> ## Documentation Index > Fetch the complete documentation index at: https://docs.enkryptai.com/llms.txt > Use this file to discover all available pages before exploring further. # Modify Compliance Scan > Updates one scan, addressed by name in `X-Enkrypt-Scan`. Send any subset of the mutable fields; only the keys you send are written, and an empty body is a `400`. `provider` and `workspace_id` are **immutable** — sending either is a `400`. A scan whose workspace changed would carry a cursor and a history belonging to something else; delete it and create a new one. Sending a new `compliance_api_key` replaces the stored one, which is how a scan in `needs_reconnect` recovers: the edit re-resolves the key. Renaming is allowed; the new name is what `X-Enkrypt-Scan` must carry afterwards, and it must still be unique in the project (`409` otherwise). Requires the **governance officer** role on the project your API key belongs to. The organization owner is not exempt — an owner without the role gets `403` — and an individual (non-organization) account cannot hold the role at all. ## OpenAPI ````yaml PATCH /compliance/modify-scan openapi: 3.0.0 info: title: Enkrypt AI APIs version: 2.0.0 servers: - url: https://api.enkryptai.com security: - apiKeyAuth: [] tags: - name: Guardrails - name: Code of Conduct - name: Endpoints - name: Redteam description: >- Red Team API: submit red-team / threat-modeling / playground / eval runs, then poll run status, records, results and compliance. Also two-phase threat modeling (categories + data), dataset retrieval, model health, findings and risk mitigation. The previous task-based Red Team API is under **Archived**. - name: Deployments - name: AI Proxy - name: Leaderboard - name: Archived - name: MCP Hub description: >- MCP Hub vulnerability scanning APIs. Submitting scans (the POST endpoints) is open to all authenticated callers. The scan **retrieval** APIs — Get Scan Job Status, Get Complete Scan Results, List Scans, and Get MCP Hub Scan Statistics (the GET endpoints) — are an **enterprise data-license feature**: they require your organization to have MCP Hub API access enabled by Enkrypt, otherwise they return `403`. Contact us at support@enkryptai.com to enable access. - name: MCP Registry Servers - name: MCP Gateways - name: MCP Playground - name: Skill Scanner description: >- Skill Scanner APIs: submit an agent skill (a directory inside a git repository) for security scanning, then read the verdict, the risk level and the full report. Scanning is asynchronous — a scan takes roughly 30–90 seconds, so `POST /skill-hub/scan` returns a `scan_id` you poll. You see your organization's scans and nobody else's. The identity comes from your API key, never from your request — sending `user_email` is a `400`. For an organization or project API key, scans are filed under the **organization**, so every member sees every scan the organization has run, whichever project or member submitted it. For an individual account it is simply your own scans. Either way List Skill Scans needs no parameter to say who you are. - name: Compliance description: >- Compliance APIs: connect a ChatGPT Enterprise workspace, then keep reading its compliance logs and scanning every message through one of your saved guardrails. Every endpoint here — reads as well as writes — requires the **governance officer** role on the project your API key belongs to. The organization owner is **not** exempt: an owner who has not been granted the role gets `403` like anyone else. An individual (non-organization) account cannot hold the role at all, so compliance is an organization-only feature today. A scan is addressed by name in the `X-Enkrypt-Scan` header, within the project its API key belongs to. Message text is never stored: Get Compliance Message fetches it live from the provider, and only while the provider still holds it. paths: /compliance/modify-scan: patch: tags: - Compliance summary: Modify Compliance Scan description: >- Updates one scan, addressed by name in `X-Enkrypt-Scan`. Send any subset of the mutable fields; only the keys you send are written, and an empty body is a `400`. `provider` and `workspace_id` are **immutable** — sending either is a `400`. A scan whose workspace changed would carry a cursor and a history belonging to something else; delete it and create a new one. Sending a new `compliance_api_key` replaces the stored one, which is how a scan in `needs_reconnect` recovers: the edit re-resolves the key. Renaming is allowed; the new name is what `X-Enkrypt-Scan` must carry afterwards, and it must still be unique in the project (`409` otherwise). Requires the **governance