Your compliance record, in your own software.
A REST API over your firm's compliance record: clients and households, personal trading and alerts, the communications archive, the Exam Checklist, policies, vendors and the audit trail. Pull it into your advisor portal, data warehouse or reporting, keep it current with incremental sync, and create or update clients straight from your CRM. Every request runs as the person who owns the token, with exactly the access they have in the app.
Host: app.regfin.com
Authorization: Bearer rfn_••••
{
"external_id": "hs-contact-80412",
"external_id_type": "hubspot",
"first_name": "Maria",
"last_name": "Lopez",
"email": "[email protected]",
"lifecycle_status": "prospect"
}
"data": {
"id": "0199a3c4-6e32-7d4c-…",
"type": "client",
"attributes": {
"full_name": "Maria Lopez",
"lifecycle_status": "prospect",
"advisor": { "name": "Sarah Johnson", … },
"updated_at": "2026-09-28T16:45:00.000000Z",
…
}
}
}
Send it again and the same client is updated (200 OK).
Your whole compliance record, readable.
More than 40 kinds of compliance record to list and read, many with their own change history. Clients can also be created and updated. Every endpoint is documented in the API reference customers see in the app, and the OpenAPI 3.1 spec is available on request.
Communications archive
Email, text messages, WhatsApp, social media and websites. Keyword search, filters by sender or recipient and by date, and a short-lived link to an email's original message with its attachments.
Documents & policies
Documents and folders with the same folder access as the app, downloaded through short-lived links. Every version of each policy and written program.
Exam readiness
The Exam Checklist with its evidence, exam findings, mock exams, written programs and exam binders, so your own reporting shows where the firm stands.
Alerts & incidents
Alerts with their comments and history, escalations, incidents and compliance reviews.
Personal trading & code of ethics
Preclearance requests, employee accounts and holdings, gifts and outside business activities, trade rules including restricted securities, securities excluded from monitoring, and trade monitoring scan results.
Households & clients
Clients and households with notes, meetings and annual reviews, plus accounts, holdings and transactions. Create or update a client by your CRM's own ID, and a retried call never makes a duplicate.
Vendors & governance
Vendor profiles with risk tier and due-diligence history, information systems, access reviews, Form ADV filings and marketing reviews.
Forms & tasks
Tasks and who they're assigned to, forms, distributions and every submission, so completion shows up in your own dashboards.
Audit trail
Who did what to which record, and when. Filter by person, record, action and date, or read one record's history. The exam-time record, in your own systems.
Keep your systems current.
Ask for what changed since your last sync. Every record list takes updated_since and returns changes in a fixed order, so a scheduled job in your warehouse, your CRM integration or a Zapier or Make step stays up to date.
Built for scheduled jobs
Run a sync every few minutes or once a night. The archive lists can hold millions of messages, and a sync run stays fast however far back it reads.
- Stable paging: records come back in a fixed order, so a run reads each record it reaches once.
- Retry-safe client writes: match on your CRM's ID, so a retried call updates the same client.
- Clear limits: requests are rate-limited, and a 429 response carries
Retry-After. - Built for consultants: one consultancy token works across the firms you manage. Name the firm in
X-Acting-Company, list your firms withGET /v1/managed_firms, and read template drift, push history, coverage and firm health across your book.
Put compliance inside your own software.
The value isn't a client library to install. It's that your compliance record becomes data your own systems can read and keep current.
Your advisor portal
Show advisors the status of their preclearance requests, assigned forms and open tasks in the portal they already log into.
Your data warehouse & reporting
Sync clients, alerts, tasks, the archive and the audit trail into your warehouse on a schedule, and build the reports your firm actually reads.
Your CRM
Create or update clients from your CRM, matched on the CRM's own ID, and read back their households, accounts and annual reviews.
Your consultancy's systems
Work each client firm's records with one consultancy token, and read template drift, push history, coverage and firm health across every firm you manage.
OpenAPI 3.1 spec
Every endpoint, parameter and field is in the API reference customers see in the app. Ask us for the OpenAPI 3.1 spec to generate a typed client in your language, or call the endpoints directly.
A demo environment, on request
We can set up a demo environment with sample data so your team can build and test before connecting your firm's own records.
What you can count on.
Your permissions, exactly
A token acts as the person who owns it, with exactly the access that person has in the app. It's read-only unless created with write access, it expires after the period you choose (30 days to a year), and it can be revoked at any time.
Retry-safe client writes
Create or update a client by your CRM's own ID. A retry after a timeout updates the same client instead of making a second one.
Changes on the record
Every client created or updated through the API is in the audit trail under the token owner's name, and each token shows when it was last used.
Generated from the code
The OpenAPI spec is generated from the code that serves the API, and our build fails if the two drift apart.
Clear rate limits
Requests are rate-limited. A 429 response carries a Retry-After header, so your integration knows when to try again.
Common questions.
Retry-After header that tells your integration when to try again.rfn_. Once your firm has API access, your CCO creates tokens in Settings, and a consultant does the same for their consultancy. A token is read-only unless created with write access, expires after 30 to 365 days, and can be revoked at any time. Each token acts as the person who owns it, with exactly their access in the app.external_id and external_id_type) when you create or look up a client, and RegFin returns or updates the existing client instead of making a duplicate. A PATCH or PUT sets only the fields you send, so repeating one has the same result.See it running on your stack.
Book a demo and we'll walk your team through the endpoints and the OpenAPI spec, then show how RegFin fits the software your firm already runs.
Book a demo →