Org-scoped • RLS enforced • Audited

SecurePoint USA API Reference

Server-to-server API for screening, check-in, adjudication, and audits. All endpoints enforce `organization_id` via RLS; privileged actions are append-only audited; tokens are hashed at rest.

OpenAPI (download)Zapier (outbound webhooks)Base URL: https://securepointusa.com/api
Defense Tier
  • POST /api/v1/prescreen

    Create a prescreen request

    Defense
  • GET /api/v1/screenings/[id]

    Fetch screening details

    Defense
  • POST /api/v1/checkin

    Check in a visitor

    Defense
  • POST /api/v1/webhooks/screening_completed

    Receive screening completed events

    Defense
  • POST /api/v1/webhooks/visitor_checked_in

    Receive visitor check-in events

    Defense
  • POST /api/v1/webhooks/visitor_checked_out

    Receive visitor check-out events

    Defense
  • POST /api/v1/webhooks/session_escalated

    Receive escalation events

    Defense
Enterprise Tier
  • GET /api/v1/screenings/[id]/evidence

    Download screening evidence PDF

    Enterprise
  • POST /api/v1/ownership/check

    BIS 50 / OFAC ownership graph check

    Enterprise
  • GET /api/v1/adjudication/queue

    List adjudication queue cases

    Enterprise
  • GET /api/v1/adjudication/[id]

    Get adjudication case detail

    Enterprise
  • POST /api/v1/adjudication/[id]/disposition

    Apply CLEARED / ESCALATED / DENIED

    Enterprise
  • PUT /api/v1/workforce/sync

    Bulk sync workforce profiles

    Enterprise
  • POST /api/v1/vendors/screen

    Screen vendors/contractors

    Enterprise
  • GET /api/v1/audit/export

    Export audit logs

    Enterprise
  • PUT /api/v1/adjudication/rules

    Upsert adjudication rules

    Enterprise
  • POST /api/v1/sessions/[id]/update

    Update visitor session status/metadata

    Enterprise
Auth patterns

Use API keys for server-to-server. JWTs for interactive admin flows.

API key
curl -X POST https://securepointusa.com/api/v1/prescreen \
  -H "Authorization: Bearer spusa_***" \
  -H "Content-Type: application/json" \
  -d '{"subject":"Jane Doe","company":"AeroFab","country":"US"}'
JWT
curl -H "Authorization: Bearer <jwt>" \
  https://securepointusa.com/api/v1/screenings/<id>
  • API keys can be disabled/revoked; JWTs expire per session policy.
  • RLS enforced via organization_id; no cross-tenant access.
  • Use X-Request-ID to correlate with audit logs.
Usage tips
  • All privileged actions are append-only audited; tokens are hashed at rest.
  • Webhooks acknowledge with 200; payload keys logged, no PII stored.
  • Latency target p95 < 200ms; keep payloads small and reuse connections.
  • Include org-scoped JWTs or API keys; RLS blocks cross-org access.
Need full schema? Download the OpenAPI spec or contact support for sandbox keys.