officer** role on the project your API key belongs to. The organization owner is not exempt — an owner without the role gets `403` — and an individual (non-organization) account cannot hold the role at all. operationId: compliance_modify_scan parameters: - name: X-Enkrypt-Scan in: header required: true schema: title: Scan Name type: string description: >- The scan's saved name, within the project your API key belongs to. Letters, numbers, spaces and `_ & - . /`; must start and end with a letter or a number; at most 64 characters. example: ChatGPT Enterprise requestBody: required: true content: application/json: schema: $ref: '#/components/schemas/ComplianceModifyScanRequest' examples: replace-key: summary: Replace a rejected key value: compliance_api_key: YOUR_NEW_PROVIDER_COMPLIANCE_KEY change-guardrail-and-cadence: summary: Change the guardrail and slow the poll value: guardrails_name: Stricter Guardrail list_interval_s: 300 rewind-cursor: summary: Re-read from an earlier time value: cursor_end_time: '2026-08-01T00:00:00Z' responses: '200': description: >- Scan updated. `warning` is present only when the record was saved but the scanning service could not be reloaded. content: application/json: schema: $ref: '#/components/schemas/ComplianceScanResponse' examples: updated: summary: Updated value: scan: scan_id: 11111111-2222-3333-4444-555555555555 id: 00000000-1111-2222-3333-444444444444 project_name: default scan_name: ChatGPT Enterprise created_by: 00000000-1111-2222-3333-444444444444 updated_by: 00000000-1111-2222-3333-444444444444 provider: openai workspace_id: 00000000-0000-0000-0000-000000000000 event_types: - CONVERSATION_MESSAGE guardrails_name: Stricter Guardrail cursor_end_time: '2026-09-01T00:00:00Z' cursor_file_id: null last_polled_at: '2026-09-23T10:00:00Z' list_interval_s: 300 pending_cap: 5000 status: active created_at: '2026-09-01T09:00:00Z' updated_at: '2026-09-01T09:00:00Z' '400': $ref: '#/components/responses/ComplianceBadRequest' '401': $ref: '#/components/responses/ComplianceUnauthorized' '403': $ref: '#/components/responses/ComplianceForbidden' '404': $ref: '#/components/responses/ComplianceNotFound' '409': $ref: '#/components/responses/ComplianceConflict' '500': $ref: '#/components/responses/ComplianceServerError' components: schemas: ComplianceModifyScanRequest: title: ComplianceModifyScanRequest type: object description: >- Body of Modify Compliance Scan: any subset of the mutable fields. Only the keys you send are written, so a `status` you omit cannot overwrite a `needs_reconnect` the scanner just set. An empty body is a `400`, and `provider`, `workspace_id` and `scan_id` are rejected outright. properties: scan_name: type: string maxLength: 64 description: >- Rename the scan. Must stay unique in the project; the new name is what `X-Enkrypt-Scan` carries afterwards. guardrails_name: type: string description: Evaluate subsequent messages against a different saved guardrail. event_types: type: array minItems: 1 items: type: string enum: - CONVERSATION_MESSAGE - CODEX_LOG - APP_LOG - CUSTOM_AGENTS_LOG - CHATGPT_PLUGIN_SPREADSHEET cursor_end_time: type: string format: date-time description: >- Move the cursor. Setting it back re-reads that period, as far as the provider's 30-day retention allows. status: type: string enum: - active - paused - disabled description: '`needs_reconnect` is not accepted — only the scanner writes it.' list_interval_s: type: integer minimum: 1 pending_cap: type: integer minimum: 1 compliance_api_key: type: string format: password writeOnly: true description: >- Replace the stored key. This is how a scan in `needs_reconnect` recovers. ComplianceScanResponse: title: ComplianceScanResponse type: object description: >- A write that returns the resulting scan. `warning` appears only when the record was saved but the scanning service could not be reached — the write stands and the scanner reconciles on its next pass. properties: scan: $ref: '#/components/schemas/ComplianceScan' warning: type: string description: >- Present only when the record was written but the scanning service did not respond. ComplianceScan: title: ComplianceScan type: object description: >- One compliance scan. `compliance_api_key` is deliberately absent — no endpoint returns the stored key, in plaintext or masked. properties: scan_id: type: string format: uuid description: >- Enkrypt's id for the scan. Returned for reference; you address a scan by name in `X-Enkrypt-Scan`, never by this. id: type: string format: uuid description: >- The owning account (your organization, or your user for an individual account). project_name: type: string description: >- The project