# Endpoint reference

> Request and response details for every Platform API endpoint.

Source: https://docs.csquaregrc.com/api/endpoints


## Sub-organizations

A sub-organization represents one of your customers. Use your own customer ID as `external_id`.

### GET /sub-orgs

```bash
curl https://YOUR_API_BASE/sub-orgs -H "x-api-key: $CSQUARE_API_KEY"
```

```json
{
  "sub_organizations": [
    { "id": "6f1c…", "external_id": "cust_123", "name": "Northwind", "is_active": true,
      "credit_allocation": 500, "credits_used": 40, "created_at": "2026-09-01T12:00:00Z" }
  ]
}
```

### POST /sub-orgs

| Field | Type | Required | Notes |
| --- | --- | --- | --- |
| `external_id` | string | Yes | Your ID for the customer. |
| `name` | string | Yes | Display name. |
| `credit_allocation` | number | No | Credit cap. `0` means no cap. |
| `config` | object | No | Free-form configuration. |
| `metadata` | object | No | Free-form metadata. |

Returns `201` with `{ "sub_organization": { … } }`, or `429` when your plan's sub-organization limit is reached.

## Checks

All three checks take a `program_id` that must belong to your organization, and an optional `sub_org_id` to charge credits to.

### POST /compliance/check

| Field | Type | Notes |
| --- | --- | --- |
| `program_id` | UUID | Required. |
| `sub_org_id` | UUID | Optional. Charged 5 credits. |
| `scope` | `"quick"` or `"full"` | `quick` runs deterministic rules only and returns fast. |

```bash
curl -X POST https://YOUR_API_BASE/compliance/check \
  -H "x-api-key: $CSQUARE_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"program_id":"2b7e…","sub_org_id":"6f1c…","scope":"quick"}'
```

### POST /aml/status

Returns the AML compliance status for a program, including how the determination was made. 5 credits.

### POST /risk/score

AI risk assessment of a program's gaps. Accepts `depth` (`"quick"`, `"standard"` or `"deep"`). 15 credits.

## Webhooks

### GET /webhooks

Lists subscriptions with `last_triggered_at` and `failure_count`.

### POST /webhooks

| Field | Type | Notes |
| --- | --- | --- |
| `url` | string | Must be `https://` and must not point to a private or reserved address. |
| `events` | string[] | Required, at least one event. |

The response includes a signing `secret`. Store it to verify deliveries.

## Alerts

### GET /alerts

Regulatory and compliance alerts for your tenant: type, title, severity, affected frameworks and jurisdictions, and whether action is required. Pass `unread_only=true` to filter.