Last updated: 2026-08-17 · Audience: developers and product teams choosing a completions API
Why the ISMS Copilot API instead of any model
A generic model API sells tokens. Compliance completions need the framework in the prompt before the model speaks. That is the whole difference: if you already use an OpenAI client, keep the client. Curated knowledge is already loaded.
The short version
- Any model will talk about ISO 27001. It is recalling training data and whatever you stuffed into the system prompt.
- This API detects or pins a framework module, injects that curated reference, and tells you which modules ran.
- Compatibility is not the product. Compatibility is how you call it. The product is the knowledge.
The question this page answers
You already have an OpenAI, Anthropic, Mistral, or xAI key. Your SDK works. Why change the base URL?
Because the hard part of a compliance completion is not generating fluent sentences. It is answering with the right control id, the right edition, and the honesty to say when the ground is missing. A frontier lab optimises for everyone. It does not ship a maintained, pinable catalog of SecNumCloud, HDS, TISAX, or NIS 2 transpositions as first-class modules, and it does not disclose which of those modules ran.
This page is for people wiring completions into a product, an agent, or an internal tool. It is not the chat-product argument (workspaces, SoA generators, uploaded evidence). That lives at Why ISMS Copilot. It is also not the GRC-platform build-vs-buy matrix. That lives at Build vs buy compliance AI.
What fails when you use any model
A system prompt is not a knowledge base
Telling a model "you are an ISO 27001 expert" changes tone. It does not load ISO/IEC 27001:2022 Annex A.5.23, and it does not stop the model inventing a control number that sounds right.
Training recall ages
Frameworks revise. National transpositions diverge. A training cut-off does not receive the Tuesday amendment with a 60-day comment window. A curated module can.
You now own the corpus
The first weekend with a PDF chunker looks like progress. Production is version awareness, refusal when the ground is missing, evals per framework, and a roadmap when a customer asks for a jurisdiction you did not fund.
No disclosure, no debug
When a completion cites the wrong edition, a generic model API does not tell you which of its built-in sources (if any) were used. This API reports the injected module ids on the response. If you run your own retrieval, you can log that yourself.
Side by side
Same SDK. Different job. Column B is any foundation-model completions API used as-is, not a named vendor scorecard.
| Aspect | ISMS Copilot API | Any foundation-model API |
|---|---|---|
| Wire format | OpenAI-compatible POST /v1/chat/completions. Point an existing OpenAI SDK at a new base URL. | Tokens from a general-purpose model. Some providers share this wire; others do not. |
| What is in the prompt | Your messages plus curated framework modules the service selected or you pinned. | Your messages plus whatever system prompt and RAG you assembled. |
| Who maintains the corpus | ISMS Copilot. Public catalog at GET /v1/frameworks. Count moves as modules ship. | You. PDFs, chunkers, embeddings, version pins, and the next amendment. |
| Disclosure | Response headers and body list which modules were injected, plus a knowledge-size estimate. | The provider does not disclose which built-in sources (if any) were used. Your own retrieval can be logged by you. |
| Caller control | ismscopilot.frameworks = "auto" (default), "none", or a pin list (max 8 ids). | Roll your own retrieval, or hope the training cut-off is enough. |
| Intellectual property | Published Reference Integrity policy: identifiers and concise titles; original paraphrase, not verbatim copyrighted standards. | You own the copyright risk of whatever you retrieve and paste. |
| Request-content retention | Documented Zero Data Retention for prompts and outputs in the API data layer; usage metadata only. | Many foundation-model APIs retain request content for a limited abuse-monitoring window unless you contract otherwise. |
What the API actually does
1.You send a normal completion
Authenticate with an
sk-ismskey. Callhttps://api.ismscopilot.com/v1/chat/completionswithisms-fastorisms-thinking(plus-eutwins). Your application code does not change shape.2.The server selects framework modules
Default
autodetects named frameworks in user messages and the last assistant turn. You can pin exact catalog ids, or sendnoneand pay for no knowledge. Valid ids come fromGET /v1/frameworks, which listed 92 modules on 2026-08-17.3.Curated reference is injected, then billed as input
The published server prompt, your instructions, the selected modules, and the Reference Integrity policy are assembled in a documented order. Everything added server-side is part of the prompt and is billed as input tokens. The response tells you which modules ran.
