> ## Documentation Index
> Fetch the complete documentation index at: https://docs.replit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Compliance API

> Retrieve retained customer prompt content to enrich Replit Enterprise audit logs for security and compliance workflows.

The Compliance API lets Enterprise account admins retrieve retained prompt content associated with `project.message_sent` audit events. Use it to enrich exported or streamed audit logs when an authorized security or compliance workflow needs a prompt's full text.

<Warning>
  Prompt content can contain source code, secrets, personal data, or other
  sensitive information. Grant access only to approved systems and people, store
  the content according to your organization's security and retention policies,
  and use the minimum required scope.
</Warning>

## Who can access the Compliance API

The Compliance API is available only to **account admins on Enterprise accounts**. Workspace admins and other account members cannot create API keys with Compliance API access or retrieve prompt content.

To learn more about Enterprise admin roles, see [Account and Workspace Admins](/teams/identity-and-access-management/account-and-workspace-admins).

## Create an API key

The Compliance API requires the dedicated `audit-logs:read` scope. General read access, including `read:*`, does not grant access to customer prompt content.

<Steps>
  <Step title="Open Developer settings">
    Open **Settings**. Under **Account**, select **Developer**.
  </Step>

  <Step title="Create an API key">
    Select **Create API key**, give the key a descriptive name, and choose an
    expiration appropriate for your security policy.
  </Step>

  <Step title="Grant audit log access">
    Under **Audit logs**, select **Read**. Confirm that the key includes the
    `audit-logs:read` scope.
  </Step>

  <Step title="Store the key securely">
    Copy the key, which begins with `rpl_`, and store it in a secure secret
    manager. The key is displayed only once. Treat it like a password and never
    share it, paste it into chat, or commit it to source control.
  </Step>

  <Step title="Authenticate your integration">
    Send the key as a Bearer token with requests to the Compliance API.
  </Step>
</Steps>

## Example use cases

* **Security investigations:** Enrich `project.message_sent` audit events with full customer prompt text so authorized responders can reconstruct incidents, identify prompt-injection or data-exfiltration attempts, and determine affected projects and users.
* **Compliance monitoring:** Inspect prompt content for regulated data, secrets, or policy violations, then route findings into DLP, SIEM, retention, and eDiscovery workflows with the original audit metadata intact.

## API reference

For the endpoint path, query parameters, response schema, pagination behavior, and examples, see the [Compliance API developer documentation](https://api.replit.com/docs#tag/compliance/GET/compliance/messages).

## Related documentation

* [Audit Logs](/teams/identity-and-access-management/audit-logs): View, export, and stream security-relevant events from your Enterprise account.
* [Admin API](/teams/admin-api): Access account usage, workspaces, members, and projects programmatically.