Compliance Monitoring API (CMaaS)

Base URL: https://api.techcompass.com.au. Register entity watchlists once; receive webhook alerts whenever a monitored entity changes across ASIC, ABR, OFAC, FSANZ and more.

How It Works

Compliance Monitoring as a Service (CMaaS) is an automated compliance monitoring tool that runs on top of all Tech Compass data pipelines. As a continuous watchlist monitoring service, it removes the need to poll individual APIs for changes: register entities once and receive webhook alerts whenever a monitored entity changes across sanctions, company registry, and food recall data.

The CMaaS detection job polls each data source on its own schedule (ASIC daily, ABR hourly, OFAC daily, FSANZ every 2 hours) and compares each entity's current state against the last snapshot. On any change, it writes an alert and fires a signed webhook to your configured endpoint.

Data flow

1. POST /v1/monitoring/watchlists            — create a named watchlist
2. POST .../watchlists/{id}/items            — add entities to monitor
3. PUT  .../watchlists/{id}/webhook          — configure your alert endpoint
4. [Tech Compass runs change detection]
5. GET  /v1/monitoring/alerts                — poll for alerts, or receive webhook POSTs

Authentication

All endpoints require a Professional tier API key in the Authorization header:

Authorization: ApiKey tc_live_<your_key>

Entity limits

Key Concepts

Watchlists

A watchlist is a named group of entities. You can create multiple watchlists to organise monitoring by customer segment, product, or team. Each watchlist has its own webhook configuration.

Items

Each item in a watchlist is a single entity identified by an identifier_type and identifier_value (e.g. abn + 51 824 753 556). Items specify which products_monitored apply — you can monitor the same ABN for ASIC status changes, ABR status changes, and FSANZ recalls independently.

Snapshots

When the detection job first encounters an item, it captures a snapshot of the current state. On each subsequent run it compares the new state against the snapshot. Only actual changes trigger alerts — polling noise from unchanged data generates no alerts.

Alerts

An alert is created when a monitored entity's state changes. Each alert has a severity (high, medium, low), a product_event_type (e.g. asic_status), and a changed_fields list describing what changed. Alerts remain until acknowledged.

Event Types

Identifier Types

The data_region is set automatically based on the identifier type and determines which regional database stores snapshots and alerts for that item.

Watchlist Endpoints

POST /v1/monitoring/watchlists

Create a named watchlist.

curl -X POST "https://api.techcompass.com.au/v1/monitoring/watchlists" \
  -H "Authorization: ApiKey tc_live_<your_key>" \
  -H "Content-Type: application/json" \
  -d '{"name": "Onboarded customers"}'

{
  "watchlist_id": "a1b2c3d4-...",
  "name": "Onboarded customers",
  "created_at": "2026-07-07T10:00:00Z",
  "is_active": true,
  "data_lineage": { ... }
}

GET /v1/monitoring/watchlists

List all watchlists for your API key.

curl "https://api.techcompass.com.au/v1/monitoring/watchlists" \
  -H "Authorization: ApiKey tc_live_<your_key>"

POST /v1/monitoring/watchlists/{watchlist_id}/items

Add an entity to a watchlist. Returns 403 if your entity limit would be exceeded.

curl -X POST "https://api.techcompass.com.au/v1/monitoring/watchlists/a1b2c3d4-.../items" \
  -H "Authorization: ApiKey tc_live_<your_key>" \
  -H "Content-Type: application/json" \
  -d '{
    "identifier_type": "abn",
    "entity_identifier": "51824753556",
    "products_monitored": ["asic_status", "abr_status"]
  }'

GET /v1/monitoring/watchlists/{watchlist_id}/items

List all items in a watchlist (active items only — soft-deleted items are excluded).

curl "https://api.techcompass.com.au/v1/monitoring/watchlists/a1b2c3d4-.../items" \
  -H "Authorization: ApiKey tc_live_<your_key>"

