Compliance API
The Compliance API gives an Enterprise organization’s security, legal and records teams programmatic access to what its members did in Syntic and what they created there: activity, chat histories, projects, Syntic Code sessions and their files. It is built for eDiscovery platforms, data-loss-prevention tools, insider-risk monitoring and records retention.
It is a separate surface from the Admin API, which changes settings, and from the audit feed, which records administrative changes only.
Access
| Requirement | Detail |
|---|---|
| Plan | Enterprise. Other plans get 403 plan_required. |
| Key | An Admin API key (sk_admin_...) created with the compliance:read scope. Deleting records and managing legal holds also needs compliance:write. |
| Who can create such a key | Primary owner only. Every use of the key is written to the audit feed. |
| Beta flag | syntic-beta: compliance-2026-12-01 |
A compliance key can read every member’s chats. Keep it in a secrets vault, give it to the one system that needs it, and restrict it by IP with the key’s network rules.
What is covered
| Data | Endpoints | Notes |
|---|---|---|
| Activity across products | Activities | Metadata only: who, what, when, from where. |
| Members, past and present | Users & roles | Removed members remain listed so old records stay attributable. |
| Chats in Syntic’s chat apps | Chat records | Includes chats members deleted, until retention removes them. |
| Projects and their documents | Project records | |
| Syntic Code sessions | Syntic Code sessions | Transcripts only when transcript retention is on. |
| Bulk export | Exports | JSONL or zip, up to a year per export. |
| Preservation | Legal holds | Overrides retention and deletion. |
Requests sent to the developer API (/v1/chat/completions and so on) are your own application’s traffic; their bodies are governed by your retention settings and are not exposed here.
Activity types
| Product | Actions |
|---|---|
chat | chat.created, chat.message_sent, chat.file_uploaded, chat.shared, chat.deleted |
code | code.session_started, code.session_ended, code.command_run, code.edit_accepted, code.plugin_installed |
agents | agents.session_started, agents.tool_called, agents.session_ended |
api | api_key.created, api_key.disabled, files.uploaded, batches.created |
console | console.signed_in, console.signed_out, console.mfa_changed |
admin | compliance.export_created, compliance.export_downloaded, compliance.record_deleted, compliance.legal_hold_changed |
Retention interplay
Records are available here for as long as the organization’s retention keeps them. A legal hold extends that for the people and kinds it names. Deleting a record through this API is permanent and is itself recorded as a compliance.record_deleted activity.
Paging and volume
List calls page with after_id like the rest of the API, up to 1,000 records a page for activities. For anything over a few hundred thousand records, use an export instead of paging. Compliance calls have their own rate limit of 120 requests per minute per organization.