The API for continuous compliance evidence.
The StackWeaver API lets a workspace read its own evidence, and lets partner firms work with client evidence from their own systems. It matches the OpenAPI document the portal publishes. Sign in to the Partner Portal to see exactly what's available for your firm today.
Request API access →GET /api/v1/evidenceRead-only, oldest first. Needs a workspace API key with the evidence:read permission.
GET /api/v1/evidence/{eo_id}Read-only. Includes the Evidence Object's review and sign-off decisions.
GET /api/v1/requestsRead-only, oldest first. Needs the requests:read permission.
GET /api/v1/postureRead-only counts per framework. There is no overall score. Needs the posture:read permission.
GET /api/partner/engagementsRuns with your own signed-in portal session; only your firm's engagements come back.
GET /api/partner/evidence-packageRuns with your own signed-in portal session.
POST /api/partner/{id}/reviewThe reviewer recorded is the signed-in caller. Signed-off, superseded or withdrawn evidence cannot be reviewed here.
POST /api/partner/{id}/request-evidenceRuns with your own signed-in portal session.
Sign in to the Partner Portal to see exactly what's enabled for your firm today.
Workflows
Exchange evidence between an authorized client workspace and a partner firm.
- →Read Evidence Objects, requests and per-framework counts (workspace API key, read-only)
- →Retrieve the evidence package for an engagement
- →Ask the client for evidence on a control
Review evidence from your own systems, with the reviewer recorded as the signed-in caller.
- →Approve, reject or request changes on an Evidence Object
- →Signed webhooks when evidence is submitted, accepted or signed off, and when a request is created
- →Upload findings
Structured remediation work with clients, built with partner input.
- →Open remediation requests
- →Track remediation status
- →Verify completed controls
Why firms integrate
The partner endpoints connect a partner firm's workflow to the evidence a client workspace holds, so evidence does not have to travel by email.
Scoped, not shared
The read API uses workspace API keys that a workspace owner or admin creates, with specific read permissions and an optional expiry, and that can be revoked at any time. The partner endpoints run with your own signed-in session, and the database only returns your firm's engagements. The read API allows 600 requests per 10 minutes per key.
Request access →Try the live dashboard →Built for regulated environments.
What's next
Next on the build list: Upload findings, Remediation requests and tracking, Engagement progress tracking, OAuth 2.1 for partner systems, Partner sandbox, SDKs and Model Context Protocol (MCP). Sign up for the Partner Portal to see what's live for your firm today and help us prioritize what ships next.
Apply as a Founding Partner →Common questions
What can the API do?
A workspace owner or admin can create a read-only API key and read that workspace's Evidence Objects, evidence requests and per-framework counts. A partner firm account can list its engagements, retrieve the evidence package for one, request and review evidence, and approve, reject or request changes on an Evidence Object from inside the Partner Portal. Exactly what's live for your firm today is visible once you sign in.
How is access controlled?
The read API uses workspace API keys. A key is shown once when it is created, StackWeaver stores only its SHA-256 fingerprint, and it carries specific permissions (evidence:read, requests:read, posture:read), an optional expiry, and can be revoked at any time. The partner endpoints run with your own signed-in session, and the database only returns your firm's engagements.
Is there a rate limit?
The read API allows 600 requests per 10 minutes per key.
Where is the reference?
The OpenAPI document is published by the portal and is the source for this page. To ask for access or tell us what you need, email [email protected].