> ## Documentation Index > Fetch the complete documentation index at: https://docs.enkryptai.com/llms.txt > Use this file to discover all available pages before exploring further. # Get Compliance Message > One message's text, fetched **live from the provider**. Message text is never stored, so serving this re-downloads the whole export file the message came from — up to 15 MB for a single message, out of the same rate-limited budget the scan itself uses. **Put it behind a deliberate click.** Never call it from a list view, a hover card or a prefetch: a burst of calls starves the scan that is reading new messages. Allow up to a minute for a response. `X-Enkrypt-Scan` is required, not optional: the scan it names is what scopes the lookup to your own data. `410` is not a failure. It means the file has aged out of the provider's 30-day retention window, which is the normal steady state for anything older than a month; `content_expires_at` on the record says when that will happen. Requires the **governance officer** role on the project your API key belongs to. The organization owner is not exempt — an owner without the role gets `403` — and an individual (non-organization) account cannot hold the role at all. ## OpenAPI ````yaml GET /compliance/get-message openapi: 3.0.0 info: title: Enkrypt AI APIs version: 2.0.0 servers: - url: https://api.enkryptai.com security: - apiKeyAuth: [] tags: - name: Guardrails - name: Code of Conduct - name: Endpoints - name: Redteam description: >- Red Team API: submit red-team / threat-modeling / playground / eval runs, then poll run status, records, results and compliance. Also two-phase threat modeling (categories + data), dataset retrieval, model health, findings and risk mitigation. The previous task-based Red Team API is under **Archived**. - name: Deployments - name: AI Proxy - name: Leaderboard - name: Archived - name: MCP Hub description: >- MCP Hub vulnerability scanning APIs. Submitting scans (the POST endpoints) is open to all authenticated callers. The scan **retrieval** APIs — Get Scan Job Status, Get Complete Scan Results, List Scans, and Get MCP Hub Scan Statistics (the GET endpoints) — are an **enterprise data-license feature**: they require your organization to have MCP Hub API access enabled by Enkrypt, otherwise they return `403`. Contact us at support@enkryptai.com to enable access. - name: MCP Registry Servers - name: MCP Gateways - name: MCP Playground - name: Skill Scanner description: >- Skill Scanner APIs: submit an agent skill (a directory inside a git repository) for security scanning, then read the verdict, the risk level and the full report. Scanning is asynchronous — a scan takes roughly 30–90 seconds, so `POST /skill-hub/scan` returns a `scan_id` you poll. You see your organization's scans and nobody else's. The identity comes from your API key, never from your request — sending `user_email` is a `400`. For an organization or project API key, scans are filed under the **organization**, so every member sees every scan the organization has run, whichever project or member submitted it. For an individual account it is simply your own scans. Either way List Skill Scans needs no parameter to say who you are. - name: Compliance description: >- Compliance APIs: connect a ChatGPT Enterprise workspace, then keep reading its compliance logs and scanning every message through one of your saved guardrails. Every endpoint here — reads as well as writes — requires the **governance officer** role on the project your API key belongs to. The organization owner is **not** exempt: an owner who has not been granted the role gets `403` like anyone else. An individual (non-organization) account cannot hold the role at all, so compliance is an organization-only feature today. A scan is addressed by name in the `X-Enkrypt-Scan` header, within the project its API key belongs to. Message text is never stored: Get Compliance Message fetches it live from the provider, and only while the provider still holds it. paths: /compliance/get-message: get: tags: - Compliance summary: Get Compliance Message description: >- One message's text, fetched **live from the provider**. Message text is never stored, so serving this re-downloads the whole export file the message came from — up to 15 MB for a single message, out of the same rate-limited budget the scan itself uses. **Put it behind a deliberate click.** Never call it from a list view, a hover card or a prefetch: a burst of calls starves the scan that is reading new messages. Allow up to a minute for a response. `X-Enkrypt-Scan` is required, not optional: the scan it names is what scopes the lookup to your own data. `410` is not a failure. It means the file has aged out of the provider's 30-day retention window, which is the normal steady state for anything older than a month; `content_expires_at` on the record says when that will happen. Requires the **governance officer** role on the project your API key belongs to. The organization owner is not exempt — an owner without the role gets `403` — and an individual (non-organization) account cannot hold the role at all. operationId: compliance_get_message parameters: - name: X-Enkrypt-Scan in: header required: true schema: title: Scan Name type: string description: >- The scan's saved name, within the project your API key belongs to. Letters, numbers, spaces and `_ & - . /`; must start and end with a letter or a number; at most 64 characters. example: ChatGPT Enterprise - name: event_id in: query required: true schema: type: string description: The message's event id, as