API Reference

The Comma Compliance API provides programmatic access to archived messages, compliance policies, and integration management. Use it to build custom workflows, export data to external systems, or integrate Comma into your existing compliance infrastructure.

Before you start

API access is enabled per account. In your Comma dashboard, open the team menu (top-right) and go to Development → API to generate a token and copy your OpenAPI spec URL. If you don’t see Development → API, email support@commacompliance.com to have API access enabled for your account.

Base URL

https://app.commacompliance.com/api/v1

Authentication

All API requests require a Bearer token in the Authorization header:

Authorization: Bearer <your-api-token>

Generate API tokens from the Development → API page in your Comma dashboard (open the team menu in the top-right, then Development → API). Tokens inherit the permissions of the user who created them.

OpenAPI specification

The full, machine-readable OpenAPI 3.1 specification is published at:

https://app.commacompliance.com/api/v1/openapi.yaml

The same URL (with a copy button) is shown on the Development → API page. Load it into Swagger UI, Redoc, Postman, or an MCP-capable client (such as ChatGPT) to generate code or explore the live endpoints.

Rate limits

• Standard plans - 100 requests per minute
• Enterprise plans - 1,000 requests per minute

Rate limit headers are included in every response:

X-RateLimit-Limit: 100
X-RateLimit-Remaining: 97
X-RateLimit-Reset: 1714003200

Endpoints

The list below is the archive-reading surface most integrations need. The live /api/v1/openapi.yaml is the source of truth and includes the write and admin endpoints as well.

Archive content

Method	Endpoint	Description
GET	/teams and /teams/{id}	Your team(s)
GET	/teams/{team_id}/platform_accounts and /platform_accounts/{id}	Connected accounts (the channels being archived)
GET	/platform_accounts/{id}/message_threads	List threads for an account
GET	/message_threads/{id}	Get a thread
GET	/message_threads/{id}/messages	List messages in a thread
GET	/messages/{id}	Get a message
GET	/messages/{id}/message_revisions	Edits and deletions of a message
GET	/message_threads/{id}/thread_events	Joins, leaves, renames, and similar events
GET	/message_threads/{id}/message_thread_participants	Participants in a thread
GET	/platform_accounts/{id}/calls	Calls for an account
GET	/platform_accounts/{id}/voicemails	Voicemails for an account
GET	/worm_records/{id}	The original: the sealed record for an item, with its SHA-256

Supervision and records management

Method	Endpoint	Description
GET, POST	/teams/{team_id}/policies	List or create compliance policies
GET, PUT	/policies/{id}	Get or update a policy
GET	/policies/{id}/policy_matches	Matches a policy produced
GET, POST	/teams/{team_id}/team_cases	List or create cases
GET	/teams/{team_id}/audit_logs	Audit trail
GET	/teams/{team_id}/notifications	Notifications

People and organization

Method	Endpoint	Description
GET	/teams/{team_id}/memberships	Team members
GET	/teams/{team_id}/team_contacts	External contacts
GET	/users and /users/{id}	Users

Originals versus representations. The message, thread, revision, call, and voicemail endpoints return Comma’s working representation of each item - the shape the dashboard shows. /worm_records/{id} returns the original: the sealed record as it was captured, with its SHA-256. If you are migrating, auditing, or producing records, pull the sealed record for each item; use the representation endpoints to find them. To walk the whole archive, list platform accounts, then threads per account, then messages per thread (plus calls and voicemails per account), and fetch each item’s sealed record. Everything is paginated.

Response format

All responses return JSON with a consistent envelope:

{
  "data": { },
  "meta": {
    "page": 1,
    "per_page": 50,
    "total": 234
  }
}

Error responses include a machine-readable code and human-readable message:

{
  "error": {
    "code": "rate_limit_exceeded",
    "message": "Rate limit exceeded. Try again in 60 seconds."
  }
}

SDKs and libraries

Official SDKs are coming soon. In the meantime, the REST API works with any HTTP client.

Need help?

Contact support@commacompliance.com for API access questions or to request higher rate limits.