aid: regscale
name: RegScale
description: 'RegScale is a Continuous Controls Monitoring (CCM) and compliance-automation
  company whose cloud-native, OSCAL-native GRC platform keeps organizations continuously
  audit-ready by turning compliance documentation into living, machine-readable data.
  The platform ships as a customer-tenanted deployment (SaaS, hybrid, or on-premises)
  and exposes its data through three programmable surfaces: a JWT-authenticated REST
  API under /api, a HotChocolate-style GraphQL endpoint at /graphql, and a published
  gRPC contract library (rs-data) covering asset, issue and vulnerability ingestion.
  RegScale also publishes a first-party Python CLI/SDK (regscale-cli) that doubles as
  an integration framework for 70+ scanners, cloud providers and ITSM tools, and holds
  FedRAMP High, SOC 2 Type 2, ISO 27001:2022, TX-RAMP Level 2 and CSA STAR credentials.'
url: https://raw.githubusercontent.com/api-evangelist/regscale/refs/heads/main/apis.yml
deliveryModel:
  model: saas
  open_source: false
  commercial: true
  callable_host: false
  label: Hosted service · you call their endpoint
  confidence: medium
  source:
  - pricing
  generated: '2026-08-28'
  method: derived
image: https://regscale.com/wp-content/uploads/2024/04/cropped-Regscale-Favicon-192x192.png
x-type: company
x-source: harvest:secondary-market
specificationVersion: '0.20'
created: '2026-08-26'
modified: '2026-08-26'
tags:
- Company
- Compliance
- Governance Risk and Compliance
- Continuous Controls Monitoring
- Security
- FedRAMP
- OSCAL
- Risk Management
- Audit
- Compliance as Code
- Vulnerability Management
- Government
apis:
- aid: regscale-rest-api
  name: RegScale REST API
  description: 'The RegScale REST API is the primary programmable surface of the RegScale
    platform. It is served from each customer''s own RegScale tenant under the /api
    path, authenticated with a JSON Web Token obtained from /api/authentication/login
    or with a long-lived Personal Access Token issued to a Service Account. Resources
    follow a module/record model (security plans, controls, control implementations,
    assessments, issues, POA&Ms, assets, catalogues, profiles, components, workflows)
    and are related to one another through the ParentId + ParentModule convention.'
  humanURL: https://regscale.readme.io/reference/regscale-api-documentation
  baseURL: https://{your-instance}.regscale.com/api
  tags:
  - Compliance
  - Governance Risk and Compliance
  - Security
  - Audit
  properties:
  - type: Documentation
    url: https://regscale.readme.io/docs/overview
  - type: APIReference
    url: https://regscale.readme.io/reference/regscale-api-documentation
- aid: regscale-graphql-api
  name: RegScale GraphQL API
  description: 'RegScale exposes a GraphQL endpoint at /graphql on each customer tenant,
    used by the first-party RegScale CLI for high-volume paginated reads. Queries follow
    the HotChocolate connection shape - items, totalCount and pageInfo with take/skip
    paging and a where filter object - and are authenticated with the same Bearer token
    as the REST API.'
  humanURL: https://regscale.readme.io/docs/overview
  baseURL: https://{your-instance}.regscale.com/graphql
  tags:
  - GraphQL
  - Compliance
  - Security
- aid: regscale-grpc-ingestion
  name: RegScale gRPC Ingestion Services
  description: 'RegScale publishes a gRPC contract library, rs-data, covering three
    high-volume ingestion services: AssetIngestionService, IssueIngestionService and
    VulnIngestionService. Each service exposes a unary batch create-or-update RPC and
    a server-streaming variant for chunked ingestion, with Bearer-token call credentials
    over TLS.'
  humanURL: https://pypi.org/project/rs-data/
  baseURL: https://{your-instance}.regscale.com
  tags:
  - gRPC
  - Protobuf
  - Vulnerability Management
  properties:
  - type: Protobuf
    url: grpc/regscale-asset-service.proto
  - type: Protobuf
    url: grpc/regscale-issue-service.proto
  - type: Protobuf
    url: grpc/regscale-vuln-service.proto
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
- FN: APIs.json
  email: info@apis.io
common:
- type: DomainSecurity
  url: security/regscale-domain-security.yml
- type: Website
  url: https://regscale.com/
- type: DeveloperPortal
  url: https://regscale.readme.io/
- type: Documentation
  url: https://regscale.readme.io/docs/overview
- type: GettingStarted
  url: https://regscale.readme.io/docs/overview
- type: Support
  url: https://regscale.readme.io/docs/opening-tickets
- type: APIReference
  url: https://regscale.readme.io/reference/regscale-api-documentation
- type: Blog
  url: https://regscale.com/blog/
- type: GitHubOrganization
  url: https://github.com/RegScale
- type: TermsOfService
  url: https://regscale.com/terms-of-service/
- type: PrivacyPolicy
  url: https://regscale.com/privacy-policy/
- type: Security
  url: https://regscale.com/security/
- type: TrustCenter
  url: https://trust.regscale.com/
- type: Compliance
  url: https://regscale.com/security/
- type: ChangeLog
  url: https://regscale.readme.io/changelog
- type: Packages
  url: packages/regscale-packages.yml
- type: SDKs
  url: packages/regscale-packages.yml
- type: CLI
  url: cli/regscale-cli.yml
- type: LLMsTxt
  url: llms/regscale-llms.txt
- type: Conformance
  url: conformance/regscale-conformance.yml
- type: Authentication
  url: authentication/regscale-authentication.yml
- type: Conventions
  url: conventions/regscale-conventions.yml
- type: DataModel
  url: data-model/regscale-data-model.yml
- type: Lifecycle
  url: lifecycle/regscale-lifecycle.yml
- type: ChangeLog
  url: changelog/regscale-changelog.yml
- type: RateLimits
  url: rate-limits/regscale-rate-limits.yml
- type: Plans
  url: plans/regscale-plans-pricing.yml
- type: VulnerabilityDisclosure
  url: security/regscale-vulnerability-disclosure.yml
- type: TrustCenter
  url: security/regscale-trust-center.yml
- type: Idempotency
  url: conventions/regscale-conventions.yml
- type: Protobuf
  url: grpc/regscale-asset-service.proto
- type: Webhooks
  url: https://regscale.readme.io/docs/webhooks
x-enrichment:
  date: '2026-08-26'
  status: enriched
  artifacts_added: 23
  pass: local-v1
x-coverage:
  state: covered
  reason: null
  detail: >-
    RegScale publishes no OpenAPI, but STEP 0b did not come up empty: a first-party gRPC
    contract library (rs-data 1.5.0 on PyPI) yielded three real services and six RPCs, and the
    docs host serves a verbatim llms.txt. The one wall hit was the ReadMe docs host, which
    bot-challenges an ordinary crawler with HTTP 429 on HTML and on most .md paths, so the
    hosted API reference and the webhooks catalog could not be read.
  evidence:
  - url: https://regscale.readme.io/llms.txt
    status: 200
  - url: https://pypi.org/pypi/rs-data/json
    status: 200
  - url: https://regscale.readme.io/reference/regscale-api-documentation
    status: 429
  checked: '2026-08-26'