canonical: https://jentic.com/apis/isofy.io/isofy # Isofy API Jentic publishes the only available OpenAPI specification for Isofy API, keeping it validated and agent-ready. Isofy is an ISO compliance management platform that exposes a single GraphQL endpoint at POST `/graphql/token.` All resource access - controls, evidence, audits, gaps, and remediation tasks - is driven by GraphQL queries and mutations sent to that endpoint. Authentication is a bearer token tied to the workspace, and queries are templated against the Isofy schema for ISO 27001 and adjacent frameworks. ## For AI agents Drive an Isofy ISO compliance workspace through a single GraphQL endpoint - query controls, evidence, and audits or run mutations to log remediation work. ## Scope Does not handle vulnerability scanning, threat detection, or asset inventory - use for ISO compliance management only. ## Capabilities - Query the current control status for an ISO 27001 implementation - Pull the evidence catalogue attached to a specific control - List remediation tasks open across the workspace - Run a GraphQL mutation to create an audit finding or remediation task - Retrieve the full schema introspection to discover available types and fields ## Use cases ### ISO 27001 control status reporting Generate weekly status reports for an ISO 27001 implementation by sending GraphQL queries to POST `/graphql/token.` The agent retrieves controls grouped by domain, summarises pass and fail counts, and surfaces controls that have not had evidence refreshed within the policy window. Removes the manual export-to-spreadsheet cycle that compliance teams typically rely on. Example prompt: Send a GraphQL query for all controls in domain A.5 and return their current status grouped by owner ### Automated evidence collection for audits When an external audit is scheduled, the agent uses POST `/graphql/token` to enumerate every control linked to the audit scope and pull the most recent evidence reference for each. The output feeds an audit prep workbook so auditors arrive with everything pre-staged. Cuts the prep window from days to hours for a typical ISO audit. Example prompt: For each control in the upcoming audit scope, run a GraphQL query that returns the latest evidence reference and the date it was uploaded ### Continuous remediation task tracking Track open remediation work surfaced by Isofy by running scheduled GraphQL queries against POST `/graphql/token.` The agent posts new tasks into a project tracker like Jira, links them back to the originating control, and updates Isofy via a mutation when the tracker task closes. Keeps engineering and compliance views aligned without manual reconciliation. Example prompt: Query open remediation tasks in Isofy and create a Jira issue for any task without a linked tracker item ### AI agent answering compliance posture questions An AI agent embedded in the security chatops channel answers questions like 'are we compliant on access reviews' by routing through Jentic to POST `/graphql/token.` The agent searches for 'query Isofy controls' and Jentic loads the operation with the bearer token already in the vault. Reduces the load on the compliance lead for routine status questions. Example prompt: When asked 'are access reviews up to date', send a GraphQL query for control A.9.2 and return its status ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | `/graphql/token` | Execute a GraphQL query or mutation against the Isofy schema | ## Key resources - **GraphQL** — Single GraphQL endpoint that exposes the entire Isofy schema for queries and mutations ## Why Jentic - **Setup:** Wiring Isofy by hand means implementing its bearer auth and posting GraphQL queries against a single token endpoint yourself. Through Jentic you install once, import Isofy from the API Directory, store the bearer token once, and your agent calls it. - **Permission scoping:** Isofy exposes one GraphQL token operation, so scope by operation: allow the agent only the POST `/graphql/token` call it needs to read ISO controls and record findings. Because you choose the operations it may run, nothing outside ISO compliance management is reachable. - **Credential handling:** Your Isofy bearer token is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'list ISO controls' or 'create an audit finding', and Jentic returns the matching Isofy operation with its input schema so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **Drata API** — Compliance automation platform with REST endpoints in place of Isofy's GraphQL pattern - **Secureframe API** — Compliance platform with deep SaaS integrations covering similar SOC 2 and ISO 27001 ground - **ComplyAdvantage API** — AML and KYC screening that pairs with ISO compliance workflows for financial-services workspaces ## FAQ ### Why is there no official OpenAPI spec for Isofy API? Isofy is GraphQL-first and does not publish an OpenAPI specification. Jentic generates and maintains an OpenAPI wrapper around the single POST `/graphql/token` endpoint so AI agents and developers can route through it via structured tooling. It is validated against the live API and kept up to date. Get started with Jentic One, the self-hosted execution layer. ### What authentication does the Isofy API use? Isofy uses bearer token authentication. Tokens are issued under the workspace settings and are scoped to the workspace they originate from. Through Jentic the bearer token is held in the vault - agents receive only a scoped execution token at request time. ### Can I run any GraphQL query against this API? Yes, the single POST `/graphql/token` endpoint accepts the full breadth of Isofy's GraphQL schema. Use schema introspection on the same endpoint to discover available types and fields before constructing queries. ### What are the rate limits for the Isofy API? Hard rate limits are not declared in the spec. Isofy applies fair-use throttling tied to the workspace plan, with caps that are generous for interactive dashboards but worth confirming before scripting tight polling loops. ### How do I list all open remediation tasks through Jentic? Search Jentic with the query 'list Isofy remediation tasks', load the POST `/graphql/token` operation, and execute it with a GraphQL query that selects open tasks. The agent receives the response array and can render it directly or feed it into a tracker integration. ### Does Isofy support frameworks other than ISO 27001? Yes - the platform covers SOC 2, ISO 27017, ISO 27018, ISO 22301, and adjacent frameworks. The same GraphQL endpoint serves them; queries reference the relevant control identifiers per framework. ### Can I limit what my agent is allowed to do with the Isofy API? Yes. Because Jentic One is self-hosted, your own rules decide which operations and credentials the agent may use. Isofy exposes a single POST `/graphql/token` operation, so you scope by allowing the agent only that call, and only for the GraphQL queries and mutations you approve, such as reading ISO 27001 control status or logging a remediation task. Anything outside ISO compliance management stays unreachable because you choose the operations it may run.