Install Jentic One Beta

Connect the Isofy API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Isofy API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fisofy.io%2Fisofy" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fisofy.io%2Fisofy" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Isofy API.

Query the current control status for an ISO 27001 implementation

Pull the evidence catalogue attached to a specific control

List remediation tasks open across the workspace

Run a GraphQL mutation to create an audit finding or remediation task

Retrieve the full schema introspection to discover available types and fields

GET STARTED

Start building with Isofy API

Explore with Jentic One

View OpenAPI Document

Use Cases

Patterns agents use Isofy API for, with concrete tasks.

★ ISO 27001 control status reporting

Generate weekly status reports for an ISO 27001 implementation by sending GraphQL queries to POST /graphql/token. The agent retrieves controls grouped by domain, summarises pass and fail counts, and surfaces controls that have not had evidence refreshed within the policy window. Removes the manual export-to-spreadsheet cycle that compliance teams typically rely on.

Send a GraphQL query for all controls in domain A.5 and return their current status grouped by owner

Automated evidence collection for audits

When an external audit is scheduled, the agent uses POST /graphql/token to enumerate every control linked to the audit scope and pull the most recent evidence reference for each. The output feeds an audit prep workbook so auditors arrive with everything pre-staged. Cuts the prep window from days to hours for a typical ISO audit.

For each control in the upcoming audit scope, run a GraphQL query that returns the latest evidence reference and the date it was uploaded

Continuous remediation task tracking

Track open remediation work surfaced by Isofy by running scheduled GraphQL queries against POST /graphql/token. The agent posts new tasks into a project tracker like Jira, links them back to the originating control, and updates Isofy via a mutation when the tracker task closes. Keeps engineering and compliance views aligned without manual reconciliation.

Query open remediation tasks in Isofy and create a Jira issue for any task without a linked tracker item

AI agent answering compliance posture questions

An AI agent embedded in the security chatops channel answers questions like 'are we compliant on access reviews' by routing through Jentic to POST /graphql/token. The agent searches for 'query Isofy controls' and Jentic loads the operation with the bearer token already in the vault. Reduces the load on the compliance lead for routine status questions.

When asked 'are access reviews up to date', send a GraphQL query for control A.9.2 and return its status

Key Endpoints

1 endpoints — jentic publishes the only available openapi specification for isofy api, keeping it validated and agent-ready.

METHOD

PATH

DESCRIPTION

POST

/graphql/token

Execute a GraphQL query or mutation against the Isofy schema

POST

/graphql/token

Execute a GraphQL query or mutation against the Isofy schema

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring Isofy by hand means implementing its bearer auth and posting GraphQL queries against a single token endpoint yourself. Through Jentic you install once, import Isofy from the API Directory, store the bearer token once, and your agent calls it.

Permission scoping

Isofy exposes one GraphQL token operation, so scope by operation: allow the agent only the POST /graphql/token call it needs to read ISO controls and record findings. Because you choose the operations it may run, nothing outside ISO compliance management is reachable.

Credential isolation

Your Isofy bearer token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'list ISO controls' or 'create an audit finding', and Jentic returns the matching Isofy operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

FAQs

Specific to using Isofy API through Jentic.

Why is there no official OpenAPI spec for Isofy API?

Isofy is GraphQL-first and does not publish an OpenAPI specification. Jentic generates and maintains an OpenAPI wrapper around the single POST /graphql/token endpoint so AI agents and developers can route through it via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer.

What authentication does the Isofy API use?

Isofy uses bearer token authentication. Tokens are issued under the workspace settings and are scoped to the workspace they originate from. Through Jentic the bearer token is held in the vault - agents receive only a scoped execution token at request time.

Can I run any GraphQL query against this API?

Yes, the single POST /graphql/token endpoint accepts the full breadth of Isofy's GraphQL schema. Use schema introspection on the same endpoint to discover available types and fields before constructing queries.

What are the rate limits for the Isofy API?

Hard rate limits are not declared in the spec. Isofy applies fair-use throttling tied to the workspace plan, with caps that are generous for interactive dashboards but worth confirming before scripting tight polling loops.

How do I list all open remediation tasks through Jentic?

Search Jentic with the query 'list Isofy remediation tasks', load the POST /graphql/token operation, and execute it with a GraphQL query that selects open tasks. The agent receives the response array and can render it directly or feed it into a tracker integration.

Does Isofy support frameworks other than ISO 27001?

Yes - the platform covers SOC 2, ISO 27017, ISO 27018, ISO 22301, and adjacent frameworks. The same GraphQL endpoint serves them; queries reference the relevant control identifiers per framework.

Can I limit what my agent is allowed to do with the Isofy API?

Yes. Because Jentic One is self-hosted, your own rules decide which operations and credentials the agent may use. Isofy exposes a single POST /graphql/token operation, so you scope by allowing the agent only that call, and only for the GraphQL queries and mutations you approve, such as reading ISO 27001 control status or logging a remediation task. Anything outside ISO compliance management stays unreachable because you choose the operations it may run.

Isofy API

Name: Isofy API
Brand: Isofy API
Availability: InStock

Agent-ready OpenAPI document · curated by JenticSecurityCompliancebearer1 EndpointsREST

Know of an official OpenAPI document? Contribute it →

For Agents

Drive an Isofy ISO compliance workspace through a single GraphQL endpoint - query controls, evidence, and audits or run mutations to log remediation work.

Use for: Get the current status of an ISO 27001 control, List all open remediation tasks in Isofy, Find the evidence linked to a specific control, I want to create an audit finding for a failed control

Not supported: Does not handle vulnerability scanning, threat detection, or asset inventory - use for ISO compliance management only.

Jentic publishes the only available OpenAPI specification for Isofy API, keeping it validated and agent-ready. Isofy is an ISO compliance management platform that exposes a single GraphQL endpoint at POST /graphql/token. All resource access - controls, evidence, audits, gaps, and remediation tasks - is driven by GraphQL queries and mutations sent to that endpoint. Authentication is a bearer token tied to the workspace, and queries are templated against the Isofy schema for ISO 27001 and adjacent frameworks.

Jentic One on Github View OpenAPI Document