RegScale

aid: regscale
name: RegScale
description: 'RegScale is a Continuous Controls Monitoring (CCM) and compliance-automation company whose cloud-native, OSCAL-native
  GRC platform keeps organizations continuously audit-ready by turning compliance documentation into living, machine-readable
  data. The platform ships as a customer-tenanted deployment (SaaS, hybrid, or on-premises) and exposes its data through three
  programmable surfaces: a JWT-authenticated REST API under /api, a HotChocolate-style GraphQL endpoint at /graphql, and a
  published gRPC contract library (rs-data) covering asset, issue and vulnerability ingestion. RegScale also publishes a first-party
  Python CLI/SDK (regscale-cli) that doubles as an integration framework for 70+ scanners, cloud providers and ITSM tools,
  and holds FedRAMP High, SOC 2 Type 2, ISO 27001:2022, TX-RAMP Level 2 and CSA STAR credentials.'
url: https://raw.githubusercontent.com/api-evangelist/regscale/refs/heads/main/apis.yml
deliveryModel:
  model: saas
  open_source: false
  commercial: true
  callable_host: false
  label: Hosted service · you call their endpoint
  confidence: medium
  source:
  - pricing
  generated: '2026-08-28'
  method: derived
accessModel:
  pricing: unknown
  onboarding: unknown
  trial: false
  try_now: false
  public: false
  label: Unknown
  confidence: low
  probe_state: covered
  source:
  - authentication
  - rate-limits
  - security
  generated: '2026-11-06'
  method: derived
image: https://regscale.com/wp-content/uploads/2024/04/cropped-Regscale-Favicon-192x192.png
x-type: company
x-source: harvest:secondary-market
specificationVersion: '0.20'
created: '2026-08-26'
modified: '2026-10-06'
x-docs-platform: readme
x-docs-platform-confidence: high
x-docs-platform-checked: 2026-10-04
tags:
- Company
- Compliance
- Governance Risk and Compliance
- Continuous Controls Monitoring
- Security
- FedRAMP
- OSCAL
- Risk Management
- Audit
- Compliance as Code
- Vulnerability Management
- Government
apis:
- aid: regscale:regscale-rest-api
  name: RegScale REST API
  description: The RegScale REST API is the primary programmable surface of the RegScale platform. It is served from each
    customer's own RegScale tenant under the /api path, authenticated with a JSON Web Token obtained from /api/authentication/login
    or with a long-lived Personal Access Token issued to a Service Account. Resources follow a module/record model (security
    plans, controls, control implementations, assessments, issues, POA&Ms, assets, catalogues, profiles, components, workflows)
    and are related to one another through the ParentId + ParentModule convention.
  humanURL: https://regscale.readme.io/reference/regscale-api-documentation
  baseURL: https://{your-instance}.regscale.com/api
  tags:
  - Compliance
  - Governance Risk and Compliance
  - Security
  - Audit
  properties:
  - type: Documentation
    url: https://regscale.readme.io/docs/overview
  - type: APIReference
    url: https://regscale.readme.io/reference/regscale-api-documentation
- aid: regscale:regscale-graphql-api
  name: RegScale GraphQL API
  description: RegScale exposes a GraphQL endpoint at /graphql on each customer tenant, used by the first-party RegScale CLI
    for high-volume paginated reads. Queries follow the HotChocolate connection shape - items, totalCount and pageInfo with
    take/skip paging and a where filter object - and are authenticated with the same Bearer token as the REST API.
  humanURL: https://regscale.readme.io/docs/overview
  baseURL: https://{your-instance}.regscale.com/graphql
  tags:
  - GraphQL
  - Compliance
  - Security
- aid: regscale:regscale-grpc-ingestion
  name: RegScale gRPC Ingestion Services
  description: 'RegScale publishes a gRPC contract library, rs-data, covering three high-volume ingestion services: AssetIngestionService,
    IssueIngestionService and VulnIngestionService. Each service exposes a unary batch create-or-update RPC and a server-streaming
    variant for chunked ingestion, with Bearer-token call credentials over TLS.'
