Use the API in n8n

n8n can call the ISMS Copilot API in two ways. The HTTP Request node gives you the full request, including framework pins and the response headers. The OpenAI Chat Model node with a custom base URL is quicker to wire, for plain chat in a chain.

Option 1: HTTP Request node (recommended)

1. Create a credential of type Header Auth: name Authorization, value Bearer sk-isms-…. Keep the key in the credential, never in the node body.
2. Add an HTTP Request node:
   • Method: POST
   • URL: https://api.ismscopilot.com/v1/chat/completions
   • Authentication: Generic Credential Type, Header Auth, the credential above
   • Send Body: on, Body Content Type: JSON, Specify Body: Using JSON
   • Options, Response: Include Response Headers and Status, if you want the disclosure header; Never Error on, so error responses reach the next node
3. Body:

{
  "model": "isms-fast",
  "messages": [
    { "role": "user", "content": {{ JSON.stringify($json.question) }} }
  ],
  "ismscopilot": { "frameworks": ["NIS_2_BE"] }
}

The answer is at choices[0].message.content. The injected modules are in the x-isms-frameworks response header and in the ismscopilot.frameworks field of the body, which you can store next to the answer.

To pin per item (for example per customer country), build the array in an expression:

"ismscopilot": { "frameworks": {{ JSON.stringify([ "NIS_2_" + $json.country, "GDPR" ]) }} }

Make sure every value is a real catalog id: an unknown id returns 400 with code framework_not_found. The catalog is at GET https://api.ismscopilot.com/v1/frameworks (no key needed).

Option 2: OpenAI Chat Model with a custom base URL

1. Create an OpenAI credential. Paste the sk-isms- key as the API key and set Base URL to https://api.ismscopilot.com/v1.
2. In a Basic LLM Chain, attach an OpenAI Chat Model sub-node with that credential. Choose the model by ID: isms-fast, isms-thinking, isms-fast-eu, isms-thinking-eu or isms-mini.
3. If your n8n version shows a Use Responses API option on the model node, turn it off. The ISMS Copilot API serves chat completions only; /v1/responses returns 404.

Limits of this route: no framework pins (the node does not send the ismscopilot field), so the API uses auto and only injects a module when the question names a framework. Name it ("Under ISO 27001…", "For GDPR…"), or use Option 1.

The credential test only calls GET /v1/models. A passing test does not prove the node's runtime call works, so run the chain once to check.

Errors in workflows

With Continue On Fail, the HTTP Request node passes on n8n's own error object, not our error body. Instead, in the HTTP Request node set Options, Response, Never Error to on (plus Include Response Headers and Status), then branch on {{ $json.body.error.code }} and {{ $json.statusCode }}. With Include Response Headers and Status off, the code is at {{ $json.error.code }}.

• insufficient_quota (HTTP 429): the prepaid balance is empty. Alert a person; retrying will not help.
• rate_limit_exceeded (HTTP 429): wait the Retry-After seconds. Retry On Fail with a wait handles it.
• framework_not_found, context_length_exceeded (HTTP 400): fix the request.

Full list: Errors and error codes.

Limits

• Text in, text out. No tools, no JSON mode, n is 1, no images.
• n8n saves execution data, including request and response bodies, under your own instance settings. That copy is outside our Zero Data Retention. To keep prompts and answers out of it, set Workflow settings, Save successful production executions to Do not save, or set EXECUTIONS_DATA_SAVE_ON_SUCCESS=none on the instance.
• The steps above follow n8n's OpenAI credential and node options as documented by n8n and community guides, checked 2026-10-28; we did not run them on every n8n version. Labels move between releases.

Related

• Get an API key and first completion
• Serve customers in many countries
• Credits, pricing, and spend limits