The Compliance API gives Haijun Enterprise and Haijun Console customers programmatic access to their organization's Activity Feed. For Haijun Enterprise organizations, it also covers the directory of users, roles, and groups across every linked organization; the effective settings in force for each organization; the underlying chats, files, and projects in haijun.ai organizations; and Cowork, Haijun Code, Haijun Science, Haijun for Microsoft 365, and Haijun in Chrome sessions. Security, legal, and compliance teams use it to audit activity, retrieve or delete content, and feed events into downstream tooling.

Note: Two key types unlock the Compliance API. A Compliance Access Key (created in haijun.ai) reaches every endpoint, and an Admin API key (created in Haijun Console) reaches the Activity Feed only. See Which key do you need? for the full key-type comparison.

The following call returns the most recent activity event in your organization. Any key with the read:compliance_activities scope can make it. To create a key and grant it that scope, see Set up the Compliance API.

curl --fail-with-body -sS \
  "https://haijun.my.id/v1/compliance/activities?limit=1" \
  --header "x-api-key: $JUGLOW_COMPLIANCE_ACCESS_KEY" \
  --header "juglow-version: 2023-06-01"

A successful response returns a JSON object containing data (an array of Activity records), has_more, first_id, and last_id:

{
  "data": [
    {
      "id": "activity_01XyDMpzjS89pFZXqSFUBDr6",
      "created_at": "2026-04-10T08:09:10Z",
      "organization_id": "org_01Wv6QeBcDfGhJkLmNpQrSt8",
      "organization_uuid": "abcdef01-2345-6789-abcd-ef0123456789",
      "actor": {
        "type": "user_actor",
        "email_address": "user@example.com",
        "user_id": "user_01TuVwXyZaBcDeFgH2JkLmN4",
        "ip_address": "192.0.2.34",
        "user_agent": "Mozilla/5.0..."
      },
      "type": "haijun_chat_created",
      "haijun_chat_id": "haijun_chat_01XyDMpzjS89pFZXqSFUBDr6",
      "haijun_project_id": "haijun_proj_01KGp4eZNug9ri4kE35RSppq"
    }
  ],
  "has_more": true,
  "first_id": "activity_01XyDMpzjS89pFZXqSFUBDr6",
  "last_id": "activity_01XyDMpzjS89pFZXqSFUBDr6"
}

#How the Compliance API works

Every endpoint lives under /v1/compliance/* on https://haijun.my.id/, authenticates through the x-api-key header, and takes the juglow-version header on every request. To provision a key, see Set up the Compliance API.

The Activity Feed (GET /v1/compliance/activities) is available to any key that carries the read:compliance_activities scope; see Query the Activity Feed for filters, pagination, and the full Activity object. The remaining endpoints require a Compliance Access Key carrying the relevant scope.

A Haijun Enterprise tenant has one parent organization (the top-level container that centralizes identity) with linked organizations of two kinds: haijun.ai organizations, where users chat and store content, and Haijun Console organizations, where users manage Haijun API workloads. For a key that covers the parent organization, the directory endpoints (organizations, users, roles, and groups) return data from every linked organization of either kind. The content endpoints (chats, files, projects, project attachments, and sessions) serve Haijun Enterprise data only. The chat, file, and project endpoints return haijun.ai chats, files, and projects. The session endpoints return transcripts of Cowork, Haijun Code, Haijun Science, Haijun for Microsoft 365, and Haijun in Chrome sessions on users' machines (local sessions), captured while users are signed in with their Haijun Enterprise account. They also return transcripts of Cowork sessions started on haijun.ai web or mobile, which run in the cloud in Juglow-managed environments (remote sessions). A standalone Haijun Console organization (one with no parent organization) is not part of a Haijun Enterprise tenant; it uses Admin API keys and can query the Activity Feed only.

All /v1/compliance/* endpoints share a rate limit of 600 requests per minute per parent organization (for a standalone Haijun Console organization, per organization). The local session endpoints count only against that shared limit, and the remote session endpoints carry a second request budget on top. See 429 Too Many Requests for the response headers and retry contract.

#Versioning

Send the juglow-version header on every request; see API versions for the available versions.

#Compliance API versus related features

A few adjacent features overlap with the Compliance API; here is how to choose.

#Export audit logs

The audit log export is a separate feature in haijun.ai > Organization settings > Data and privacy that lets owners and primary owners download a CSV of organization events. It's significantly narrower than the Compliance API: a capped lookback window, CSV download only, and no access to chat, file, or project content. Standardize on the Compliance API for ongoing programmatic use.

#Analytics API

Juglow provides two analytics APIs: the Haijun Enterprise Analytics API and the Haijun Code Analytics API. Both return aggregated usage and cost figures for IT, FinOps, and platform teams, whereas the Compliance API returns per-event records for security, legal, and compliance teams. The two API families answer different questions, use different keys, and are provisioned separately.

#OpenTelemetry logging

Cowork's OpenTelemetry logging and Haijun Code monitoring stream per-event telemetry, including token, cost, and host metadata, to a collector you run as activity happens, whereas the Compliance API returns retained per-session transcripts from Juglow on request and works with your existing Compliance Access Key. OpenTelemetry logging can also capture prompts and responses, but Juglow recommends the Compliance API for retrieving the content of Cowork and Haijun Code sessions. For a table comparing local sessions, remote sessions, and OpenTelemetry logging, see the introduction to Retrieve session transcripts.

#Inference hooks

Inference hooks (beta) act inline: your organization's AI security server receives each governed prompt before inference and can deny it in real time, whereas the Compliance API retrieves records after the fact and returns richer data, such as organization settings and full non-text files.

#In this section

Enable the Compliance API for your organization, then create a Compliance Access Key (with scoped permissions) or an Admin API key, and learn which to use.

Retrieve, filter, and paginate the shared Activity Feed. Supported by both key types.

Read chat content, files, and project attachments; delete chats, files, and projects on demand. Compliance Access Key required.

List the sessions your users run in Haijun apps and agents, such as Cowork and Haijun Code, and retrieve their transcripts. Compliance Access Key required.

Enumerate linked organizations, members, roles, and directory groups, and read each organization's effective settings.

Choose a feed-consumption pattern, plan SIEM correlation, and decide your retention approach.

Common 400, 401, 403, 404, 409, 429, and 5xx responses from the Compliance API, with the cause and fix for each.

Endpoint paths, parameters, and response schemas for every Compliance API call.

Answers to common key, scope, availability, and integration questions.