  humanURL: https://pypi.org/project/rs-data/
  baseURL: https://{your-instance}.regscale.com
  tags:
  - gRPC
  - Protobuf
  - Vulnerability Management
  properties:
  - type: Protobuf
    url: grpc/regscale-asset-service.proto
  - type: Protobuf
    url: grpc/regscale-issue-service.proto
  - type: Protobuf
    url: grpc/regscale-vuln-service.proto
maintainers:
- FN: Kin Lane
  email: kin@apievangelist.com
- FN: APIs.json
  email: info@apis.io
common:
- url: https://regscale.com/feed/
  type: BlogRSS
- type: DomainSecurity
  url: security/regscale-domain-security.yml
- type: Website
  url: https://regscale.com/
- type: DeveloperPortal
  url: https://regscale.readme.io/
- type: Documentation
  url: https://regscale.readme.io/docs/overview
- type: GettingStarted
  url: https://regscale.readme.io/docs/overview
- type: Support
  url: https://regscale.readme.io/docs/opening-tickets
- type: APIReference
  url: https://regscale.readme.io/reference/regscale-api-documentation
- type: Blog
  url: https://regscale.com/blog/
- type: GitHubOrganization
  url: https://github.com/RegScale
- type: TermsOfService
  url: https://regscale.com/terms-of-service/
- type: PrivacyPolicy
  url: https://regscale.com/privacy-policy/
- type: Security
  url: https://regscale.com/security/
- type: TrustCenter
  url: https://trust.regscale.com/
- type: Compliance
  url: https://regscale.com/security/
- type: ChangeLog
  url: https://regscale.readme.io/changelog
- type: Packages
  url: packages/regscale-packages.yml
- type: SDKs
  url: packages/regscale-packages.yml
- type: CLI
  url: cli/regscale-cli.yml
- type: LLMsTxt
  url: llms/regscale-llms.txt
- type: Conformance
  url: conformance/regscale-conformance.yml
- type: Authentication
  url: authentication/regscale-authentication.yml
- type: Conventions
  url: conventions/regscale-conventions.yml
- type: DataModel
  url: data-model/regscale-data-model.yml
- type: Lifecycle
  url: lifecycle/regscale-lifecycle.yml
- type: ChangeLog
  url: changelog/regscale-changelog.yml
- type: RateLimits
  url: rate-limits/regscale-rate-limits.yml
- type: Plans
  url: plans/regscale-plans-pricing.yml
- type: VulnerabilityDisclosure
  url: security/regscale-vulnerability-disclosure.yml
- type: TrustCenter
  url: security/regscale-trust-center.yml
- type: Idempotency
  url: conventions/regscale-conventions.yml
- type: Protobuf
  url: grpc/regscale-asset-service.proto
- type: Webhooks
  url: https://regscale.readme.io/docs/webhooks
x-enrichment:
  date: '2026-08-26'
  status: enriched
  artifacts_added: 23
  pass: local-v1
x-coverage:
  state: covered
  reason: null
  detail: 'RegScale publishes no OpenAPI, but STEP 0b did not come up empty: a first-party gRPC contract library (rs-data
    1.5.0 on PyPI) yielded three real services and six RPCs, and the docs host serves a verbatim llms.txt. The one wall hit
    was the ReadMe docs host, which bot-challenges an ordinary crawler with HTTP 429 on HTML and on most .md paths, so the
    hosted API reference and the webhooks catalog could not be read.'
  evidence:
  - url: https://regscale.readme.io/llms.txt
    status: 200
  - url: https://pypi.org/pypi/rs-data/json
    status: 200
  - url: https://regscale.readme.io/reference/regscale-api-documentation
    status: 429
  checked: '2026-08-26'