recorded for this scan. example: evt_abc123 responses: '200': description: Successful Response content: application/json: schema: $ref: '#/components/schemas/ComplianceMessage' examples: message: summary: One message value: event_id: evt_abc123 scan_id: 11111111-2222-3333-4444-555555555555 log_file_id: file_abc123 event_type: CONVERSATION_MESSAGE timestamp: '2026-09-23T08:41:07Z' direction: input actor_email: user@example.com conversation_id: conv_abc123 text: The message text, as it was sent. has_files: false file_names: [] content_expires_at: '2026-10-23T08:41:07Z' '400': $ref: '#/components/responses/ComplianceBadRequest' '401': $ref: '#/components/responses/ComplianceUnauthorized' '403': $ref: '#/components/responses/ComplianceForbidden' '404': $ref: '#/components/responses/ComplianceNotFound' '410': description: >- Gone — the provider no longer holds this content. Expected for anything past the 30-day retention window, and not an error to retry. content: application/json: schema: $ref: '#/components/schemas/ComplianceMessageGoneResponse' examples: expired: summary: Aged out upstream value: error: Message content is no longer available from the provider reason: expired detail: log file is past the provider's retention window '500': $ref: '#/components/responses/ComplianceServerError' '502': description: The provider, or the service that reads it, could not be reached. content: application/json: schema: $ref: '#/components/schemas/ComplianceErrorResponse' '503': $ref: '#/components/responses/ComplianceServiceUnavailable' components: schemas: ComplianceMessage: title: ComplianceMessage type: object description: >- One message, fetched live from the provider. Nothing here is stored by Enkrypt. properties: event_id: type: string scan_id: type: string format: uuid log_file_id: type: string description: The export file this message was read from. event_type: type: string nullable: true timestamp: type: string format: date-time nullable: true description: The provider's timestamp for the message. direction: type: string nullable: true description: Whether this was sent to the assistant or returned by it. actor_email: type: string nullable: true description: The workspace member the message belongs to. conversation_id: type: string nullable: true text: type: string nullable: true description: The message text. has_files: type: boolean default: false file_names: type: array items: type: string content_expires_at: type: string format: date-time nullable: true description: >- When this content leaves the provider's retention window, after which the call returns `410`. ComplianceMessageGoneResponse: title: ComplianceMessageGoneResponse type: object description: Body of the `410` from Get Compliance Message. properties: error: type: string example: Message content is no longer available from the provider reason: type: string example: expired detail: type: string description: What the provider said. ComplianceErrorResponse: title: ComplianceErrorResponse type: object description: Error envelope returned by the compliance APIs. properties: error: type: string example: Scan not found ComplianceGatewayErrorResponse: title: ComplianceGatewayErrorResponse type: object description: >- Error envelope returned by the gateway for a request it refuses before it reaches the compliance service — an unknown body field, a value outside an enum, a malformed scan name, or a failed permission check. properties: code: type: integer example: 403 error: type: string example: Forbidden message: type: string example: Access Denied request_id: type: string time: type: number responses: ComplianceBadRequest: description: >- Bad Request — a malformed or non-JSON body, an unknown or unexpected field, a value outside an enum, a missing or malformed `X-Enkrypt-Scan`, a missing `event_id`, out-of-range paging, an empty update, or an attempt to change `provider` / `workspace_id` / `scan_id`. content: application/json: schema: oneOf: - $ref: '#/components/schemas/ComplianceErrorResponse' - $ref: '#/components/schemas/ComplianceGatewayErrorResponse' ComplianceUnauthorized: description: Unauthorized — missing or invalid `apikey` header. content: application/json: schema: $ref: '#/components/schemas/ComplianceGatewayErrorResponse' ComplianceForbidden: description: >- Forbidden — the caller does not hold the **governance officer** role on this project, or the account is an individual (non-organization) account, which cannot hold that role. The organization owner is not exempt: an owner without the role is refused here too. content: application/json: schema: oneOf: - $ref: '#/components/schemas/ComplianceErrorResponse' - $ref: '#/components/schemas/ComplianceGatewayErrorResponse' ComplianceNotFound: description: >- Not Found — no scan of that name in the project your API key belongs to (or, on Get Compliance Message, no record of that `event_id`). content: application/json: schema: $ref: '#/components/schemas/ComplianceErrorResponse' ComplianceServerError: description: Internal Server Error. content: application/json: schema: oneOf: - $ref: '#/components/schemas/ComplianceErrorResponse' - $ref: '#/components/schemas/ComplianceGatewayErrorResponse' ComplianceServiceUnavailable: description: >- Service Unavailable — the scanning service could not be reached or timed out. Calls that only read or write the record are unaffected; only the ones that need the service live fail this way. content: application/json: schema: $ref: '#/components/schemas/ComplianceErrorResponse' securitySchemes: apiKeyAuth: type: apiKey in: header name: apikey ````