API Reference

Tenurex REST API

Base URL: https://api.tenureq.com/v1

All endpoints return JSON. Requests that create or modify resources require a JSON body with Content-Type: application/json.

Authentication

Authenticate using your API token as a Bearer token in the Authorization header.

Authenticationcurl
curl -H "Authorization: Bearer tnx_live_xxxxxxxxxxxx" \
     https://api.tenureq.com/v1/controls

Controls

GET /controls

List all controls and their current status.

GET /v1/controlscurl
curl https://api.tenureq.com/v1/controls \
  -H "Authorization: Bearer $TOKEN"

# Response:
{
  "controls": [
    {
      "id": "CC6.1",
      "name": "Logical access security",
      "status": "pass",
      "last_validated": "2026-06-17T14:32:01Z",
      "framework": "soc2"
    }
  ],
  "total": 48
}

GET /controls/{id}

Get a specific control with full test history.

GET /v1/controls/CC6.1curl
curl https://api.tenureq.com/v1/controls/CC6.1 \
  -H "Authorization: Bearer $TOKEN"

Evidence

GET /evidence

List evidence records, optionally filtered by control ID or date range.

GET /v1/evidencecurl
curl "https://api.tenureq.com/v1/evidence?control_id=CC6.1&from=2026-01-01" \
  -H "Authorization: Bearer $TOKEN"

POST /evidence/export

Trigger generation of an auditor-ready evidence package.

POST /v1/evidence/exportcurl
curl -X POST https://api.tenureq.com/v1/evidence/export \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "framework": "soc2",
    "period_start": "2026-01-01",
    "period_end": "2026-06-30",
    "format": "pdf"
  }'

# Response:
{
  "export_id": "exp_abc123",
  "status": "generating",
  "estimated_ready": "2026-06-17T14:37:00Z"
}

Integrations

GET /integrations

List all configured integrations and their connection status.

GET /v1/integrationscurl
curl https://api.tenureq.com/v1/integrations \
  -H "Authorization: Bearer $TOKEN"

Webhooks

Subscribe to real-time events via webhooks. Tenurex will POST to your endpoint when drift is detected, a control scan completes, or an evidence export is ready.

Webhook payload — drift detectedJSON
{
  "event": "drift.detected",
  "control_id": "CC6.1",
  "integration": "github",
  "detail": "User jsmith added to org-admins",
  "severity": "warning",
  "timestamp": "2026-06-17T14:32:01Z"
}