Concord Trust API Overview
The Concord Trust API gives your organization server-side access to Trust and GRC: controls, frameworks, evidence, risks, and your trust centers.
Overview
The Concord Trust API (Trust V1) provides access to the Trust and GRC surfaces of Concord for registered organizations: controls and frameworks, evidence and audits, the risk register, and your trust centers. Use it from your own servers to sync compliance status, manage evidence, and keep your trust center current.
To connect an AI assistant such as Claude or ChatGPT, you don't need the API. See Connecting AI Assistants to Concord (MCP).
Base URL
https://api.concord.tech/trust-v1Authentication
The Trust API uses the same organization API keys as the Concord Privacy API. Send the key in the x-api-key header, and keep it on your server. Create keys under Integrations → AI & API Access → API Keys; see Adding and Managing API Keys for the roles.
curl https://api.concord.tech/trust-v1/organizations/ORGANIZATION_ID/controls \
-H "x-api-key: YOUR_API_KEY"Organization and Trust Center IDs
Every path is scoped to an organization. To find your organization ID, call Get organizations in the Privacy API.
Each trust center is a Concord project, so trust center paths use its project ID:
/organizations/{organizationId}/projects/{projectId}/...Call List trust centers to find them.
Endpoint Groups
- Controls: controls, adopted frameworks, evidence, audits, and auditor access
- Risks: the risk register and risk reports
- Trust Centers: badges, announcements, questionnaires, the knowledge base, and analytics
- Trust Audience: who can access a trust center
- Report Branding: the resolved branding used in PDF report exports
Report Branding is read-only. Organization branding itself is set with the Platform API's organization branding.
Other Concord APIs
- Concord Platform API: documents, assessments, vendors, tasks, and shared settings
- Concord Privacy API: consent, privacy requests, data mapping, and scans
- Concord Site API: client-side consent and privacy requests for your website
OpenAPI Specification
The full specification is published at api.concord.tech/docs/json/trust-v1/ for code generators and API clients.