C2 API & integration docs

All endpoints run on this Next.js deployment (Vercel). Authenticate with header x-tenant-token from signup.

Core flow

1. POST /api/v1/tenants — create tenant
2. POST /api/v1/compliance/workflows — register + classify
3. GET /api/v1/compliance/eu/annex-iv/:id — Annex IV pack
4. GET /api/v1/compliance/iso/readiness — ISO scorecard
5. POST /api/v1/compliance/china/filing-draft — China draft
6. GET /api/v1/audit/verify — verify hash-chain

Public demo (no auth)

POST /api/v1/compliance/classify — same EU rules as the console; does not persist.

Cron

GET /api/cron/compliance — daily chain verify + inbox pulses. Send Authorization: Bearer $CRON_SECRET when configured.

Agent integration

From any agent runtime, POST workflow metadata on each deploy and store the returned workflow.id. Pull Annex IV JSON into your release checklist. See disclaimer.

Reproducibility

Classifier / ISO scorecard / China draft logic are TypeScript ports of aiteams_core.compliance. Unit tests under test/compliance*.test.ts lock golden vectors.