Ship compliance features. We maintain the framework knowledge.

The compliance model API. Point your OpenAI SDK at a new base URL; name a framework and its curated module is injected before the answer.

Use the ISMS Copilot API when your own code needs compliance answers: ISMS Copilot maintains curated modules for 150+ frameworks, and the response names the modules that ran.

Create an API key Read the docs →

https://api.ismscopilot.com/v1

First request

curl https://api.ismscopilot.com/v1/chat/completions \
  -H "Authorization: Bearer sk-isms-..." \
  -H "Content-Type: application/json" \
  -d '{
    "model": "isms-fast",
    "messages": [
      {"role": "user", "content": "List 3 ISO 27001 access control requirements."}
    ]
  }'

TL;DR

ISMS Copilot APIAny foundation-model API

Wire

ISMS Copilot APIOpenAI-compatible text-only /v1/chat/completions

Any foundation-model APITokens from a general-purpose model; wire varies by provider

Knowledge

ISMS Copilot APICurated modules, detected or pinned, injected at inference

Any foundation-model APITraining recall plus your system prompt

Who maintains it

ISMS Copilot APIISMS Copilot. Public GET /v1/frameworks catalog

Any foundation-model APIYou own the corpus forever

Disclosure

ISMS Copilot APIx-isms-frameworks header names the modules that ran

Any foundation-model APINo built-in module list on the response

Control

ISMS Copilot APIauto, none, or pin up to 8 catalog ids

Any foundation-model APIRoll your own retrieval

Request content

ISMS Copilot APIDocumented Zero Data Retention for prompts and outputs

Any foundation-model APIOften retained for a limited abuse window

The API in 27 seconds

API or MCP server: pick by who makes the call

APIMCP server

Who makes the call

APIYour own code: your product, CI, scheduled jobs, pipelines

MCP serverYou, inside your AI tool: Claude, ChatGPT, Cursor, Codex or any MCP client

How you connect

APIAn sk-isms key and a new base URL in your OpenAI SDK

MCP serverThe server URL, then sign in (Claude, ChatGPT) or a personal access token (Cursor, Codex)

What you pay with

APIPrepaid API credits, billed per token

MCP serverYour ISMS Copilot chat plan, including Free

Read the API docs →Connect the MCP server →

What comes back

Trimmed. The x-isms-frameworks header and the ismscopilot object tell you which curated modules were injected and how much knowledge went in.

HTTP/1.1 200 OK
x-isms-frameworks: ISO_27001

{
  "model": "isms-fast",
  "choices": [
    { "message": { "role": "assistant", "content": "ISO/IEC 27001:2022 Annex A, control A.5.15 ..." } }
  ],
  "usage": { "prompt_tokens": 1842, "completion_tokens": 312 },
  "ismscopilot": {
    "frameworks": ["ISO_27001"],
    "knowledge_characters": 4926,
    "knowledge_tokens_method": "chars_div_3_v1"
  }
}

Same model, with and without the knowledge

On this frozen 20-task compliance set, the same base model scored differently depending on the scaffold around it; the largest increase came when curated framework knowledge was injected at inference time, especially on less-known frameworks.

Naked: 68.0% overall
Best DIY prompt: 76.0% overall
DIY + knowledge module: 96.9% overall
Full ISMS Copilot: 92.1% overall

The module is the same curated reference ISMS Copilot injects when your question names a framework, and the same one the API exposes. Outside the trap questions, the naked model fabricated 8 control and article identifiers, including an entire invented ISO 42001 Annex A structure. The product fabricated zero. The primary endpoint was frozen in advance: full product versus the better of the two DIY prompts. The pre-registered verdict is a tie, and that is the verdict we report.

Read the benchmark, losses included →

Try the catalog without a key

No key needed. Returns count and registry_hash. 150+ modules; the live catalog is authoritative.

curl https://api.ismscopilot.com/v1/frameworks

Models

The four standard aliases cost $2.80 per million input tokens and $8.80 per million output tokens, on either path. isms-mini costs $0.50 in and $2.00 out. The console stays the billing source of truth.

isms-mini: GLM-5.3-Flash, global, bulk lane, no thinking mode
isms-fast: GLM 5.3, global
isms-thinking: GLM 5.3, global, reasoning
isms-fast-eu: GLM 5.3 hosted by Mistral, EU processing path
isms-thinking-eu: GLM 5.3 hosted by Mistral, EU processing path, reasoning

Framework control

auto detects named frameworks in the conversation, none injects nothing, or pin up to 8 catalog ids. ismscopilot.system: "none" opts out of the persona.

