The Core GRC API runs the same tools as the Claude connector and the CLI, over HTTPS. Use it to connect Core GRC to your own systems: ticketing, procurement, a data warehouse, or a scheduled job.

Base URL: https://api.core-grc.com/v1

Create an API key

  1. In Core GRC, open Profile settings and find API keys.
  2. Choose Create key, give it a name, and pick:
    • Access: Read only (list and read tools only) or Read and write.
    • Expires after: 30 days, 90 days, or 1 year.
  3. Copy the key. It starts with cgrc_ and is shown only once.

A key acts as you, in the organization you created it in, with your current role. If your permissions change, the key changes with them. If you leave the organization, the key stops working. If your organization requires two-factor authentication, your account must have it turned on.

Keep keys in a secret manager, not in code. Revoke a key from the same page at any time. Anything using it stops straight away.

Make a request

Send the key as a bearer token:

curl https://api.core-grc.com/v1/whoami \
  -H "Authorization: Bearer $COREGRC_API_KEY"

Call a tool with POST /v1/tools/{tool} and the arguments as one JSON object:

curl https://api.core-grc.com/v1/tools/tprm_list_entities \
  -H "Authorization: Bearer $COREGRC_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"entityType":"vendor","limit":50}'

Endpoints

Method Path What it does
GET /v1/whoami Your user, role, organization, and active modules
GET /v1/tools Tools this key can call. Add ?module=tprm (or policy, consent, rights, webaccess) to filter
GET /v1/tools/{tool} One tool's description and JSON Schema input
POST /v1/tools/{tool} Run the tool
GET /v1/openapi.json OpenAPI 3.1 description of every tool. No key needed

Tool names and arguments are the same as on the tools page and in the CLI. You only see tools for modules your organization has active, and only the ones your role allows.

Responses and errors

A successful call returns 200 with the tool's result as JSON.

Status Meaning
400 The tool rejected the arguments or could not finish. The body is {"success": false, "error": "..."} and says what to fix
401 The key is missing, expired, or revoked
403 The key is read-only and the tool changes data
404 Unknown tool, or one this key cannot use
503 Core GRC could not verify the key just now. Retry after the Retry-After seconds

Tools that delete or overwrite data need "confirm": true in the same call, exactly as in the connector. Long-running work (cookie scans, accessibility scans, assessment jobs) is queued and returns at once. Poll the matching list or status tool.

OAuth access tokens

The API also accepts access tokens from the Core GRC OAuth sign-in used by the CLI and the Claude connector. Most integrations should use an API key instead.

Browsers

The API is for server-to-server use. It does not send CORS headers, so a web page cannot call it with a key. Call it from your backend.