# Automate the Compliance Portal

Use scoped API tokens to manage records, evidence, backups, and supplier questionnaires in a Space.

Create a token for your Space in [Dashio App](https://app.dashio.net). The Space needs an active Compliance entitlement. Grant the [scopes your integration needs](/developers/authentication#compliance).

## Read records and revisions

Read the Space's [entitlements](/api/operations/getDeveloperComplianceEntitlements) and the [Compliance catalog](/api/operations/getDeveloperComplianceCatalog). Use each collection's read scope for paginated inventory and individual records. Continue a list with its returned cursor. If a newer workspace revision invalidates the cursor, restart the list.

Send the current revision when creating, editing, or deleting a control, risk, or training policy. If the revision changed, read the current record and review the intended edit before retrying. A linked record can block deletion.

## Save a workspace

[Read the current workspace](/api/operations/readDeveloperComplianceWorkspace), edit the intended records, and [save all 16 collections](/api/operations/saveDeveloperComplianceWorkspace) with the revision you read. Set `DASHIO_REQUEST_JSON` to the path of your prepared JSON body when running a generated example. A successful save returns the new revision.

Adding, changing, or removing attachments also needs `compliance:evidence:write`. Approving a Trust Center disclosure also needs `compliance:trust-access-requests:approve`. Use the [OpenAPI downloads](/developers/openapi) for the complete collection schema.

## Download evidence and exports

[List evidence](/api/operations/listDeveloperComplianceEvidence) to find the record ID and check attachment availability. Use the separate [attachment scope](/api/operations/downloadDeveloperComplianceEvidence) for file contents. [Prepare an export](/api/operations/prepareDeveloperComplianceExport) by sending a supported selector. Questionnaire responses and Trust disclosures require approval. Check `Content-Type` and `Content-Disposition`, then save the response bytes to a private file.

## Back up and import

[Download a portable backup](/api/operations/downloadComplianceWorkspaceBackup) and protect it as private workspace data. [Preview an import](/api/operations/previewComplianceBackupImport) to review counts, conflicts, schedules to pause, blockers, and additional scopes. [Commit the import](/api/operations/commitComplianceBackupImport) with the same backup and the preview revision. Imports add missing records. Conflicting saved IDs and new Trust disclosure approvals block the commit. Use a workspace save with the approval scope to approve a current Trust disclosure.

## Deliver supplier questionnaires

[Read a supplier's delivery status](/api/operations/getDeveloperSupplierDelivery) to find the current case and version. Use separate scopes to [change a case or pause delivery](/api/operations/changeDeveloperSupplierDelivery) and [queue email delivery](/api/operations/queueDeveloperSupplierDelivery). Persist an `Idempotency-Key` for each write and reuse it for an identical retry within seven days. Verify the supplier contact in the Portal before queuing email. Use the separate scope to [list submitted case evidence](/api/operations/listDeveloperSupplierDeliveryEvidence) and download verified files.