OpenAI-compatible compliance API quickstart

1. Create an API key

3. Same request with the OpenAI SDK

Point the official OpenAI SDK at the ISMS Copilot base URL. For the documented text-only chat completions subset, that is the only integration change. Do not send tool definitions.

Python

from openai import OpenAI

client = OpenAI(
    base_url="https://api.ismscopilot.com/v1",
    api_key="sk-isms-...",
)

resp = client.chat.completions.create(
    model="isms-thinking",
    messages=[{"role": "user", "content": "Difference between SOC 2 Type 1 and Type 2?"}],
)
print(resp.choices[0].message.content)

Node.js

import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://api.ismscopilot.com/v1",
  apiKey: "sk-isms-...",
});

const resp = await client.chat.completions.create({
  model: "isms-fast",
  messages: [{ role: "user", content: "Which GDPR articles cover the DPO?" }],
});
console.log(resp.choices[0].message.content);

Reading the live frameworks catalog

Default auto-detection scans user messages and the last assistant turn, not system or developer messages. Pin catalog ids when you already know the framework. To list what the catalog currently covers, call the public endpoint directly:

curl https://api.ismscopilot.com/v1/frameworks

No key required for this endpoint. It returned 132 entries on 2026-09-30, each with an id, name, region, and version. Treat the live response as authoritative; do not hard-code the count.

Next steps

1. 1. Set a spend cap. Do this before you wire the key into anything that calls it in a loop.
2. 2. Read the system prompt page. If you need to understand exactly what framing the model receives, docs/api/system-prompt publishes it in full.
3. 3. Wire it as a sub-agent. Tool-using coding agents should call this endpoint as a compliance step, not as their global model. See the compliance sub-agent guide. For why this API instead of any model, see the vs-any-model argument.
4. 4. Decide API vs Embed. If what you actually want is a finished chat widget rather than raw completions, see ISMS Copilot Embed instead.
5. 5. Keep accountability clear. A compliance-literate completion is not a certification decision. Pair this with the agent accountability guide if your product surfaces answers to end customers.
6. 6. Put the data posture in writing. Residency and retention are two different guarantees; how to read both on any vendor, and what persists anyway, in the data-guarantees guide.

Primary sources

• ISMS Copilot API documentation (live product truth). docs.ismscopilot.com (checked 2026-09-07).
• Get an API key and first completion (steps, curl, Python, Node examples). docs.ismscopilot.com (checked 2026-09-07).
• Models and regions (alias list, EU vs global paths). docs.ismscopilot.com (checked 2026-09-07).
• Framework knowledge (how detection works). docs.ismscopilot.com (checked 2026-09-07).
• Zero Data Retention (request content posture, what is retained as metadata). docs.ismscopilot.com (checked 2026-09-07).
• Credits, pricing, and spend limits. docs.ismscopilot.com (checked 2026-09-07).
• Public frameworks catalog (GET /v1/frameworks; count verified on this page's last-updated date). api.ismscopilot.com (checked 2026-09-07).
• OpenAI API reference for chat completions (industry shape this endpoint targets). platform.openai.com (checked 2026-09-07).

Written and maintained by the ISMS Copilot team for API integrators. Last reviewed 2026-09-07.

This is a developer quickstart, not a pricing quote or legal advice. Product capabilities, retention posture, and commercial terms are defined by live docs, the Trust Center, and the platform console. Where this page summarizes those surfaces, the live surface wins on drift.