the scan lives in. Taken from your API key, not from the request. scan_name: type: string description: >- The scan's name, unique within the project. This is the value `X-Enkrypt-Scan` carries. created_by: type: string format: uuid description: The platform user who created the scan. updated_by: type: string format: uuid description: >- The platform user who last edited it; the creator until someone else does. provider: type: string enum: - openai - anthropic description: >- The provider the workspace lives on. Immutable after creation. Only `openai` is served today. workspace_id: type: string format: uuid description: The ChatGPT workspace UUID being read. Immutable after creation. event_types: type: array items: type: string enum: - CONVERSATION_MESSAGE - CODEX_LOG - APP_LOG - CUSTOM_AGENTS_LOG - CHATGPT_PLUGIN_SPREADSHEET description: The provider services this scan reads. They share one cursor. guardrails_name: type: string description: The saved guardrail every message is evaluated against. cursor_end_time: type: string format: date-time description: >- How far through the provider's own timeline the scan has read. Set at creation, then advanced by the scan itself. cursor_file_id: type: string nullable: true description: The export file the cursor last sat on. For audit only. last_polled_at: type: string format: date-time nullable: true description: >- Updated on every successful poll, whether or not anything new came back — which is what tells a quiet workspace from a stopped scan. Null until the first poll. list_interval_s: type: integer description: Seconds between polls. default: 60 pending_cap: type: integer description: How many events may be queued before the poller backs off. default: 5000 status: type: string enum: - active - paused - disabled - needs_reconnect description: >- `active` is the only state that reads anything. `needs_reconnect` is written by the scanner when the provider rejects the stored key and can never be sent by a caller. created_at: type: string format: date-time updated_at: type: string format: date-time description: Moved by a user edit only. Cursor advances do not touch it. ComplianceErrorResponse: title: ComplianceErrorResponse type: object description: Error envelope returned by the compliance APIs. properties: error: type: string example: Scan not found ComplianceGatewayErrorResponse: title: ComplianceGatewayErrorResponse type: object description: >- Error envelope returned by the gateway for a request it refuses before it reaches the compliance service — an unknown body field, a value outside an enum, a malformed scan name, or a failed permission check. properties: code: type: integer example: 403 error: type: string example: Forbidden message: type: string example: Access Denied request_id: type: string time: type: number responses: ComplianceBadRequest: description: >- Bad Request — a malformed or non-JSON body, an unknown or unexpected field, a value outside an enum, a missing or malformed `X-Enkrypt-Scan`, a missing `event_id`, out-of-range paging, an empty update, or an attempt to change `provider` / `workspace_id` / `scan_id`. content: application/json: schema: oneOf: - $ref: '#/components/schemas/ComplianceErrorResponse' - $ref: '#/components/schemas/ComplianceGatewayErrorResponse' ComplianceUnauthorized: description: Unauthorized — missing or invalid `apikey` header. content: application/json: schema: $ref: '#/components/schemas/ComplianceGatewayErrorResponse' ComplianceForbidden: description: >- Forbidden — the caller does not hold the **governance officer** role on this project, or the account is an individual (non-organization) account, which cannot hold that role. The organization owner is not exempt: an owner without the role is refused here too. content: application/json: schema: oneOf: - $ref: '#/components/schemas/ComplianceErrorResponse' - $ref: '#/components/schemas/ComplianceGatewayErrorResponse' ComplianceNotFound: description: >- Not Found — no scan of that name in the project your API key belongs to (or, on Get Compliance Message, no record of that `event_id`). content: application/json: schema: $ref: '#/components/schemas/ComplianceErrorResponse' ComplianceConflict: description: Conflict — a scan with that name already exists in this project. content: application/json: schema: $ref: '#/components/schemas/ComplianceErrorResponse' ComplianceServerError: description: Internal Server Error. content: application/json: schema: oneOf: - $ref: '#/components/schemas/ComplianceErrorResponse' - $ref: '#/components/schemas/ComplianceGatewayErrorResponse' securitySchemes: apiKeyAuth: type: apiKey in: header name: apikey ````