Developers

E-ARI API v1

Programmatic access to your assessments, AI registry, vendor risk results, and compliance controls — pull E-ARI state into your GRC platform, BI stack, or internal dashboards. Read access from the Growth tier; write access on Enterprise.

Authentication

Create a key in Portal → API Keys and send it as a Bearer token. Keys are scoped read or write and can be revoked at any time. Rate limit: 30 requests / 15 minutes per key.

curl https://www.e-ari.com/api/v1/assessments \
  -H "Authorization: Bearer eari_live_..."

Endpoints

GET/api/v1/assessmentsread

Completed assessments with overall score, maturity band, entity type, and per-pillar scores.

GET/api/v1/systemsread

AI system registry — name, purpose, deployer role, risk tier, classification rationale.

GET/api/v1/systems/:idread

Single registry entry including open obligation gaps.

POST/api/v1/systemswrite

Create a registry entry (name, description, purpose, deployerRole, sector).

PATCH/api/v1/systems/:idwrite

Update registry-entry fields.

DELETE/api/v1/systems/:idwrite

Delete a registry entry and its dependent artefacts.

GET/api/v1/vendorsread

Third-party AI vendors with questionnaire status, risk score, tier, and review dates.

GET/api/v1/controlsread

Derived compliance controls: passing / failing / pending per EU AI Act obligation, plus attestation warnings.

Responses & errors

Success responses wrap payloads in { "data": … }. Errors return { "error": "…" } with conventional status codes: 401 (missing/invalid key), 403 (insufficient scope or tier), 404, 429 (rate limit — includes retryAfter). List endpoints return up to 100–200 records, newest first.