Org-scoped • RLS enforced • Audited

SecurePoint USA API Reference

Server-to-server API for screening, check-in, adjudication, and audits. All endpoints enforce `organization_id` via RLS; privileged actions are append-only audited; tokens are hashed at rest.

OpenAPI (download)Zapier (outbound webhooks)Base URL: https://securepointusa.com/api

Defense Tier

POST /api/v1/prescreen
Create a prescreen request
Defense
GET /api/v1/screenings/[id]
Fetch screening details
Defense
POST /api/v1/checkin
Check in a visitor
Defense
POST /api/v1/webhooks/screening_completed
Receive screening completed events
Defense
POST /api/v1/webhooks/visitor_checked_in
Receive visitor check-in events
Defense
POST /api/v1/webhooks/visitor_checked_out
Receive visitor check-out events
Defense
POST /api/v1/webhooks/session_escalated
Receive escalation events
Defense

Enterprise Tier

GET /api/v1/screenings/[id]/evidence
Download screening evidence PDF
Enterprise
POST /api/v1/ownership/check
BIS 50 / OFAC ownership graph check
Enterprise
GET /api/v1/adjudication/queue
List adjudication queue cases
Enterprise
GET /api/v1/adjudication/[id]
Get adjudication case detail
Enterprise
POST /api/v1/adjudication/[id]/disposition
Apply CLEARED / ESCALATED / DENIED
Enterprise
PUT /api/v1/workforce/sync
Bulk sync workforce profiles
Enterprise
POST /api/v1/vendors/screen
Screen vendors/contractors
Enterprise
GET /api/v1/audit/export
Export audit logs
Enterprise
PUT /api/v1/adjudication/rules
Upsert adjudication rules
Enterprise
POST /api/v1/sessions/[id]/update
Update visitor session status/metadata
Enterprise

Auth patterns

Use API keys for server-to-server. JWTs for interactive admin flows.

API key

curl -X POST https://securepointusa.com/api/v1/prescreen \
  -H "Authorization: Bearer spusa_***" \
  -H "Content-Type: application/json" \
  -d '{"subject":"Jane Doe","company":"AeroFab","country":"US"}'

JWT

curl -H "Authorization: Bearer <jwt>" \
  https://securepointusa.com/api/v1/screenings/<id>

API keys can be disabled/revoked; JWTs expire per session policy.
RLS enforced via organization_id; no cross-tenant access.
Use X-Request-ID to correlate with audit logs.

Usage tips

All privileged actions are append-only audited; tokens are hashed at rest.
Webhooks acknowledge with 200; payload keys logged, no PII stored.
Latency target p95 < 200ms; keep payloads small and reuse connections.
Include org-scoped JWTs or API keys; RLS blocks cross-org access.

Need full schema? Download the OpenAPI spec or contact support for sandbox keys.