curl --request PATCH \
  --url https://api.enkryptai.com/compliance/modify-scan \
  --header 'Content-Type: application/json' \
  --header 'X-Enkrypt-Scan: <x-enkrypt-scan>' \
  --header 'apikey: <api-key>' \
  --data '
{
  "compliance_api_key": "YOUR_NEW_PROVIDER_COMPLIANCE_KEY"
}
'

{
  "scan": {
    "scan_id": "11111111-2222-3333-4444-555555555555",
    "id": "00000000-1111-2222-3333-444444444444",
    "project_name": "default",
    "scan_name": "ChatGPT Enterprise",
    "created_by": "00000000-1111-2222-3333-444444444444",
    "updated_by": "00000000-1111-2222-3333-444444444444",
    "provider": "openai",
    "workspace_id": "00000000-0000-0000-0000-000000000000",
    "event_types": [
      "CONVERSATION_MESSAGE"
    ],
    "guardrails_name": "Stricter Guardrail",
    "cursor_end_time": "2026-09-01T00:00:00Z",
    "cursor_file_id": null,
    "last_polled_at": "2026-09-23T10:00:00Z",
    "list_interval_s": 300,
    "pending_cap": 5000,
    "status": "active",
    "created_at": "2026-09-01T09:00:00Z",
    "updated_at": "2026-09-01T09:00:00Z"
  }
}

{
  "error": "Scan not found"
}

{
  "code": 403,
  "error": "Forbidden",
  "message": "Access Denied",
  "request_id": "<string>",
  "time": 123
}

{
  "error": "Scan not found"
}

{
  "error": "Scan not found"
}

{
  "error": "Scan not found"
}

{
  "error": "Scan not found"
}

⚖️ Compliance API

Modify Compliance Scan

Updates one scan, addressed by name in X-Enkrypt-Scan. Send any subset of the mutable fields; only the keys you send are written, and an empty body is a 400.

provider and workspace_id are immutable — sending either is a 400. A scan whose workspace changed would carry a cursor and a history belonging to something else; delete it and create a new one.

Sending a new compliance_api_key replaces the stored one, which is how a scan in needs_reconnect recovers: the edit re-resolves the key.

Renaming is allowed; the new name is what X-Enkrypt-Scan must carry afterwards, and it must still be unique in the project (409 otherwise).

Requires the governance officer role on the project your API key belongs to. The organization owner is not exempt — an owner without the role gets 403 — and an individual (non-organization) account cannot hold the role at all.

PATCH

compliance

modify-scan

curl --request PATCH \
  --url https://api.enkryptai.com/compliance/modify-scan \
  --header 'Content-Type: application/json' \
  --header 'X-Enkrypt-Scan: <x-enkrypt-scan>' \
  --header 'apikey: <api-key>' \
  --data '
{
  "compliance_api_key": "YOUR_NEW_PROVIDER_COMPLIANCE_KEY"
}
'

{
  "scan": {
    "scan_id": "11111111-2222-3333-4444-555555555555",
    "id": "00000000-1111-2222-3333-444444444444",
    "project_name": "default",
    "scan_name": "ChatGPT Enterprise",
    "created_by": "00000000-1111-2222-3333-444444444444",
    "updated_by": "00000000-1111-2222-3333-444444444444",
    "provider": "openai",
    "workspace_id": "00000000-0000-0000-0000-000000000000",
    "event_types": [
      "CONVERSATION_MESSAGE"
    ],
    "guardrails_name": "Stricter Guardrail",
    "cursor_end_time": "2026-09-01T00:00:00Z",
    "cursor_file_id": null,
    "last_polled_at": "2026-09-23T10:00:00Z",
    "list_interval_s": 300,
    "pending_cap": 5000,
    "status": "active",
    "created_at": "2026-09-01T09:00:00Z",
    "updated_at": "2026-09-01T09:00:00Z"
  }
}

{
  "error": "Scan not found"
}

{
  "code": 403,
  "error": "Forbidden",
  "message": "Access Denied",
  "request_id": "<string>",
  "time": 123
}

{
  "error": "Scan not found"
}

{
  "error": "Scan not found"
}

{
  "error": "Scan not found"
}

{
  "error": "Scan not found"
}

Authorizations

apikey

string

header

required

Headers

X-Enkrypt-Scan

string

required

The scan's saved name, within the project your API key belongs to. Letters, numbers, spaces and _ & - . /; must start and end with a letter or a number; at most 64 characters.

Example:

"ChatGPT Enterprise"

Body

application/json

Body of Modify Compliance Scan: any subset of the mutable fields. Only the keys you send are written, so a status you omit cannot overwrite a needs_reconnect the scanner just set. An empty body is a 400, and provider, workspace_id and scan_id are rejected outright.

scan_name

string

Rename the scan. Must stay unique in the project; the new name is what X-Enkrypt-Scan carries afterwards.

Maximum string length: 64

guardrails_name

string

Evaluate subsequent messages against a different saved guardrail.

event_types

enum<string>[]

Minimum array length: 1

Available options:

CONVERSATION_MESSAGE,

CODEX_LOG,

APP_LOG,

CUSTOM_AGENTS_LOG,

CHATGPT_PLUGIN_SPREADSHEET

cursor_end_time

string<date-time>

Move the cursor. Setting it back re-reads that period, as far as the provider's 30-day retention allows.

status

enum<string>

needs_reconnect is not accepted — only the scanner writes it.

Available options:

active,

paused,

disabled

list_interval_s

integer

Required range: x >= 1

pending_cap

integer

Required range: x >= 1

compliance_api_key

string<password>

write-only

Replace the stored key. This is how a scan in needs_reconnect recovers.

Response

Scan updated. warning is present only when the record was saved but the scanning service could not be reloaded.

A write that returns the resulting scan. warning appears only when the record was saved but the scanning service could not be reached — the write stands and the scanner reconciles on its next pass.

scan

ComplianceScan · object

One compliance scan. compliance_api_key is deliberately absent — no endpoint returns the stored key, in plaintext or masked.

Show child attributes

warning

string

Present only when the record was written but the scanning service did not respond.