Governance as REST — for every connector you want to build.
RAIC ships a public, versioned REST API described by OpenAPI 3.1. Every tenant-scoped resource — including Policies — is now first-class over both the API and the MCP server.
Resource groups
One consistent envelope — { data, meta, error } — across every resource. Policies are now first-class alongside Systems, Use Cases, Controls, and Risks.
Register, update, and retire AI systems and models with lifecycle, owner, and framework mappings.
Intake and workflow for AI use cases with inherent-vs-residual risk scoring and approval history.
Unified AI + Cyber controls with multi-link framework adapters (ISO 42001, EU AI Act, NIST AI RMF, CSF 2.0, SOC 2, CIS v8.1).
AI + Cyber risk register with dual inherent-vs-residual scoring (L × I triples), keyset pagination, and updated-since filters.
First-class policy CRUD — list, create, update, retire governance policies over the API and over MCP.
Shadow AI discovery items and NHI inventory reads for connectors that need current tenant posture.
Trigger and fetch branded, audit-ready reports (DOCX / XLSX / CSV / ZIP) with signed-URL delivery.
Read the tenant's append-only, hash-chained platform audit log for compliance, SIEM ingest, and connector observability.
Built for connectors
Idempotency keys: Send X-Idempotency-Key on every write. Canonical shape: <source>:<kind>:<source_id>. Retry safely without duplicates.
Actor header: X-RAIC-Actor: connector:<name> groups your calls in the tenant's audit log and lights up connector telemetry.
Dry-run first: X-Dry-Run: 1 validates payload, tenancy, and scope without persisting — perfect for connector setup wizards.
Keyset pagination: List endpoints return an opaque meta.next_cursor for forward pagination over (updated_at, id) DESC.
Consistent errors: One error envelope with stable codes for 401, 403, 404, 409, 422, and 429 so your retry logic writes itself.
Rate limits you can plan around: Per-subject and per-token limits with clear 429 envelopes and Retry-After hints; org-level overrides for high-volume partners.
Stable OSCAL identifiers: RAIC's exported OSCAL identifiers live in a reserved raic: namespace governed by a written stability policy, and published identifiers are not renamed. An identifier that can be renamed cannot be cited, so a stable ID means an auditor's or downstream tool's reference to a RAIC control still resolves next year.
Grab the OpenAPI spec and mint a token.
OrgAdmins mint rai_* tokens from the RAIC Admin Console. Point Postman, Insomnia, or your favorite HTTP client at the spec and you are live.