Isofy API

Name: Isofy API
Brand: Isofy API
Availability: InStock

★ Only Publicly Available OpenAPI DocumentSecurityCompliancebearer1 EndpointsREST

For Agents

Drive an Isofy ISO compliance workspace through a single GraphQL endpoint — query controls, evidence, and audits or run mutations to log remediation work.

Install Jentic One Beta

Connect the Isofy API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Isofy API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Isofy API.

Query the current control status for an ISO 27001 implementation

Pull the evidence catalogue attached to a specific control

List remediation tasks open across the workspace

Run a GraphQL mutation to create an audit finding or remediation task

GET STARTED

Start building with Isofy API

Explore with Jentic

View OpenAPI Document

Use Cases

Patterns agents use Isofy API for, with concrete tasks.

★ ISO 27001 control status reporting

Generate weekly status reports for an ISO 27001 implementation by sending GraphQL queries to POST /graphql/token. The agent retrieves controls grouped by domain, summarises pass and fail counts, and surfaces controls that have not had evidence refreshed within the policy window. Removes the manual export-to-spreadsheet cycle that compliance teams typically rely on.

Send a GraphQL query for all controls in domain A.5 and return their current status grouped by owner

Automated evidence collection for audits

When an external audit is scheduled, the agent uses POST /graphql/token to enumerate every control linked to the audit scope and pull the most recent evidence reference for each. The output feeds an audit prep workbook so auditors arrive with everything pre-staged. Cuts the prep window from days to hours for a typical ISO audit.

For each control in the upcoming audit scope, run a GraphQL query that returns the latest evidence reference and the date it was uploaded

Continuous remediation task tracking

Track open remediation work surfaced by Isofy by running scheduled GraphQL queries against POST /graphql/token. The agent posts new tasks into a project tracker like Jira, links them back to the originating control, and updates Isofy via a mutation when the tracker task closes. Keeps engineering and compliance views aligned without manual reconciliation.

Query open remediation tasks in Isofy and create a Jira issue for any task without a linked tracker item

AI agent answering compliance posture questions

An AI agent embedded in the security chatops channel answers questions like 'are we compliant on access reviews' by routing through Jentic to POST /graphql/token. The agent searches for 'query Isofy controls' and Jentic loads the operation with the bearer token already in the vault. Reduces the load on the compliance lead for routine status questions.

When asked 'are access reviews up to date', send a GraphQL query for control A.9.2 and return its status

Key Endpoints

1 endpoints — jentic publishes the only available openapi specification for isofy api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/graphql/token

Execute a GraphQL query or mutation against the Isofy schema

POST

/graphql/token

Execute a GraphQL query or mutation against the Isofy schema

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Isofy bearer tokens are stored encrypted in the Jentic vault. Agents never see the raw bearer value — Jentic injects it at execution time and rotates as the workspace policy requires.

Intent-based discovery

Agents search by intent (e.g. 'list ISO controls' or 'create audit finding') and Jentic returns the POST /graphql/token operation pre-loaded with a starter GraphQL query template.

Time to first call

Direct Isofy integration: 1-2 days to learn the GraphQL schema and wire token rotation. Through Jentic: under 1 hour — search, load schema, execute with a templated query.

FAQs

Specific to using Isofy API through Jentic.

Why is there no official OpenAPI spec for Isofy API?

Isofy is GraphQL-first and does not publish an OpenAPI specification. Jentic generates and maintains an OpenAPI wrapper around the single POST /graphql/token endpoint so AI agents and developers can route through it via structured tooling. It is validated against the live API and kept up to date. Get started at https://app.jentic.com/sign-up.

What authentication does the Isofy API use?

Isofy uses bearer token authentication. Tokens are issued under the workspace settings and are scoped to the workspace they originate from. Through Jentic the bearer token is held in the vault — agents receive only a scoped execution token at request time.

Can I run any GraphQL query against this API?

Yes, the single POST /graphql/token endpoint accepts the full breadth of Isofy's GraphQL schema. Use schema introspection on the same endpoint to discover available types and fields before constructing queries.

What are the rate limits for the Isofy API?

Hard rate limits are not declared in the spec. Isofy applies fair-use throttling tied to the workspace plan, with caps that are generous for interactive dashboards but worth confirming before scripting tight polling loops.

How do I list all open remediation tasks through Jentic?

Search Jentic with the query 'list Isofy remediation tasks', load the POST /graphql/token operation, and execute it with a GraphQL query that selects open tasks. The agent receives the response array and can render it directly or feed it into a tracker integration.

Does Isofy support frameworks other than ISO 27001?

Yes — the platform covers SOC 2, ISO 27017, ISO 27018, ISO 22301, and adjacent frameworks. The same GraphQL endpoint serves them; queries reference the relevant control identifiers per framework.