{
  "model": "isms-thinking",
  "messages": [{ "role": "user", "content": "Map A.5.23 to SOC 2." }],
  "ismscopilot": {
    "frameworks": ["ISO_27001", "SOC_2"]
  }
}

One product, customers in many countries

Building a compliance product with its own assistant? Pin each customer's national modules on their requests: NIS_2_NL for a Dutch customer, NIS_2_IT for an Italian one. Every EU member state has its own NIS 2 module (tracking the draft where the national law is still pending), and each request carries only its own, so adding a country never changes answers for the customers you already have.

The response names the modules that ran. Changes to any module are listed at GET /v1/frameworks/changelog.

curl https://api.ismscopilot.com/v1/chat/completions \
  -H "Authorization: Bearer sk-isms-..." \
  -H "Content-Type: application/json" \
  -d '{
    "model": "isms-fast",
    "messages": [
      {"role": "user", "content": "Which NIS 2 incident reports do we owe, and to whom?"}
    ],
    "ismscopilot": { "frameworks": ["NIS_2_NL"] }
  }'

Auth and limits

Key: sk-isms-... shown once, created in the console
Header: Authorization: Bearer sk-isms-...
Keys per user: Up to 20 active, optional spend caps per key by hour, day, week, month
Streaming: Supported on both processing paths
Not supported: Tool calling, JSON mode, n > 1, logprobs, images. Text-only subset.
Thinking floor: max_tokens raised to 1024 on thinking aliases; effective value returned in x-isms-max-tokens-effective

Credits

Billing: Prepaid credits, no subscription
Free first answers: USD 2 once, added when you create a key in the console (accounts with a confirmed email that have never had API credit; while the offer runs)
Minimum top-up: USD 20
Welcome credit: USD 10 once, for paying chat subscribers
Unit rates: platform.ismscopilot.com/pricing

Zero Data Retention

Prompts and outputs are not stored in the API data layer. Console usage history is metadata only. The global path runs on zero-retention upstream endpoints; the EU path runs on Mistral under a commercial ZDR agreement. Request content is never used for training. Usage and billing metadata are retained.

API DPA and subprocessors on the Trust Center →

Works with

Any OpenAI SDK
Swap base_url and the key. Python, Node, Go, Ruby, the rest.
opencode, Continue, Aider, Cline
Custom OpenAI-compatible (text-only) provider pointed at the base URL.
Cursor
Plain chat only, through the Override OpenAI Base URL setting (caveated, not a verified integration). Agent mode sends tool calls this API rejects: use the sub-agent step.
Chat only
LangChain, Vercel AI SDK, n8n, LiteLLM, Cloudflare AI Gateway
Setup guides for each, with framework pinning and the text-only limits stated.
Guides
Claude Code
Cannot use this endpoint as its model backend (Anthropic API shape). Run it as a compliance sub-agent step, or use Account MCP.
Sub-agent

Status: live

Create an sk-isms key at platform.ismscopilot.com/keys and send the first request. Your first answers are free: while the offer runs, an account that has never had API credit gets a one-time USD 2 credit when it creates a key in the console. Machine summary: GET /api/public/api/v1.

Frequently Asked Questions

Is it fully OpenAI-compatible?

It is a documented text-only subset of the chat completions API: no tool calling, no JSON mode, n=1, no logprobs, no images. Streaming works. Existing OpenAI SDKs work once you swap the base URL and the key.

Does it search the standard at request time?

No. Detection is name-level: a named framework in the conversation selects a curated module that is injected before generation. A bare clause number injects nothing. No verbatim ISO or AICPA text is returned.

Which frameworks?

150+ curated modules. GET /v1/frameworks returns the live list with a registry hash and needs no key.

What does it cost?

Your first answers are free: while the offer runs, an account that has never had API credit gets a one-time USD 2 credit when it creates a key in the console. After that, prepaid credits with a USD 20 minimum top-up. Paying chat subscribers get a one-time USD 10 welcome credit instead. Unit rates: $2.80 in and $8.80 out per million tokens for isms-fast, isms-thinking and their -eu twins; $0.50 in and $2.00 out for isms-mini. The console at platform.ismscopilot.com/pricing is the billing source of truth.

Where does it run?

Global aliases run through zero-retention upstream endpoints; the -eu aliases run on Mistral in the EU. The processing region comes back in a response header.

Can I use it from Claude Code?

Not as the model backend; Claude Code speaks the Anthropic API. Use it as a sub-agent step from a script, or connect Account MCP for account-level access.

Send the first request tonight

Create a key and paste the curl. New to the API? Your first answers are free (USD 2 of credit, while the offer runs). The response tells you which modules ran.

Create an API key