Every MCP tool has a REST equivalent under /api/v1 for custom agents and the built-in assistant. Authenticate with a bearer token: create an API key on the API keys page of your workspace and send it as Authorization: Bearer <key>.
export TOKEN=...
export HOST=https://certikit.io
curl -s -H "Authorization: Bearer $TOKEN" "$HOST/api/v1/standards"
curl -s -H "Authorization: Bearer $TOKEN" "$HOST/api/v1/search?q=information+security+policy&standard=iso27001"
curl -s -H "Authorization: Bearer $TOKEN" "$HOST/api/v1/standards/iso27001/requirements/A.5.1"
curl -s -H "Authorization: Bearer $TOKEN" "$HOST/api/v1/standards/iso27001/mandatory-documents"
curl -s -H "Authorization: Bearer $TOKEN" "$HOST/api/v1/documents/ISMS-DOC-05-4"
curl -s -H "Authorization: Bearer $TOKEN" "$HOST/api/v1/standards/iso27001/clauses/9.2/evidence"
curl -s -H "Authorization: Bearer $TOKEN" "$HOST/api/v1/crosswalk?from=iso27001&to=iso27701&clause=9.2"
curl -s -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"standard":"iso27001"}' "$HOST/api/v1/gap-assessments"
curl -s -X POST -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"question_id":"4.1-1","answer":"yes"}' "$HOST/api/v1/gap-assessments/1/answers"
curl -s -H "Authorization: Bearer $TOKEN" "$HOST/api/v1/gap-assessments/1/report"
curl -s -H "Authorization: Bearer $TOKEN" "$HOST/api/v1/workspace/profile"
curl -s -X PATCH -H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" -d '{"organisation_name":"Acme Ltd","size":"small"}' "$HOST/api/v1/workspace/profile"
Responses are {"data": …}. Errors: 401 no or expired token; 403 {"message"} when the plan, standard, daily document limit or a suspension blocks the call (the message says what to do); 404 unknown clause, document or assessment with the nearest valid refs; 422 validation. Rate limit: 60 requests a minute on the free tier, 300 on paid tiers, per workspace.
Every passage and document carries a citation (doc_ref, title, standard, toolkit_version, section, heading, clauses, mandatory). Requirement answers end with a note reminding the reader that the normative wording lives in the licensed standard.