What you can do
The Secureframe Developer Portal has API documentation and tools for integrating Secureframe with your systems. Use it to automate compliance workflows, pull audit data, or manage users programmatically.
With the Secureframe API, you can:
Automate compliance workflows such as policy management, security training, and access control
Fetch and analyze compliance data, including reports, audit logs, and personnel compliance statuses
Manage users and integrations, including adding personnel, assigning roles, and syncing third-party connections
How to get started
Visit the Secureframe Developer Portal.
Review API authentication and generate API keys in Secureframe.
Explore the API reference and example requests.
Build and test your integration.
Creating your API key
To use the Secureframe API, create an API key in Secureframe.
Important: Only users with the Super Admin access role can see Create API Key. If you are an Admin, the API Keys page loads but the create button does not appear. Ask a Super Admin to change your access role under Personnel, or have them create the key for you.
In Secureframe, open your profile in the top right, then click Company Settings.
Open the API keys tab, then click Create API Key.
Assign an Owner, add an API Key Name, then click Generate Key.
For additional help, contact Secureframe Support. If you are connecting an AI assistant instead of calling the REST API directly, see Secureframe MCP Server: AI-Driven Compliance Insights.
Retrieve evidence via API
A common use case is querying evidence records so you can pull compliance data into dashboards, automate reporting, or speed up audit prep.
Example: use GET /evidences/{id} to return a single evidence record by ID.
curl -X GET "https://api.secureframe.com/evidences/{id}" -H "Authorization: <API_KEY> <API_SECRET>"
Sample response:
{ "data": { "id": "4976feca-6276-4993-bfeb-53cbbbba6f08", "type": "string", "attributes": { }, "relationships": { }, "links": { } }, "includes": { } }
This is useful for audit exports, compliance monitoring, or internal evidence review.
Explore more API use cases
Evidence retrieval is a common starting point. The Developer API also supports workflows such as:
Listing and managing controls and tests
Managing users and their assigned compliance tasks
Automating policy and training assignments
Integrating Secureframe data with external tools or monitoring systems
Visit the Secureframe Developer Portal for the full catalog of endpoints, request and response formats, and interactive documentation.
API base URLs by region
Use the API base URL that matches where your Secureframe instance is hosted.
Region | API Base URL | Example |
US (default) |
| |
UK |
|
Authorization headers are the same across regions:
-H 'Authorization: <API_KEY> <API_SECRET>'
If you are unsure which region your account uses, check your login domain (for example, app-uk.secureframe.com for UK) or contact Secureframe Support.
Frequently Asked Questions (FAQ)
Why don't I see a Create API Key button?
Confirm your access role is Super Admin (not only Admin) on the Personnel page.
Account owner does not always equal Super Admin.
After a Super Admin updates your role, refresh Company Settings → API Keys.
How do I get or create an API key for Secureframe?
In Secureframe, open your profile in the top right, then click Company Settings.
Open the API keys tab, then click Create API Key.
Assign an Owner, add an API Key Name, then click Generate Key.
Note: Only Super Admins can create an API key in Secureframe.
What do I need to include when authenticating with the API?
Include both your API key and secret in the
Authorizationheader.Example:
--header 'Authorization: <YOUR_API_KEY> <YOUR_SECRET_KEY>'Generate and manage keys under Your Profile → Company Settings → API Keys.
Important: API secrets are only viewable once at creation. If the secret is lost, generate a new key.
Can I use just the API key without the secret?
No. Both the API key and the secret must be included in the
Authorizationheader for the request to succeed.
Why can't I retrieve more than 100 users using the per_page parameter?
The Secureframe API enforces a maximum of 100 records per page, even if you pass a higher
per_pagevalue.per_page=200still returns only 100 records.To retrieve more than 100 users, paginate with
pageandper_page=100.Example:
GET /users?per_page=100&page=1, thenGET /users?per_page=100&page=2, and continue until no new results are returned.
Tip: In your script, treat a page with fewer than 100 users as the last page.
How can I find test IDs to export test results programmatically?
Call GET /tests to list tests and their
idvalues.Use those IDs to pull test data or results through your API integration.
Tip: Test IDs appear as long alphanumeric strings under the id field in the response payload.