,
    "status": "active",
    "created_at": "2026-09-01T09:00:00Z",
    "updated_at": "2026-09-01T09:00:00Z"
  }
}

{
  "error": "Scan not found"
}

{
  "code": 403,
  "error": "Forbidden",
  "message": "Access Denied",
  "request_id": "<string>",
  "time": 123
}

{
  "error": "Scan not found"
}

{
  "error": "Scan not found"
}

{
  "error": "Scan not found"
}

⚖️ Compliance API

Add Compliance Scan

Creates a compliance scan and, unless you create it paused, starts polling immediately.

cursor_end_time is where reading starts, so it decides how much history gets pulled — run Test Compliance Connection first and read its backfill estimate before committing to a time.

workspace_id is the ChatGPT workspace UUID, not an OpenAI organization id. An organization id has the right shape, is accepted, and then returns nothing forever with no error to explain it.

guardrails_name names one of your saved guardrails; every message read is evaluated against it. It is not verified at creation time, so a typo surfaces later as a scan that flags nothing.

The scan name must be unique within your project — a repeat is a 409.

The key is stored encrypted and is never returned by any endpoint.

Requires the governance officer role on the project your API key belongs to. The organization owner is not exempt — an owner without the role gets 403 — and an individual (non-organization) account cannot hold the role at all.

POST

compliance

add-scan

curl --request POST \
  --url https://api.enkryptai.com/compliance/add-scan \
  --header 'Content-Type: application/json' \
  --header 'apikey: <api-key>' \
  --data '
{
  "scan_name": "ChatGPT Enterprise",
  "guardrails_name": "My Guardrail",
  "provider": "openai",
  "workspace_id": "00000000-0000-0000-0000-000000000000",
  "event_types": [
    "CONVERSATION_MESSAGE"
  ],
  "cursor_end_time": "2026-09-01T00:00:00Z",
  "compliance_api_key": "YOUR_PROVIDER_COMPLIANCE_KEY"
}
'

{
  "scan": {
    "scan_id": "11111111-2222-3333-4444-555555555555",
    "id": "00000000-1111-2222-3333-444444444444",
    "project_name": "default",
    "scan_name": "ChatGPT Enterprise",
    "created_by": "00000000-1111-2222-3333-444444444444",
    "updated_by": "00000000-1111-2222-3333-444444444444",
    "provider": "openai",
    "workspace_id": "00000000-0000-0000-0000-000000000000",
    "event_types": [
      "CONVERSATION_MESSAGE"
    ],
    "guardrails_name": "My Guardrail",
    "cursor_end_time": "2026-09-01T00:00:00Z",
    "cursor_file_id": null,
    "last_polled_at": "2026-09-23T10:00:00Z",
    "list_interval_s": 60,
    "pending_cap": 5000,
    "status": "active",
    "created_at": "2026-09-01T09:00:00Z",
    "updated_at": "2026-09-01T09:00:00Z"
  }
}

{
  "error": "Scan not found"
}

{
  "code": 403,
  "error": "Forbidden",
  "message": "Access Denied",
  "request_id": "<string>",
  "time": 123
}

{
  "error": "Scan not found"
}

{
  "error": "Scan not found"
}

{
  "error": "Scan not found"
}

Authorizations

apikey

string

header

required

Body

application/json

Body of Add Compliance Scan. scan_id is generated for you — sending one is a 400.

scan_name

string

required

A name unique within your project, and the value X-Enkrypt-Scan carries afterwards. Letters, numbers, spaces and _ & - . /; must start and end with a letter or a number.

Maximum string length: 64

Example:

"ChatGPT Enterprise"

guardrails_name

string

required

The saved guardrail every message is evaluated against. Not verified at creation time, so a typo shows up later as a scan that flags nothing.

Example:

"My Guardrail"

provider

enum<string>

required

The provider the workspace lives on. Immutable after creation. Only openai is served today.

Available options:

openai,

anthropic

Example:

"openai"

workspace_id

string<uuid>

required

The ChatGPT workspace UUID, not an OpenAI organization id — an organization id is accepted and then returns nothing forever. Immutable after creation.

event_types

enum<string>[]

required

Which provider services to read. Must be non-empty, and every value must be one the workspace actually serves — Test Compliance Connection reports which do.

Minimum array length: 1

Available options:

CONVERSATION_MESSAGE,

CODEX_LOG,

APP_LOG,

CUSTOM_AGENTS_LOG,

CHATGPT_PLUGIN_SPREADSHEET

cursor_end_time

string<date-time>

required

Where reading starts, as an ISO 8601 timestamp. This decides how much history gets pulled.

compliance_api_key

string<password>

required

write-only

The provider's compliance API key for that workspace. Stored encrypted and never returned.

status

enum<string>

default:active

needs_reconnect is not accepted here — only the scanner writes it.

Available options:

active,

paused,

disabled

list_interval_s

integer

default:60

Seconds between polls.

Required range: x >= 1

pending_cap

integer

default:5000

How many events may be queued before the poller backs off.

Required range: x >= 1

Response

Scan created. warning is present only when the record was saved but the scanning service could not be told to start — the scan is picked up on the next reconcile.

A write that returns the resulting scan. warning appears only when the record was saved but the scanning service could not be reached — the write stands and the scanner reconciles on its next pass.

scan

ComplianceScan · object

One compliance scan. compliance_api_key is deliberately absent — no endpoint returns the stored key, in plaintext or masked.

Show child attributes

warning

string

Present only when the record was written but the scanning service did not respond.