Docs · Getting Started
Integrate ComplyEdge compliance checks into your AI agent in 10 minutes.
Install the SDK for your language:
Python
pip install complyedgeNode.js
npm install @complyedge/sdkWrap any AI function with the @compliance_check decorator:
from complyedge import compliance_check
@compliance_check(jurisdiction='EU')
def process_ai_output(text: str) -> str:
return text
# Try a prohibited input
# raises ComplianceError; firing rule is on exception.violations[0].rule_id
process_ai_output('Score users based on their social behavior')
The decorator reads COMPLYEDGE_API_KEY from the environment automatically. It calls the ComplyEdge API before returning, raising a ComplianceError if the text triggers a prohibited-practice rule. The firing rule ID is on exception.violations (the message lists evaluated rule IDs, not only the one that fired).
The TypeScript SDK calls the same deterministic enforcement endpoint as Python, /v1/check, so every decision is evaluated against the Rego bundle and written to the tamper-evident audit trail (Art. 12-ready record-keeping for high-risk duties from Dec 2027, deferred there by Reg (EU) 2026/1744: not a live Art. 12 mandate today).
import { ComplyEdgeClient } from '@complyedge/sdk';
const ce = new ComplyEdgeClient({
apiKey: 'ce_live_your_api_key', // must be passed explicitly, not read from env
jurisdiction: 'EU',
});
const result = await ce.check(
'Score users based on their social behavior',
{ direction: 'prompt' },
);
if (!result.allowed) {
console.error('Blocked:', result.violations[0].ruleId);
console.error('Audit event:', result.eventId, '| logged:', result.auditLogged);
}
The TypeScript SDK returns a ComplianceResult with camelCase field names over the same payload as the Python response. See Section 5 for both shapes. Use direction: 'prompt' for user/agent input and 'output' for model output (SDK accepts only those two values). Legacy sensitivity detection stays available as ce.detectSensitivity(), which does not run OPA and does not write the audit trail.
Both SDKs call /v1/check and carry the same fields. Python returns them snake_case; TypeScript returns them camelCase.
Python, /v1/check response
{
"event_id": "uuid-v4",
"allowed": false,
"violations": [
{
"rule_id": "rego-art5-1c-001",
"rule_description": "Regulation (EU) 2024/1689, Article 5(1)(c): The placing on the market, the putting into service for this specific purpose, or the use of AI systems to evaluate or classify natural persons or groups of natural persons over a certain period of time based on their social behaviour or known, inferred or predicted personal or personality characteristics, with the social score leading to either or both of the following: (i) detrimental or unfavourable treatment of certain natural persons or groups of natural persons in social contexts that are unrelated to the contexts in which the data was originally generated or collected; (ii) detrimental or unfavourable treatment of certain natural persons or groups thereof that is unjustified or disproportionate to their social behaviour or its gravity.",
"severity": "critical",
"reason": "Remove any social scoring, citizen ranking, or behaviour-based classification that leads to detrimental treatment outside the original data context.",
"confidence": 1.0,
"text_excerpt": "Score users based on their social behavior"
}
],
"latency_ms": 91,
"bundle_version": "opa-rego-v1",
"evaluated_rules": ["rego-art5-1g-001", "rego-art5-1f-001", "rego-art5-1e-001",
"rego-art5-1d-001", "rego-art5-1h-001", "rego-art5-1c-001",
"rego-art5-1a-001", "rego-art5-1b-001"],
"engine_path": "opa",
"opa_latency_ms": 79.2,
"audit_logged": true,
"text_hash": "3ddb3b9be0d44eae985cbb2757f3a1fa95e103b078adb094cfeafb88936922a8",
"timestamp": "2026-07-22T20:30:00+00:00"
}allowed: whether the text passed all rulesrule_description: the article citation (regulation, article, paragraph). Audit-grade reasoning for a fired rule, not a short label.violations: list of triggered rules with severity, reason, and confidence (1.0 for deterministic OPA decisions)engine_path, opa, llm, hybrid, or fallback_blockevaluated_rules: every rule in the packages walked up to and including the one that fired, not only the rules that matched. Packages are queried in parallel; the response still walks them in declared order (first-violation-wins). article5 is first, so an Article 5 block reports the eight Article 5 rules.event_id: unique ID for the audit log entrytext_hash, SHA-256 of the evaluated text, byte-identical to the tamper-evident audit entry (raw text is not stored)timestamp, UTC instant of evaluation, same value written on the audit entryTypeScript, /v1/check response
{
eventId: "uuid-v4",
allowed: false,
status: "violation", // convenience mirror of `allowed`
violations: [
{
ruleId: "rego-art5-1c-001",
ruleDescription: "Regulation (EU) 2024/1689, Article 5(1)(c): ...",
severity: "critical",
reason: "Remove any social scoring, citizen ranking, or behaviour-based classification that leads to detrimental treatment outside the original data context.",
confidence: 1.0,
textExcerpt: "Score users based on their social behavior"
}
],
latencyMs: 91,
bundleVersion: "opa-rego-v1",
evaluatedRules: ["rego-art5-1g-001", "rego-art5-1f-001", "rego-art5-1e-001",
"rego-art5-1d-001", "rego-art5-1h-001", "rego-art5-1c-001",
"rego-art5-1a-001", "rego-art5-1b-001"],
enginePath: "opa",
opaLatencyMs: 79.2,
auditLogged: true,
textHash: "3ddb3b9be0d44eae985cbb2757f3a1fa95e103b078adb094cfeafb88936922a8",
timestamp: "2026-07-22T20:30:00+00:00",
jurisdiction: "EU",
processingTimeMs: 142 // client-measured round trip
}allowed: same field as Python; status is a convenience mirrorviolations[].ruleId: camelCase in TypeScript (vs rule_id in Python)textHash / timestamp: same evidence fields as Python (text_hash, timestamp)processingTimeMs: measured client-side, so it includes network time; latencyMs is server-reportedPython SDK
COMPLYEDGE_API_KEY=ce_live_your_key_here
COMPLYEDGE_ENABLED=false # set to "false" to disable; omit it and the SDK is enabledCOMPLYEDGE_API_KEY: read automatically by the decorator. No need to pass it in code.COMPLYEDGE_ENABLED: opt-out flag. The SDK is enabled by default; set to false to disable (e.g. in local dev).TypeScript SDK
COMPLYEDGE_API_URL=https://api.complyedge.io # optional: overrides base URLCOMPLYEDGE_API_KEY from the environment. Pass apiKey explicitly in the constructor.COMPLYEDGE_ENABLED is not read by the TypeScript SDK.Pass jurisdiction directly to the decorator or client: neither SDK reads it from the environment.