DELETE /v1/monitoring/watchlists/{watchlist_id}/items/{item_id}

Soft-delete a watchlist item. The item is deactivated and excluded from future detection runs. Historical alerts are preserved.

curl -X DELETE "https://api.techcompass.com.au/v1/monitoring/watchlists/a1b2c3.../items/d4e5f6..." \
  -H "Authorization: ApiKey tc_live_<your_key>"

PUT /v1/monitoring/watchlists/{watchlist_id}/webhook

Configure or update the webhook endpoint for a watchlist. Upserts on each call.

curl -X PUT "https://api.techcompass.com.au/v1/monitoring/watchlists/a1b2c3.../webhook" \
  -H "Authorization: ApiKey tc_live_<your_key>" \
  -H "Content-Type: application/json" \
  -d '{
    "webhook_url": "https://your-app.com/webhooks/tc-alerts",
    "webhook_secret": "your_signing_secret",
    "min_severity": "medium"
  }'

Alert Endpoints

GET /v1/monitoring/alerts

List alerts for your account, newest first. Supports filtering and pagination.

curl "https://api.techcompass.com.au/v1/monitoring/alerts?severity=high&limit=20" \
  -H "Authorization: ApiKey tc_live_<your_key>"

{
  "alerts": [
    {
      "alert_id": "f1e2d3c4-...",
      "item_id": "b2c3d4e5-...",
      "product_event_type": "asic_status",
      "alert_severity": "high",
      "changed_fields": {
        "asic_status": { "from": "REGD", "to": "EXAD" }
      },
      "generated_at": "2026-07-07T06:00:00Z",
      "acknowledged_at": null,
      "webhook_delivered_at": null
    }
  ],
  "total": 1,
  "limit": 20,
  "offset": 0,
  "data_lineage": { ... }
}

GET /v1/monitoring/alerts/{alert_id}

Retrieve full detail for a single alert including the complete previous and current state snapshots.

curl "https://api.techcompass.com.au/v1/monitoring/alerts/f1e2d3c4-..." \
  -H "Authorization: ApiKey tc_live_<your_key>"

Errors: 404 if alert_id not found or belongs to another account.

POST /v1/monitoring/alerts/{alert_id}/acknowledge

Mark an alert as acknowledged. Sets acknowledged_at to UTC now. Idempotent — acknowledging an already-acknowledged alert is a no-op.

curl -X POST "https://api.techcompass.com.au/v1/monitoring/alerts/f1e2d3c4-.../acknowledge" \
  -H "Authorization: ApiKey tc_live_<your_key>"

Error Reference

Common Use Cases

1. Monitor onboarded customers for ASIC/ABR status changes

Who uses this: Lenders, insurers, and professional services firms with ongoing KYC obligations.

# Add customer to watchlist
curl -X POST ".../v1/monitoring/watchlists/{id}/items" \
  -H "Authorization: ApiKey YOUR_KEY" \
  -d '{
    "identifier_type": "abn",
    "identifier_value": "51 824 753 556",
    "products_monitored": ["asic_status", "abr_status"],
    "label": "Acme Pty Ltd — Customer ID 4421"
  }'

2. OFAC watchlist monitoring for US counterparties

Who uses this: US financial institutions and multinationals with ongoing sanctions compliance obligations.

curl -X POST ".../v1/monitoring/watchlists/{id}/items" \
  -H "Authorization: ApiKey YOUR_KEY" \
  -d '{
    "identifier_type": "ein",
    "identifier_value": "12-3456789",
    "products_monitored": ["ofac_sdn"],
    "label": "Counterparty Corp"
  }'

3. Food supplier recall alerts

Who uses this: Supermarket chains, food distributors, and insurers with AU food supply chain exposure.

curl -X POST ".../v1/monitoring/watchlists/{id}/items" \
  -H "Authorization: ApiKey YOUR_KEY" \
  -d '{
    "identifier_type": "abn",
    "identifier_value": "88 123 456 789",
    "products_monitored": ["fsanz_recall"],
    "label": "Supplier: Fresh Foods Pty Ltd"
  }'