ISMS Directory

    ISMS Directory API and developer resources

    Public HTTP APIs and MCP for looking up vetted ISO 27001, SOC 2, and GRC vendors. Catalog GET is free and does not use an API key. There is no sandbox that writes the catalog. Search the live directory.

    Quickstart

    GET https://ismsdirectory.com/api/v1/search?framework=iso-27001&region=germany&service_type=consulting
GET https://ismsdirectory.com/openapi.json
GET https://ismsdirectory.com/llms.txt
GET https://ismsdirectory.com/agent.txt

    Unversioned GET /api/search is the same handler. No sunset is scheduled. New integrations should call /api/v1/search.

    ISMS Directory OpenAPI

    Machine-readable spec: https://ismsdirectory.com/openapi.json. Operations: catalog search, market page-interest, tools dump, Ask AI. Errors are JSON with code, message, and hint.

    Versioning and deprecation

    Stable REST uses a major version in the path, starting at /api/v1/. Backward-compatible fields may be added inside v1. A breaking change requires /api/v2/. Before removing a stable version we publish a migration note and send RFC 9745 Deprecation and Sunset headers, with at least 90 days before removal. No sunset is scheduled today.

    Rate limits

    Catalog and market GET advertise RateLimit-Policy: "catalog";q=120;w=60 and a matching RateLimit header (120 requests per 60 seconds per IP). Catalog GET is also CDN-cached. A 429, if ever issued, will include Retry-After. Homepage Ask AI has a separate tighter limit and may 503 when the corpus gate fails.

    MCP

    stdio MCP: npx -y @ismsdirectory/mcp-server. Server card: /.well-known/mcp/server-card.json. Human page: /mcp. Prefer HTTP GET /api/v1/search when you can fetch URLs.

    Pricing

    API lookup is free. Listing a vendor is free (queued) or fast-track at the price already on /fast-submission. Machine-readable: /pricing.md.

    Also

    ISMS Directory API and developer resources