Home Features RIA Compliance Software Archiving iMessage Archiving Trade Monitoring Vendor Due Diligence Marketing Reviews Content Library Form ADV Forms & Tasks AI Consultant Reporting Documents For Consultants Pricing Blog About Sign in Request demo

Build compliance into your own software.

A clean REST API and signed webhooks. Wire RegFin's compliance capabilities into your advisor portal, ops tooling, and client apps. JSON in, evidence out, every call authenticated and audited under your identity.

Book a demo →
POSTv1/reviews
GETv1/exceptions
PUTv1/vendors/{id}
requestapplication/json
POST /v1/reviews
Host: api.regfin.com
Authorization: Bearer sk_live_••••
Idempotency-Key: rev_9K2NpZx

{
  "channel": "linkedin",
  "author": "[email protected]",
  "body": "Q1 commentary…",
  "attachments": ["att_8K3Lp"],
  "priority": "standard",
  "due_at": "2026-04-15T17:00Z"
}
response201 Created
{
  "id": "rev_8K3LpNxQ2",
  "status": "ai_screening",
  "channel": "linkedin",
  "submitted_by": "usr_sara_chen",
  "sla_due_at": "2026-04-15T17:00Z",
  "_links": {
    "self": "/v1/reviews/rev_8K3LpNxQ2",
    "stream": "/v1/reviews/rev_…/events"
  },
  "audit_id": "aud_2H8Kvbs",
  "created_at": "2026-04-12T14:32:01Z"
}

Everything you can build on.

Resource families that each let you create, read, update, and delete, plus a few domain-specific actions. Everything is documented in the OpenAPI 3.1 spec.

GET /v1/comms · POST /v1/comms/search

Communications

Read the archive. Full-text + filter search. Stream attachments by id with signed-url responses.

GET POST PUT /v1/documents

Documents

Create, version, seal, and download. Each version emits a sha256 hash for downstream evidence.

GET POST /v1/deliveries

Deliveries

Start a campaign, check funnel state. Webhook for delivered / read / acknowledged events.

GET POST /v1/reviews

Marketing reviews

Submit drafts for AI screen + human approval. Poll for outcome or receive via webhook.

GET /v1/exceptions · POST /v1/exceptions/{id}/ack

Trade exceptions

List, acknowledge, escalate, override. Push trade fills in via /v1/trades for new exception generation.

GET POST /v1/vendors

Vendor registry

Create, read, update, and delete vendor profiles, DDQs, and attestations. Tier classification with policy enforcement.

GET POST /v1/forms

Forms & tasks

Instantiate a form, route to assignee, capture responses, render PDF. Powers most "workflow" use cases.

GET /v1/households · /v1/clients

Households & clients

The CRM surface. Reads pulled from your linked portfolio management system; writes propagate where the integration permits.

GET /v1/audit

Audit log

The full immutable event stream. Filter by actor, surface, resource, time. The exam-time goldmine.

The events that matter, streamed.

Signed webhooks with at-least-once delivery and a replay window. Subscribe to the events you care about, leave the rest. Same event shape feeds the in-app activity stream and the audit log.

event types · 3 available
client.created
A new client record was created: id and who created it.
clients
client.updated
A client record changed: the fields and who changed them.
clients
lead.submitted
A prospect submitted a lead form on your site.
leads

Keep your other systems in sync

Webhooks are how you wire RegFin into the tools your firm already runs: push a new client or a fresh lead into your CRM, your data warehouse, or your onboarding workflow the moment it happens, instead of polling for changes.

  • Signed (HMAC-SHA256): your systems can verify each message really came from RegFin and wasn't tampered with.
  • At-least-once: exponential backoff to 24 hours; manual replay from the dashboard.
  • Per-endpoint filters: point one URL at client.*, another at lead.*.
  • Test mode: fire any event from the dashboard against a sandbox URL.
  • Inspect & retry: every delivery attempt is logged with its response code; retry any failure by hand from the dashboard.

Put compliance inside your own software.

The value isn't a client library to install. It's that RegFin's compliance capabilities become endpoints your own systems can call. Build them into the software your firm already runs.

Your advisor portal

Surface preclearance, attestations, and document acknowledgments inside the portal your advisors already log into. No second system to learn.

Your ops & data tooling

Sync client records into your data warehouse, push data in through the ingest endpoints, and get a signed webhook the moment a client changes or a lead comes in. RegFin becomes a service in your stack.

Your client experience

Trigger ADV / CRS deliveries and capture acknowledgments from your own client app, with the evidence trail handled for you.

Partner integrations

Portfolio systems, CRMs, and custodian portals push data in and pull decisions out, every call authenticated and audited under the firm's identity.

OpenAPI 3.1 spec

The full contract is published at regfin.com/openapi.json. Generate a typed client in your language or call the endpoints directly.

Sandbox to build against

Every account gets a sandbox seeded with realistic data and full-volume webhooks, so you can build and test before flipping to live.

What we promise.

Live

Public status page

Real-time API status and incident history at status.regfin.com, so you always know whether it's us or you.

24 h

Idempotent writes

Every write accepts an Idempotency-Key; replays return the original response within a 24-hour window. No duplicate evidence from a retry.

12 mo

Deprecation window

Twelve months minimum from deprecation announcement to removal. Every breaking change carries a parallel-run window.

v1

One stable major

New capabilities ship as additive endpoints, not new majors. v2 would be a planned event, not a surprise.

100%

OpenAPI parity

If it's an endpoint, it's in the spec. If it's in the spec, it works. Spec is generated from the same source as the runtime.

30 d

Webhook replay

Any event from the last 30 days can be replayed against your endpoint from the dashboard or via /v1/events/{id}/replay.

Common questions.

Three audiences: (1) Firms with an internal "compliance ops" engineer wiring RegFin into their data warehouse and ops tooling; larger firms often have at least one. (2) Tech-forward RIAs replacing point-tool ops scripts. (3) Our integration partners (portfolio systems, CRMs, custodian portals) pushing data in or pulling decisions out. If you're not one of these, the web app and mobile usually cover everything.
Every account gets a sandbox with seeded data that looks like a live small RIA. Keys are sk_test_* vs. sk_live_*. Webhooks in sandbox emit at full event volume, useful for load-testing your handlers before flipping to live.
Default: 1,000 req/min per token, with burst headroom. Most clients never come close. If you do, we'll lift it on request. Just send the use case. Limits are returned in standard X-RateLimit-* headers; 429s carry a Retry-After.
Bearer API keys for server-to-server. Keys are scoped (read-only, scope-restricted, etc.) and rotatable from the dashboard. OAuth 2.0 with PKCE for user-on-behalf-of flows (rare; most integrations are firm-to-firm). All flows enforce the same permissions as the web app.
Every write endpoint accepts an Idempotency-Key header (UUID or your own id). Replays return the original response within a 24-hour window. Use it. Don't lose evidence to a retry storm.
Yes, that's the point of the API. Firms embed preclearance, attestations, deliveries, and the audit log into their own advisor portals, ops tooling, and client apps. Call the REST endpoints directly or generate a typed client from the published OpenAPI 3.1 spec. There's no proprietary SDK to adopt.

See it running on your stack.

Book a demo and we'll walk your team through the endpoints, the webhooks, and the OpenAPI spec, then show how RegFin fits the software your firm already runs.

Book a demo →