Get an API key and first completion

Create an sk-isms key in the platform console and call the OpenAI-compatible chat completions endpoint. Request content is Zero Data Retention.

Prerequisites

An ISMS Copilot account signed in at platform.ismscopilot.com.
A positive prepaid credit balance (buy credits under Credits). Completions debit the balance; an empty balance fails the request.

1. Create a key

Open platform.ismscopilot.com/keys.
Create a key. Give it a name you will recognise later.
Copy the key immediately. It starts with sk-isms- and is shown only once.
Optionally set per-key spend limits (hour / day / week / month).

Active keys are capped at 20 per user. For an agent-driven path after one human Account MCP token (when server flags allow), see Set up from Claude Code or Grok.

2. First request (curl)

curl https://api.ismscopilot.com/v1/chat/completions \
  -H "Authorization: Bearer sk-isms-..." \
  -H "Content-Type: application/json" \
  -d '{
    "model": "isms-fast",
    "messages": [
      {"role": "user", "content": "List 3 ISO 27001 access control requirements."}
    ]
  }'

3. OpenAI SDK (Python)

from openai import OpenAI

client = OpenAI(
    base_url="https://api.ismscopilot.com/v1",
    api_key="sk-isms-...",
)

resp = client.chat.completions.create(
    model="isms-thinking",
    messages=[{"role": "user", "content": "Difference between SOC 2 Type 1 and Type 2?"}],
)
print(resp.choices[0].message.content)

4. OpenAI SDK (Node)

import OpenAI from "openai";

const client = new OpenAI({
  baseURL: "https://api.ismscopilot.com/v1",
  apiKey: "sk-isms-...",
});

const resp = await client.chat.completions.create({
  model: "isms-fast",
  messages: [{ role: "user", content: "Which GDPR articles cover the DPO?" }],
});
console.log(resp.choices[0].message.content);

5. List models

curl https://api.ismscopilot.com/v1/models \
  -H "Authorization: Bearer sk-isms-..."

Without a key the endpoint returns 401 with an authentication error. That is expected.

Prompts and model outputs are not stored in the API data layer. Console usage history shows tokens, cost, model, and status only. Upstream providers are ZDR. Full detail: Zero Data Retention and the API DPA.

Common failures

Symptom	Likely cause
`401`	Missing or wrong `Authorization: Bearer` header; revoked or unknown key
`429` / quota style error	Credit balance empty, or a per-key spend limit hit
Empty answer or `api_error` on `isms-thinking` with a tiny `max_tokens`	Thinking spends budget on reasoning first. Prefer omitting `max_tokens`, or set at least 1024. The API raises lower values to 1024 and returns `x-isms-max-tokens-effective` when it does (see Models and regions).
`400` with "Streaming is not enabled"	The request set `stream: true`. Streaming is not currently enabled on this endpoint; remove `stream` (or set it to `false`) and read the full response.

The first-request curl above omits max_tokens on purpose so the server default applies. That is the safest pattern for both Fast and Thinking.

Treat sk-isms-… like a password. Revoke it in the console if it leaks, and create a new one.

Get an API key and first completion

On this page