https://api.vaquill.ai/workspace/v1, and every call carries Authorization: Bearer vq_ws_....
Run a check
documentText is between 100 and 200,000 characters. Answers 202 with an operation of type complianceCheck.run; the check id arrives on the operation’s resource and looks like cck_ plus 32 hex characters.
The regulations you can check against
regulationType accepts these fourteen, and nothing else:
gdpr, uk_gdpr, ccpa, dpdp, lgpd, ferpa, hipaa, glba, tcpa, sox, pci_dss, dora, nis2, soc2.
There is no
other. A regulation without a full requirement checklist behind it falls through to a generic one, which produces an answer shaped exactly like a real one and is worth less than no answer. The list above is the set that has a checklist, and anything else is refused by the schema with a 422 before any work starts.Document category
documentCategory defaults to other and sharpens which requirements apply. Unlike the regulation, other here is a real answer: it means “none of the listed shapes”, not “unsupported”.
dpa, privacy_policy, terms_of_service, data_breach_plan, consent_form, dsr_process, vendor_agreement, information_security_policy, incident_response_plan, financial_report, ict_risk_policy, business_continuity_plan, other.
context is up to 2,000 characters of anything else that changes which requirements bite: the industry, the data types processed, the jurisdictions involved.
Reading the result
200 at any point, with status drawn from the same five public values an operation uses. While it is queued or running, requirements is empty and the scalar fields are absent.
Two fields worth branching on
deterministicCoverage is the fraction of requirements that had keyword evidence in the document, between 0 and 1. It is the one number that says how much of the verdict rests on the document rather than on the model’s priors. Low coverage on a long document usually means the document does not address the regulation at all, which is itself the finding.
preCheckFlags names the places where the model and a deterministic keyword scan disagreed. Each one is worth a human glance before you act on that requirement.
Export a report
201 with {format, filename, url, expiresAt, sizeBytes}. format is pdf or docx. The URL is signed and lives fifteen minutes.
Retries and capacity
This endpoint takesIdempotency-Key. An organization may have 5 checks in flight at once; a sixth is refused with 429 concurrency-limit-reached.
Errors
Branch on
type, never on detail. Full shape in Errors.
Scopes
What is not here
There is no list endpoint and no delete. Hold the id you were handed at launch time. A compliance check is an analysis of a document you send, not of a document in the workspace. If the document is already uploaded, pull its text first withGET /v1/matters/{matterId}/documents/{documentId}/text and check the truncated flag before passing it in.
What to read next
NDA triage
The other screening tool: ten criteria over an inbound NDA.
Operations
The job envelope a check returns, and how to poll it well.