Full control surface and the verbatim prompt text: docs.ismscopilot.com/docs/api/system-prompt. Integrator-facing knowledge page: /docs/api/framework-knowledge.
Honest limits
This is not a claim that the model cannot be wrong. It is a claim that the model is grounded in a maintained reference when a module is selected, and that you can see which one.
1.Detection is name-level in auto mode
Default auto scans the user messages (and the last assistant turn). A bare control id such as 5.23, with no framework name, can inject nothing. Pin the module when you already know the framework.
2.Knowledge is curated, not the standard
Modules carry identifiers, concise titles, and original reference notes. They are not a dump of copyrighted ISO or AICPA text. If a caller asks for verbatim standard language, the published policy is to decline and paraphrase.
3.Your documents stay yours to send
The API does not hold the customer's policies, evidence, or risk register. Put that material in the messages, or retrieve it yourself and pass it in.
4.Guidance, not an audit opinion
Answers are educational compliance guidance. The caller still owns review, risk acceptance, and anything a regulation assigns to a person or a management body.
When any model is still the right call
- The task is general writing, coding, or brainstorming with no framework-grounded claim.
- You already operate a specialist corpus that is the product, and a generic completion path is only the last mile.
- You need a model family this API does not expose as an alias. Aliases are the contract; upstream providers can change.
Hybrid is allowed. Many teams keep a generic model for product copy and call this API only for the compliance step.
Practical next steps
- 1. Read the live docs. Start at docs/api. Do not copy this page into a customer contract without checking the current doc version.
- 2. List the catalog.
GET https://api.ismscopilot.com/v1/frameworksis public. Use the ids you actually need. - 3. Smoke a key. Create an
sk-ismskey at platform.ismscopilot.com/keys, top up prepaid credits, and send one ISO 27001 question. - 4. Need a widget instead? Raw completions are this page. A finished assistant surface is Embed.
Frequently asked questions
Why not just call any model with a compliance system prompt?
A system prompt changes persona. It does not maintain versioned framework modules, detect which module the request needs, inject that module before generation, or disclose what was injected. Those four jobs are the product.
Is the wire different from OpenAI?
No. POST https://api.ismscopilot.com/v1/chat/completions accepts the same request shape and returns the same response shape. Official and community OpenAI SDKs work by changing the base URL and using an sk-isms key. The difference is what the server adds to the prompt.
How many frameworks does it know?
The public catalog listed 92 modules on 2026-08-17 via GET https://api.ismscopilot.com/v1/frameworks. Treat the live endpoint as authoritative. Do not hard-code the number in a pitch deck.
Can I turn knowledge off?
Yes. Send ismscopilot.frameworks = "none". No module is injected and no knowledge tokens are billed for that request. You can also pin up to eight catalog ids. Controls and the published server prompt are documented at docs.ismscopilot.com/docs/api/system-prompt.
Is this the same as the chat app?
No. The API is completions: you send messages, you get a completion, you build the product surface. Chat workspaces, uploads, memories, and audit-shaped tools live on the chat product. Different credentials (sk-isms vs the chat session), different billing (prepaid credits vs subscription).
Does this transfer accountability?
No. If you ship AI inside a product, your organization still answers for what you present. Buying specialist completions reduces the corpus you have to maintain. It does not transfer management-body duties or certification decisions.
Primary sources
- ISMS Copilot API documentation (live product truth: completions, keys, credits, models). docs.ismscopilot.com (checked 2026-08-17).
- API framework knowledge (what is injected, auto/none/pin, honest limits). docs.ismscopilot.com (checked 2026-08-17).
- API system prompt published in full (persona, Reference Integrity, ismscopilot controls, disclosure headers). docs.ismscopilot.com (checked 2026-08-17).
- Public frameworks catalog on the model API (GET /v1/frameworks; count verified on this page's last-updated date). api.ismscopilot.com (checked 2026-08-17).
- OpenAI Chat Completions API reference (the request/response shape this API is compatible with). platform.openai.com (checked 2026-08-17).
Written and maintained by the ISMS Copilot team for API integrators. Last reviewed 2026-08-17.
This is a product argument, not legal advice and not a pricing quote. Product capabilities, retention posture, and commercial terms are defined by live docs, the Trust Center, and the platform console. Where this page summarises those surfaces, the live surface wins on drift. No competitor logos appear here.