# MetricStream

**Canonical:** https://apis.io/providers/metricstream/  
**Website:** https://www.metricstream.com/  
**APIs profiled:** 8

MetricStream is a San Jose, California based enterprise software company and a market leader in integrated Governance, Risk, and Compliance (GRC) management, serving large regulated organizations across banking and financial services, insurance, healthcare, life sciences, energy, utilities, telecom, technology and manufacturing. Its AI-first Connected GRC platform unifies enterprise and operational risk, regulatory and corporate compliance, policy and document management, internal audit and SOX, IT and cyber risk, third-party and vendor risk, operational resilience and business continuity, ESG, and case and incident management on one data core. MetricStream publishes a public API developer portal describing its Business REST APIs — a family of OpenAPI-derived REST modules covering GRC Foundation objects, Issues, Loss Event Management, Metrics, Risk Assessments, Regulatory Engagements, Surveys and Self Assessment & Testing — that customers, partners and internal developers use to move GRC data in and out of a MetricStream instance over HTTPS.

## Kin Score — 29.9 / 100 (thin)

Scored 2026-09-02 under rubric 0.18.0. Trend: flat (+0.0 from 29.9).

| Facet | Score |
|---|---|
| Discoverability | 81.5 |
| Contract Quality | 0.0 |
| Governance | 0.0 |
| Contract Governance | 0.0 |
| Operational Transparency | 18.4 |
| Developer Ergonomics | 47.0 |
| Commercial Clarity | 50.0 |
| Access Clarity | 50.0 |

## Agent readiness — 8.8 (agent-aware)

| Dimension | Value |
|---|---|
| Spec Presence | no |
| Agentic Access | no |
| Reversibility Documented | no |
| MCP Server | no |
| Auth Clarity | bearer |
| Idempotency | no |
| Error Semantics | documented |
| OpenAPI Examples | no |
| Rate Limit Signal | documented |
| Event Surface Described | no |
| Agent Skills | derived |
| Well Known Catalog | no |
| Consent Identity | no |
| Agent Card | no |
| Dry Run Mode | no |
| Delegated Identity | no |
| Protected Resource Metadata | no |
| Dynamic Client Registration | no |
| Agentic Commerce | no |

## Access

Open access — onboarding: open, pricing: unknown, trial: no (confidence: medium).

## APIs (8)

- **MetricStream GRC Foundation APIs** — Business REST APIs over the GRC Foundation object model — Area of Compliance, Asset, Asset Class, Control, Evidence, Exception, Financial Accounts, Function, Framework/Model Ref...
- **MetricStream Issues APIs** — Business REST APIs for the Issues module — reporting issues and viewing issue details, so first-line users and upstream systems can flag weaknesses, gaps in internal controls an...
- **MetricStream Loss Event Management APIs** — Business REST APIs for operational loss data — internal and external loss events, impacts, approval (loss) rules, default currency configuration and risk/regulatory event type m...
- **MetricStream Metrics APIs** — Business REST APIs for KRI/KPI metric definitions and metric data entry — create and maintain metric definitions and post metric data points into the GRC platform.
- **MetricStream Risk Assessments APIs** — Business REST APIs for risk assessment tasks and the setup of risk aggregation weights used when rolling assessment scores up a risk hierarchy.
- **MetricStream Regulatory Engagements APIs** — Business REST APIs for the Regulatory Engagement module — engagements with regulators and the tasks raised under them.
- **MetricStream Surveys APIs** — Business REST APIs for the Survey/Questionnaire module — creating questionnaires and initiating survey, scorecard and certification campaigns.
- **MetricStream Self Assessment & Testing APIs** — Business REST APIs for the Compliance module's test and self-assessment plans — creating and maintaining the plans that drive control testing cycles.

## Security (4)

- **Metricstream Authentication** — 0 schemes
- **Metricstream Domain Security** — TLSv1.3 · HSTS · DNSSEC · DMARC
- **Metricstream Vulnerability Disclosure** — Hackerone
- **Metricstream Trust Center** — ISO 27001, SOC 2 Type II, HIPAA

## Plans (1)

- **Metricstream Plans Pricing**

## Tags

Company, Governance, Risk, Compliance, GRC, Audit, Enterprise Software, Regulatory Technology, Cyber Risk, Third-Party Risk, Operational Resilience, ESG

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/providers/metricstream/). Scores are computed from the provider's own public artifacts under a published rubric.