NIS2Europe API Developer Portal

Quick Start

Get compliance information for your organisation in under 2 minutes:

# 1. Check NIS2 applicability for a 120-employee energy company in Germany
curl -X POST https://api.nis2europe.eu/v1/scoping \
  -H "X-API-Key: nis2_test_client_XXXX" \
  -H "Content-Type: application/json" \
  -d '{"tootajad":120,"sektor":"energia","kaive_meur":25,"riik":"de","keel":"en"}'

# 2. Get NIS2 → ISO 27001 framework mapping
curl https://api.nis2europe.eu/v1/framework-mapping \
  -H "X-API-Key: nis2_test_client_XXXX"

# 3. Generate incident notification templates (24h/72h/30d)
curl -X POST https://api.nis2europe.eu/v1/incident-templates \
  -H "X-API-Key: nis2_test_client_XXXX" \
  -H "Content-Type: application/json" \
  -d '{"detected_at":"2026-07-22T10:00:00Z","country":"de","language":"en","incident_summary":"Ransomware attack on core IT systems"}'

import requests

API_KEY = "nis2_test_client_XXXX"  # replace with your key
BASE = "https://api.nis2europe.eu"
headers = {"X-API-Key": API_KEY}

# 1. Scoping check
resp = requests.post(f"{BASE}/v1/scoping", headers=headers, json={
    "tootajad": 120, "sektor": "energia", "kaive_meur": 25, "riik": "de", "keel": "en"
})
result = resp.json()["data"]
print(result["klassifikatsioon"])  # "essential" | "important" | "out_of_scope"

# 2. Framework mapping
mapping = requests.get(f"{BASE}/v1/framework-mapping", headers=headers).json()

# 3. Order a compliance document package
order = requests.post(f"{BASE}/v1/orders", headers=headers, json={
    "teenus": "pakett", "riik": "de"
}).json()["data"]
print(order["makselink"])  # Revolut payment link

const API_KEY = 'nis2_test_client_XXXX';
const BASE = 'https://api.nis2europe.eu';

// 1. Scoping check
const scope = await fetch(`${BASE}/v1/scoping`, {
  method: 'POST',
  headers: { 'X-API-Key': API_KEY, 'Content-Type': 'application/json' },
  body: JSON.stringify({ tootajad: 120, sektor: 'energia', kaive_meur: 25, riik: 'de', keel: 'en' })
}).then(r => r.json());
console.log(scope.data.klassifikatsioon);

// 2. All framework mappings
const maps = await fetch(`${BASE}/v1/framework-mapping`, {
  headers: { 'X-API-Key': API_KEY }
}).then(r => r.json());

Authentication

All API requests require an API key passed in the X-API-Key header.

Response envelope

Every response is wrapped in a consistent envelope:

{
  "data": { ... },        // endpoint-specific payload
  "meta": {
    "powered_by": "AIPOS OÜ (reg. 16966532)",
    "request_id": "550e8400-e29b-41d4-a716-446655440000",
    "environment": "sandbox"  // only for nis2_test_ keys
  }
}

Sandbox Mode

• All read endpoints (scoping, mapping, incident-templates, wizard) return real data from the knowledge base.
• POST /v1/orders returns a realistic mock order — no Revolut payment link is created, no documents are generated.
• Sandbox keys auto-receive Professional-tier rate limits (300 req/min, 10 000 req/month).
• Sandbox environments are clearly marked in all API responses and must not be used in production.

Sandbox order response

{
  "data": {
    "order_id": "sandbox-demo-order-001",
    "teenus": "pakett", "riik": "DE",
    "makse_staatus": "tasutud",
    "dokumendi_staatus": "vabastatud",
    "tulemus": {
      "dokumendid": [{ "nimi": "NIS2_Riskijuhtimispoliitika_SANDBOX.md", ... }],
      "sandbox_note": "SANDBOX: mock data only."
    }
  },
  "meta": { "environment": "sandbox", "powered_by": "AIPOS OÜ (reg. 16966532)", ... }
}

API Endpoints

Base URL: https://api.nis2europe.eu  |  Current version: v1

POST /v1/scoping — NIS2 Applicability

Deterministic classification: essential / important / out_of_scope. No LLM, <200ms.

Request

{
  "tootajad": 120,        // employees (required); size class is derived from this + turnover
  "sektor": "energia",    // NIS2 Annex I/II sector key — full list: GET /v1/scoping/questions
  "kaive_meur": 25,       // annual turnover, MEUR (optional)
  "riik": "de",           // ISO 3166-1 alpha-2 (23 live EU countries)
  "keel": "en"            // response language ("en" | "et" | "de" | "fi" | ...)
}

Response

{
  "data": {
    "klassifikatsioon": "important",  // "essential" | "important" | "out_of_scope"
    "suurus": "keskmine",
    "sektor": "energia",
    "annex": "I",
    "pohjendused": ["A medium-sized entity in the sector 'Energy' (Annex I) -> IMPORTANT (Art 3(2))."],
    "sources": [
      { "seadus": "Directive (EU) 2022/2555", "paragrahv": "art 3(1)", "kb_versioon": "kb_2026-07-22_c109ef7f" }
    ]
  }
}

GET /v1/framework-mapping — Framework Cross-Mapping

NIS2 art 21(2) sub-measures (a–j) mapped to ISO 27001, DORA, and GDPR controls.

