API
OpenAI-compatible chat completions with automatic framework knowledge. Create keys and buy credits at platform.ismscopilot.com.
The ISMS Copilot API is a model provider for compliance work. You call an OpenAI-compatible chat completions endpoint. That compatibility is how you call it. The product is curated framework knowledge injected before the answer, so you do not assemble a standards corpus yourself.
Why this instead of any foundation-model API: Framework knowledge. Marketing argument: Why the ISMS Copilot API instead of any model.
Status
The API is available through the platform console at platform.ismscopilot.com. You create keys, top up prepaid credits, and call:
https://api.ismscopilot.com/v1Access requires a platform account and a positive prepaid credit balance. Paid ISMS Copilot plans include a one-time USD 10 API credit. Keys can be created in the console once you are signed in; completions debit credits (empty balance fails the request). This is not the same product as chat subscription usage, and not the same token as account MCP (pat-isms-…).
Agent-readable product summary (status, endpoint, aliases): GET https://www.ismscopilot.com/api/public/api/v1. OpenAPI definition of this API: model-api-openapi.json.
Guides
Get an API key and first completion
Create a key, call /v1/chat/completions, and list models.
Set up from Claude Code / Grok
pat-isms scopes, optional MCP mint/checkout (flag-gated), then sk-isms HTTP.
Models and regions
isms-fast, isms-thinking, isms-mini, and the -eu variants.
Framework knowledge
Why this API instead of any model: curated modules, auto/none/pin, public catalog.
Use the API in coding agents
Point opencode, Cline, Cursor, Continue, Aider or any OpenAI SDK at the endpoint as a compliance sub-agent.
The system prompt, in full
Every word we add, plus the controls to change or disable it.
Zero Data Retention (ZDR)
We do not store prompts or outputs; upstream providers are ZDR.
Credits, pricing, and spend limits
Prepaid credits, min top-up, and per-key caps.
Zero Data Retention. The API does not store request content or model outputs in our data layer. Upstream OpenRouter and Mistral paths are ZDR. Usage metadata only is kept for billing. Full detail: Zero Data Retention and the API DPA.
Auth model (short)
| Item | Value |
|---|---|
| Key prefix | sk-isms-… (shown once at creation) |
| Header | Authorization: Bearer sk-isms-… |
| Console | platform.ismscopilot.com/keys |
| Not this plane | Account MCP tokens (pat-isms-…) live under Agents |
What you can build
- Compliance assistants and copilots inside your own product
- Automated drafting of policies, controls and risk assessments
- Compliance-aware summarisation over your own content (you supply the text in the messages)
What this API is not
- It is not the chat web app. Workspaces, memories, and document upload are account/chat features.
- It is not the website Embed / Assistants product (that is a partner widget, billed in EUR reply tiers).
- It is not heyGRC. heyGRC has its own product and docs.
In-console developer notes also live at platform.ismscopilot.com/docs while you are signed in. This docs site is the public, crawlable home for the same surface.