API overview
Gamut exposes an HTTP API so you can integrate governance into the rest of your stack, automating inventory, assessments, evidence and reporting rather than doing everything by hand.
Base URL
Section titled “Base URL”The API is served from your Gamut workspace under a versioned prefix:
https://run.gamutassure.com/api/compass/v1/All endpoints sit beneath this prefix. The version segment (v1) lets the API evolve without
breaking existing integrations.
Authentication
Section titled “Authentication”Programmatic access uses bearer tokens, named and revocable API tokens tied to a user,
a workspace, an access level and an expiry. Pass the token in the Authorization header:
Authorization: Bearer <your-token>See Authentication for creating, using and revoking tokens.
What you can do
Section titled “What you can do”The API exposes supported governance resource families described in the resource guide. Not every interactive or administrative operation is a supported public API. Subject to the documented resource, permissions and entitlements, integrations can:
- Keep your AI inventory in sync with other systems.
- Drive or retrieve assessment data.
- Manage evidence and findings programmatically.
- Pull data for external reporting.
- Use workspace-scoped API access within the token’s read-only or read/write boundary.
Two authentication modes
Section titled “Two authentication modes”The API has two distinct authentication paths for two distinct callers:
- Bearer tokens for user-scoped automation against the governance objects above. A token can do only what its owner could do in its bound workspace, within its access level and before its expiry. Token administration remains an interactive account operation and is not available through a bearer token. See Authentication.
- Signed service requests for external agent runtimes, under
/api/compass/v1/external-agent/*. These endpoints (context, model, tool invoke, child-agent request, heartbeat, result) use authenticated, anti-replay service requests rather than user bearer tokens, and every action is brokered through Gateway. This is the path the BYO agent runtime SDK uses; agents act through it but never receive provider credentials.
Conventions
Section titled “Conventions”The API follows consistent conventions for requests, responses and errors. See Conventions & errors.
- Authentication: create and use bearer tokens.
- Conventions & errors: request and response shape.