Developer Compliance Copilot

API Documentation

Integrate AI compliance checking directly into your development workflow. Analyze systems, monitor compliance status, and receive actionable recommendations through our REST API.

Try the API Explorer OpenAPI Spec

Getting Started

Get up and running with the Arcus Copilot API in minutes. Follow these steps to start analyzing your AI systems for regulatory compliance.

Compliance Analysis

Analyze AI systems against global regulations including EU AI Act, Colorado SB 205, and more.

Real-time Status

Monitor compliance status, readiness scores, and active alerts for registered AI systems.

Generate an API Key
Navigate to Settings → API Keys in your Arcus dashboard. Create a new key with at least read permission. Your key will look like arc_xxxxxxxxxxxx.

Make Your First Request

Use the API key as a Bearer token in the Authorization header. Try the compliance check endpoint:

cURL

curl -X POST https://www.arcus-ai.app/api/copilot/check \
  -H "Authorization: Bearer arc_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
    "system_description": "An AI hiring tool that screens resumes",
    "use_case": "hiring",
    "deployment_regions": ["eu", "us_colorado"]
  }'

Review the Response
The API returns a risk level, applicable jurisdictions, key obligations, and actionable recommendations. Use these to inform your compliance strategy.

Authentication

All API endpoints require authentication via API key. Your key is linked to your organization and determines rate limits based on your subscription plan.

API keys are organization-scoped.

All requests are authenticated and rate-limited at the organization level. Generate keys at Settings → API Keys.

Authorization Header

Include your API key in the Authorization header using the Bearer scheme:

HTTP Header

Authorization: Bearer arc_your_api_key_here

Key Permissions

Your API key must have at least read permission to access copilot endpoints. Keys with insufficient permissions will receive a 403 Forbidden response.

Permission	Access	Description
`read`	Required	Access compliance check and system status endpoints
`manage`	Optional	Full access, including read

Keep your API key secure.

Never commit keys to source control or expose them in client-side code. Use environment variables or a secrets manager.

Endpoints

The Copilot API provides two endpoints: one for analyzing AI systems and another for checking compliance status of registered systems.

POST /api/copilot/check

Analyze an AI system description against the regulation database. Powered by Claude Sonnet 4 to identify risk levels, applicable jurisdictions, key obligations, and actionable recommendations.

Request Body

Parameter	Type	Description
system_descriptionRequired	string	Detailed description of the AI system to analyze. Max 5,000 characters.
use_caseOptional	string	Use case category: hiring, credit, healthcare, content, surveillance, etc.
data_typesOptional	string[]	Types of data processed: personal_data, biometric, financial, health, etc.
deployment_regionsOptional	string[]	Deployment regions: eu, us_colorado, us_california, uk, au, cn, kr, etc.
affected_individualsOptional	string	Description of individuals affected by the AI system.
risk_categoryOptional	string	Suggested risk category if already known by the developer.

Response (200)

Response

{
  "success": true,
  "data": {
    "risk_level": "high",
    "confidence": 0.92,
    "applicable_jurisdictions": [
      {
        "jurisdiction_key": "eu_ai_act",
        "jurisdiction_name": "EU AI Act",
        "risk_classification": "high_risk",
        "applicable": true,
        "reason": "Employment-related AI system under Annex III"
      }
    ],
    "key_obligations": [
      {
        "title": "Conformity Assessment",
        "description": "High-risk AI system requires conformity assessment",
        "jurisdiction": "EU AI Act",
        "priority": "critical",
        "legal_reference": "Article 43",
        "deadline_info": "Before placing on market"
      }
    ],
    "recommendations": [
      {
        "title": "Implement Human Oversight",
        "description": "Ensure human can override AI decisions",
        "urgency": "immediate",
        "estimated_effort": "2-4 weeks"
      }
    ],
    "summary": "This AI hiring tool is classified as high-risk..."
  },
  "meta": {
    "model_used": "claude-sonnet-4-20250514",
    "analysis_time_ms": 3450,
    "input_tokens": 1200,
    "output_tokens": 800
  }
}

GET /api/copilot/systems/{systemId}/status

Returns the current compliance status for a registered AI system, including readiness scores, obligation summaries, risk assessments, active alerts, and watchtower monitoring data.

