For security reviewers & TPRM platforms · Live
Every trust center is also a machine-readable API.
Reviewing a Screenata customer? Skip the portal-and-PDF shuffle. Every published trust center exposes the same posture as a versioned JSON API: certifications, control coverage, subprocessors, documents with content hashes — and a signed snapshot your tooling can verify cryptographically.
The API is live on every published trust center (trust-api/1.0, additive-only within /v1). The canonical spec is served at /api/trust/openapi.json; the download above is a snapshot of it.
How it works
Public tier, gated grants, signed snapshots.
Public by default, discoverable by machines
The public tier needs no authentication and returns exactly what the human trust center page shows: frameworks, control coverage, subprocessors, updates, and public documents. Any trust center host answers GET /.well-known/trust-api with its API base — point a tool at the domain and it finds the rest.
Gated documents without the email thread
Restricted documents like the SOC 2 report sit behind the same access request the web page uses: submit a request with your identity and reason, poll for approval, and receive a time-boxed Bearer grant. The publisher approves once; your tooling downloads for the life of the grant.
Cryptographically verifiable, not just readable
The attestation endpoint returns an Open Evidence Signing (OES) envelope over a snapshot of the posture — frameworks, resource hashes, control summary. Verify it offline with npx oes against the publisher's /.well-known/oes-signing keys. Every document also carries a SHA-256 content hash.
The surface
Ten endpoints, one of them a signature.
| Endpoint | Returns |
|---|---|
| GET/v1/{slug} | Trust Center index — frameworks, badges, counts, endpoints |
| GET/v1/{slug}/resources | Visible documents with freshness and content hashes |
| GET/v1/{slug}/resources/{id} | One resource |
| GET/v1/{slug}/resources/{id}/content | Document download (public, or gated under a grant) |
| GET/v1/{slug}/controls | Control coverage summary by domain |
| GET/v1/{slug}/subprocessors | Subprocessor list |
| GET/v1/{slug}/updates | Compliance timeline |
| GET/v1/{slug}/attestation | OES-signed snapshot of the whole posture |
| POST/v1/{slug}/access-requests | Request access to gated documents (e.g. the SOC 2 report) |
| GET/v1/{slug}/access-requests/{id} | Poll a request; the Bearer grant appears once approved |
From your terminal
A vendor review your scripts can run.
# Discover the API from any Screenata trust center domain
curl https://trust.example.com/.well-known/trust-api
# Pull the posture — no auth needed for the public tier
curl https://api.screenata.com/api/trust/v1/{slug}
curl https://api.screenata.com/api/trust/v1/{slug}/controls
curl https://api.screenata.com/api/trust/v1/{slug}/subprocessors
# Request the gated SOC 2 report, then poll for the grant
curl -X POST https://api.screenata.com/api/trust/v1/{slug}/access-requests \
-H "Content-Type: application/json" \
-d '{"requesterName":"Jane Doe","requesterEmail":"jane@buyer.com",
"requesterSystem":"Acme TPRM","resourceId":"..."}'
# Verify the signed snapshot offline
curl https://api.screenata.com/api/trust/v1/{slug}/attestation | npx oes verifyFor publishers
Your buyers' security tooling reads this automatically.
Publish a trust center on Screenata and the API comes with it — no extra setup. Enterprise buyers running TPRM platforms fetch your posture, verify the signature, and close their vendor review without a single email. Auditing an engagement instead? See the Auditor Pull API.