SAI360 API
SAI360 is enterprise software for Governance, Risk, and Compliance (GRC) that consolidates risk registers, controls, audits, vendor risk, policies, incidents, and ethics & compliance learning. An unofficial API lets you programmatically pull risks, controls, KRIs, audits, findings, is
What is SAI360?
SAI360 is a cloud platform for Governance, Risk & Compliance and Integrated Risk Management. Organizations use SAI360 to manage enterprise and IT risk, control frameworks, audits and findings, regulatory obligations, policies, third‑party risk assessments, incidents, and ethics & compliance training—often with role‑based portals tailored to risk owners, auditors, compliance managers, and business users.
Core product areas include:
- Enterprise & IT Risk Management (Risk Registers, KRIs, Controls, Assessments)
- Audit Management (Audit Plans, Fieldwork, Findings, Corrective Actions)
- Compliance Management & Regulatory Change (Obligations, Policies, Attestations, Control Mapping)
- Third‑Party Risk Management (Vendors, Assessments, Questionnaires, Issues)
- Ethics & Compliance Learning (Training Assignments, Completions)
- Incident Management & EHS (Incidents, Investigations, CAPA)
- Business Continuity & Resilience (BIAs, Plans, Exercises)
Common data entities:
- Organizations, Users, Roles/Permissions
- Risks (metadata, categories, owners, inherent/residual scores)
- Controls and Control Tests (design/operating effectiveness)
- KRIs and Metrics (thresholds, trend, alerts)
- Audits, Procedures, Workpapers, Findings
- Issues and Corrective Actions (CAPA)
- Vendors/Third Parties, Assessments, Questionnaires
- Policies, Policy Versions, Attestations
- Training Assignments/Completions and Learning Content
- Incidents/Events, Investigations, Root Cause
- Business Impact Analyses (BIAs), Continuity Plans
The SAI360 Integration Challenge
Organizations rely on SAI360 daily, but turning portal‑based workflows into API‑driven automation is non‑trivial:
- Role‑aware workflows: Risk owners, auditors, compliance, vendors, and business users each see different fields, states, and actions
- Regulatory rigor: Risk scoring, control effectiveness, audit evidence, and policy attestation require careful handling and traceability
- Workflow complexity: Multi‑step assessments, approvals, and CAPA lifecycles are optimized for front‑end flows
- Authentication complexity: MFA, session lifecycles, and vendor portals complicate headless automation
- Data spread: Key objects span risks, controls, audits, vendors, policies, incidents, and training with context across modules
How Supergood Creates SAI360 APIs
Supergood reverse‑engineers authenticated browser flows and network interactions to deliver a resilient API endpoint layer for your SAI360 tenant.
- Handles username/password and MFA (SMS, email, TOTP) securely
- Maintains session continuity with automated refresh and change detection
- Normalizes responses so you can integrate once and rely on consistent objects across modules
- Aligns with customer entitlements and role‑based permissions to ensure compliant access
Getting Started
- Schedule Integration Assessment
Book a 30‑minute session to confirm your modules, licensing, and authentication model.
- Supergood Builds and Validates Your API
We deliver a hardened SAI360 adapter tailored to your workflows and entitlements.
- Deploy with Monitoring
Go live with continuous monitoring and automatic adjustments as SAI360 evolves.
API Endpoints
Authentication
/sessionsEstablish a session using credentials. Supergood manages MFA (SMS, email, TOTP). Returns a short‑lived auth token maintained by the platform.
Authentication
/sessions/refreshRefresh an existing token to keep sessions uninterrupted.
Risks
/risksList risks with filters, scoring, and KRI summaries.
Third‑Party Assessments
/third-parties/{thirdPartyId}/assessmentsCreate a vendor risk assessment with questionnaire assignment, due date, and reviewers.
Audit Findings
/audits/{auditId}/findings/{findingId}Update audit finding status, severity, and corrective actions.
Policy Attestations
/policies/{policyId}/attestationsRecord a user’s acknowledgement of a policy version, with audit metadata.
Use Cases
Risk & Control Data Sync
- Mirror risks, controls, and KRIs into your internal IRM or analytics stack - Keep risk metadata current for reporting and dashboards - Normalize scoring, categories, and ownership across business units
Vendor Risk & Assessments Automation
- Launch vendor questionnaires (e.g., SIG, ISO 27001) from your platform - Track assessment status, evidence submissions, and findings - Push remediation tasks into Jira or ServiceNow and sync closure back to SAI360
Audit & Findings Management
- Ingest audit plans, procedures, and findings for continuous monitoring - Attach evidence from your data lake and update corrective actions programmatically - Drive SLA alerts and escalate overdue CAPA items
Policies, Training, & Attestations
- Sync policy catalogs and versions, record staff attestations from your app - Assign ethics & compliance training and pull completion data for HR/ops - Reconcile obligations and control mappings for regulatory reporting
Incident & Issue Management
- Create incidents from detection systems and route investigations - Track root cause, impact, and corrective actions with attachments - Feed incident data to analytics and resilience programs
Technical Specifications
Authentication
Username/password with MFA (SMS, email, TOTP); supports service accounts or customer‑managed credentials
Response format
JSON with consistent resource schemas and pagination across modules
Rate limits
Tuned for enterprise throughput while honoring customer entitlements and usage controls
Session management
Automatic reauth and cookie/session rotation with health checks
Data freshness
Near real‑time retrieval of risks, controls, audits, vendors, policies, incidents, and training objects
Security
Encrypted transport, scoped tokens, and audit logging; respects SAI360 role‑based permissions
Webhooks
Optional asynchronous delivery for long‑running workflows (e.g., assessments, CAPA updates, policy attestations)
Latency
Sub‑second responses for list/detail queries under normal load
Throughput
Designed for high‑volume risk, audit, and assessment sync with attachment handling
Reliability
Retry logic, backoff, and idempotency keys minimize duplicate actions
Adaptation
Continuous monitoring for UI/API changes with rapid adapter updates
Frequently asked questions
Supergood supports workflows across commonly used modules such as Risk Management (Risks, Controls, KRIs), Audit Management (Plans, Procedures, Findings, CAPA), Compliance & Policies (Obligations, Policy Attestations), Third‑Party Risk (Vendors, Assessments, Questionnaires), Ethics & Compliance Learning (Assignments, Completions), and Incident/EHS, subject to your licensing and entitlements. We scope coverage during integration assessment.
We support username/password + MFA (SMS, email, TOTP). Sessions are refreshed automatically with secure challenge handling.
Yes. We can normalize findings, CAPA items, and evidence to match your schema and push updates to systems like Jira or ServiceNow while complying with rate and permission constraints. Status changes are reconciled back into SAI360 with webhooks or polling.
Yes. We support recording policy acknowledgements, downloading attestation artifacts, assigning training, and retrieving completion data via normalized responses with checksum validation and time‑limited URLs for attachments.