Path Parameters

Parameter	Type	Description
systemIdRequired	uuid	UUID of the registered AI system.

Response (200)

Response

{
  "success": true,
  "data": {
    "system": {
      "id": "550e8400-e29b-41d4-a716-446655440000",
      "name": "Resume Screening AI",
      "description": "AI-powered resume screening tool",
      "purpose": "Candidate screening",
      "deployment_status": "production",
      "jurisdiction_flags": ["eu_ai_act", "us_colorado"],
      "status": "active",
      "created_at": "2026-01-15T10:30:00Z",
      "updated_at": "2026-03-01T14:22:00Z"
    },
    "compliance": {
      "overall_score": 68,
      "jurisdiction_scores": [
        {
          "jurisdiction_key": "eu_ai_act",
          "score": 68,
          "component_scores": {
            "obligations": 72,
            "documentation": 65,
            "assessment": 70,
            "remediation": 65
          },
          "computed_at": "2026-03-09T00:00:00Z"
        }
      ],
      "obligation_summary": {
        "total": 24,
        "met": 18,
        "unmet": 3,
        "in_progress": 3
      }
    },
    "risk_assessment": {
      "latest_classification": "high",
      "confidence_score": 0.89,
      "assessed_at": "2026-02-28T16:45:00Z"
    },
    "alerts": {
      "total_open": 2,
      "by_severity": { "high": 1, "medium": 1 }
    },
    "watchtower": {
      "active_alerts": 1,
      "threshold_violations": 0
    }
  },
  "meta": {
    "response_time_ms": 145
  }
}

Interactive API Explorer

Test the API directly from this page using your API key. Responses are live and will count against your rate limit.

Live requests.

The explorer sends real API requests. The compliance check endpoint uses AI analysis and will count toward your daily rate limit.

API Explorer

API Key

Endpoint

Request Body (JSON)

// Response will appear here after sending a request

Rate Limiting

API rate limits are enforced per organization based on your subscription plan. Limits reset daily at midnight UTC.

Plan	Daily Limit	Reset
Free Trial	100 requests/day	Midnight UTC
Professional	1,000 requests/day	Midnight UTC
Business	Unlimited	N/A

Rate Limit Headers

Every API response except 401, 403 and 500 errors includes rate limit headers so you can monitor your usage:

Header	Type	Description
X-RateLimit-Limit	string	Your daily request limit, or "unlimited" for Business plan.
X-RateLimit-Remaining	string	Number of remaining requests today.
X-RateLimit-Reset	datetime	ISO 8601 timestamp when the rate limit window resets.

When the rate limit is exceeded, the API returns a 429 Too Many Requests response with the reset time included in both the response body and headers.

Error Codes

All error responses follow a consistent format with a machine-readable code and human-readable message. Use the code field for programmatic error handling.

Error Response Format

{
  "success": false,
  "error": {
    "code": "ERROR_CODE",
    "message": "Human-readable description"
  }
}

400	VALIDATION_ERROR	Request body failed validation. Check required fields and data type constraints.
400	INVALID_JSON	Request body is not valid JSON. Ensure proper JSON formatting.
401	MISSING_AUTH	No Authorization header provided. Include: Bearer <api_key>
401	INVALID_AUTH_FORMAT	Authorization header format incorrect. Use: Bearer <api_key>
401	INVALID_API_KEY	API key is invalid, expired, or revoked. Generate a new key in Settings.
403	INSUFFICIENT_PERMISSIONS	API key lacks required 'read' permission. Update key permissions in Settings.
403	PLAN_FEATURE_DISABLED	Your plan does not include Developer Copilot API access. Upgrade to regain API access.
404	NOT_FOUND	AI system not found or does not belong to your organization.
429	RATE_LIMIT_EXCEEDED	Daily API limit exceeded for your plan. Upgrade or wait for reset.
500	INTERNAL_ERROR	An unexpected server error occurred. Retry the request or contact support.