Single measure example

curl https://api.nis2europe.eu/v1/framework-mapping/a \
  -H "X-API-Key: nis2_test_client_XXXX"

# Response
{
  "data": {
    "artikkel": "art 21(2)(a)",
    "kirjeldus": "Policies on risk analysis and information system security",
    "iso27001": ["A.5.1", "A.8.8"],
    "dora": ["Art. 5"],
    "gdpr": ["Art. 32"],
    "sources": [ ... ]
  }
}

POST /v1/incident-templates — Notification Templates

Generate NIS2 art 23 incident notification text for all three stages (24h early warning, 72h incident notification, 30-day final report).

Request

{
  "detected_at": "2026-07-22T10:00:00Z",  // ISO 8601
  "country": "de",
  "language": "en",
  "incident_summary": "Ransomware encrypting ERP system"
}

Response (truncated)

{
  "data": {
    "phases": [
      {
        "phase": "early_warning",
        "deadline": "2026-07-23T10:00:00Z",
        "legal_basis": "Directive (EU) 2022/2555 art 23(1)",
        "template": "Early warning — 24 hours\n\n...",
        "sources": [ ... ]
      },
      { "phase": "incident_notification", ... },
      { "phase": "final_report", ... }
    ]
  }
}

POST /v1/wizard/evaluate — Gap Analysis

Free gap analysis against all 10 NIS2 art 21(2) security measures. Returns current compliance score and prioritised recommendations.

curl -X POST https://api.nis2europe.eu/v1/wizard/evaluate \
  -H "X-API-Key: nis2_test_client_XXXX" \
  -H "Content-Type: application/json" \
  -d '{"vastused":{"1":"no","2":"partial","3":"yes"},"keel":"en","riik":"de"}'

resp = requests.post(f"{BASE}/v1/wizard/evaluate", headers=headers, json={
    "vastused": {"1": "no", "2": "partial", "3": "yes"},
    "keel": "en", "riik": "de"
})
data = resp.json()["data"]
print(data["skoor"], data["jargmine_samm"])

Orders — Document Packages

Order a legally-grounded NIS2 compliance document package. Payment via Revolut; documents released within 15 minutes of payment confirmation.

POST /v1/orders — create order

{
  "teenus": "pakett",    // "pakett" | "b_skann" | "yksikdokument" | "hooldus" | ...
  "riik": "de",          // target jurisdiction
  "idempotency_key": "your-unique-key-001"  // optional; prevents duplicates
}

Response includes makselink (Revolut hosted payment page). After payment, documents are generated and available via the tulemus.dokumendid[].allalaadimislink fields. Download links are time-limited (72 hours).

GET /v1/orders/{order_id} — poll status

POST /v1/account/vat — VAT / Billing Details

Set your VAT number and billing address. VIES validation runs at invoice creation time.

{
  "kmkr": "DE123456789",      // VAT registration number
  "arveldus_riik": "de",     // billing country (ISO alpha-2)
  "arveldus_aadress": "Musterstraße 1, 10115 Berlin",
  "reg_kood": "HRB 12345"    // company register code
}

GET /v1/billing/summary — Usage & Invoices

Returns your orders, invoices (with download links), active subscription, and monthly API usage vs limit.

GET /v1/status — Service Health

Public endpoint (no auth). Returns overall health and per-service status.

{
  "data": {
    "overall": "operational",
    "timestamp": "2026-07-22T18:00:00Z",
    "teenused": {
      "api":      { "status": "ok" },
      "database": { "status": "ok" },
      "redis":    { "status": "ok" },
      "worker":   { "status": "ok" }
    }
  }
}

GET /v1/changelog — KB Version History

Returns the structured knowledge base changelog — which legal source changed and when.

curl https://api.nis2europe.eu/v1/changelog

Error Codes

All errors follow the envelope format: {"error": {"code": "...", "message": "...", "request_id": "..."}}

On rate limiting, the response includes headers: X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset, Retry-After.

Rate Limits

Every response includes X-RateLimit-* headers so you can track consumption programmatically. Each authenticated API key is tracked independently.

Pricing

What the licence includes — and what it does not

Payment rule: All orders are prepaid via Revolut to AIPOS OÜ. Documents are released only after payment confirmation. No credit terms.

→ SLA & versioning policy