Connect
Read API, webhooks and single sign-on
Let your other systems read the state of your AI governance, and let your team sign in with the credentials it already uses.
What it is for
With a read-only key, other systems in your organisation — a dashboard, a BI or risk tool — read your Alethexis records without exporting them by hand.
A webhook notifies your system as soon as something happens in your organisation, without it having to poll the API. The API answers when asked; the webhook notifies.
With single sign-on, your team signs in to Alethexis with the credentials it already uses in Microsoft Entra ID or Google Workspace. The Owner manages all three, and they are available in M2 and M3.
How it works
A read-only API
Eight resources with an organisation key: AI systems, classifications, controls, evidence index, sections, approvals, audit log and AI use requests. Paginated lists and a date filter. Each key allows 120 requests per minute and 10,000 per day, and there can be up to 10 active keys at a time.
Keys that are never shown again
The key is shown only once: Alethexis keeps only its SHA-256 hash. Once revoked, it stops working immediately. Its creation and revocation are recorded in the audit log, with the prefix and never the key.
Webhooks by event
You register an https address and choose which of nine events to receive: sections closed and reopened, systems created and reclassified, high risks, approvals registered, evidence uploaded, requests decided and corrective actions on an own product. Each delivery is attempted up to five times, with increasing waits, and failed ones can be retried by hand.
HMAC verification header
Each delivery carries the “Alethexis-Signature” header with an HMAC-SHA256 of the timestamp and the body, computed with the endpoint secret; your system recomputes and compares it before accepting the delivery. The documentation includes an example in Node.js and another in Python.
Single sign-on
Through SAML, with Microsoft Entra ID or Google Workspace, over your organisation's email domains. You test it before switching it on and, once it works, you can require members to sign in through single sign-on only. No extra cost.
What you get
OpenAPI specification
The public API documentation covers the headers, the filters for each resource, the error codes, the fields of each webhook event and the OpenAPI specification of the resources.
FAQ
- Does the API return personal data?
- No. By design, it does not include fields intended for personal data (authors, emails, IP addresses, changed values) or hand-written text. System and tool names are set by your organisation: do not put personal data in them.
- Can I write to Alethexis through the API?
- No. The API is read-only: it does not create, change or delete anything in the platform.
- What data does a webhook carry?
- Payloads carry identifiers, states and dates: never names, free text or personal data. The detail is read afterwards with the read API, using the identifiers in the payload.
- Does single sign-on create users or bring in roles?
- It does not create users on its own: someone who signs in through SSO without a prior invitation does not join any organisation. It does not sync groups or roles from your provider: roles are assigned in Alethexis.