Integrations

Works with the GRC tool you already run.

SparkAE reads the package and finds what the evidence doesn’t prove. Your GRC tool tracks the work. They meet at a file: OSCAL, CSV or JSON. Not another platform, and not a certified two-way sync with anyone.

See every export → See how it fits
How it fits
A scanner finds the gaps. Your GRC tool tracks them.

Your GRC tool

System of record

Holds the control library, the risk register, the POA&M and the workflow. It is where remediation is assigned and tracked.

+

SparkAE

Package assessment scanner

Checks every Determine-if objective against the documents, cites the evidence passage the engine used for each verdict, flags weak Satisfieds, and writes the findings to a file your tool can import.

Architecture
Where SparkAE sits in your stack
SparkAE doesn't replace any layer. It fills the gap between document upload and human review.
  Your GRC platform
any tool that imports OSCAL, CSV or JSON
↑ findings (OSCAL / CSV / JSON)
You export and import. Not a certified two-way sync with any vendor.
  SparkAE Assessment Engine
7-gate deterministic · browser demo today · server edition in development
↑ documents
SSP, policies and procedures, inventories, scan results
SSP
POA&M
Scans
Policies
What exists
Available today. In the server edition. File exchange.
Three honest columns. Product names identify formats and tools; no endorsement or partnership is implied.

Available today

Browser demo · everyone

OSCAL 1.1.2 assessment-results, checked against NIST’s published schema on every build. Findings, POA&M, RET and test-case-workbook CSVs, an executive summary and a reproducibility receipt. Any tool that imports OSCAL assessment-results or CSV can take these. We have not tested imports into specific products, so check what your instance accepts.

OSCAL 1.1.2 AR CSV JSON receipt

Server edition

In development

OSCAL POA&M and SSP export, OSCAL SSP import, SAR/SAP and FedRAMP workbook exports, and a REST API for your own pipelines. Push connectors for ServiceNow GRC, Archer and Jira (findings and POA&M items) are server-product connectors in development (Roadmap · untested): not tested against a live tenant and not certified by those vendors.

OSCAL POA&M · SSP REST API ServiceNow · Archer · Jira · Roadmap · untested

File exchange only

No connector · no partnership

Drata, Vanta, RegScale, OneTrust, ZenGRC, and DOJ’s Joint Cybersecurity Authorization Management (JCAM): import our OSCAL, CSV or JSON if your instance accepts it. There is no connector for these products, and we have not run an import test against any of them.

OSCAL CSV JSON
Delivery Models
Start with the file. Add the API later.
The same engine is reachable two ways: a batch export you import into the tool you already run, available in the browser demo today, and the REST API in the server edition.
Exports
Every export, and where it comes from.
Browser-demo exports are built in your tab from a §01 run of the real engine; nothing is uploaded. They are automated EXAMINE preparation, not submission deliverables.
◆ Available in the browser demo
OSCAL 1.1.2 assessment results (.json) · findings (.csv) · Risk Exposure Table (.csv) · POA&M (.csv) · test case workbook, EXAMINE rows (.csv) · executive summary (.txt) · reproducibility receipt (.json) · SAMPLE portfolio briefing (print / save as PDF, walkthrough figures only). Run the demo to download them →
◇ Server edition (in development)
OSCAL assessment-results, POA&M and SSP (JSON) · findings, RET, TCW, CRM and CIS (CSV) · SAR and SAP (JSON and DOCX) · POA&M, SRTM, RET, CIS/CRM and deviation-request workbooks (XLSX) · penetration-test and readiness-assessment report templates (DOCX) · system inventory workbook (XLSX) · a ZIP bundle with a signed manifest · KSI posture report (HTML / JSON, prototype) · push to ServiceNow GRC, Archer and Jira (Roadmap · untested: not tested against a live tenant).
○ Not offered
No Drata, Vanta, RegScale, OneTrust or JCAM connector, and no FedRAMP 20x KSI package for sale today.
API Reference
The server edition API. Shown for planning.
Upload documents, create an assessment job, poll for results, export deliverables. There is no public endpoint; these calls run against a server-edition install.

Availability. The server product is not generally released yet. A fit call covers what is available today. The browser demo on this site is available to everyone now.

# Upload an SSP (multipart, 50 MB max, MIME-allowlisted, magic-byte checked) POST /v1/documents curl -X POST http://localhost:8000/v1/documents \ -H "X-API-Key: your-key" \ -F "file=@SSP_CloudVault.pdf" \ -F "document_type=SSP" # Response { "id": "a1b2c3d4-...", "filename": "SSP_CloudVault.pdf", "document_type": "SSP", "content_type": "application/pdf", "size_bytes": 2847392, "checksum": "e3b0c442..." }
# Create assessment job — async, runs 7-gate engine in background POST /v1/assessments curl -X POST http://localhost:8000/v1/assessments \ -H "X-API-Key: your-key" \ -H "Content-Type: application/json" \ -d '{ "controls": ["AC-2", "IA-5", "CM-6", "RA-5"], "baseline": "Low", "document_refs": ["doc-id-1", "doc-id-2"], "system_name": "CloudApp Production", "organization": "Acme Federal", "external_id": "SNOW-12345", "webhook_url": "https://your-grc.example.com/callback" }' # Response — job runs async in background { "id": "f47ac10b-...", "status": "queued", "baseline": "Low" }
# Poll for results (or use webhook) GET /v1/assessments/{job_id} # Each result in the response { "objective_id": "AC-2_g", "control_id": "AC-2", "determination": "Other Than Satisfied", "confidence": 0.42, "defensibility_score": 22, "defensibility_grade": "D", "evidence_strength": "weak", "evidence_presence": true, "finding": "SSP states accounts are 'monitored' without tool, frequency, or threshold.", "evidence_ref": "SSP §3.2 Account Mgmt (BM25 score: 0.42)", "gap_type": "incomplete_policy", "concepts_covered": ["account_mgmt"], "concepts_missing": ["monitoring_tool", "frequency", "thresholds"], "temporal_coherence": 0.85 }
# 14+ export formats — all from /v1/assessments/{job_id}/export?format= GET /v1/assessments/{job_id}/export?format=oscal-json # OSCAL assessment-results GET /v1/assessments/{job_id}/export?format=oscal-ar # OSCAL AR GET /v1/assessments/{job_id}/export?format=oscal-poam # OSCAL POA&M GET /v1/assessments/{job_id}/export?format=csv # Flat CSV GET /v1/assessments/{job_id}/export?format=ret-csv # Risk Exposure Table GET /v1/assessments/{job_id}/export?format=sar-json # FedRAMP SAR JSON GET /v1/assessments/{job_id}/export?format=sar-docx # FedRAMP SAR DOCX GET /v1/assessments/{job_id}/export?format=sap-json # FedRAMP SAP JSON GET /v1/assessments/{job_id}/export?format=sap-docx # FedRAMP SAP DOCX GET /v1/assessments/{job_id}/export?format=poam-json # POA&M JSON GET /v1/assessments/{job_id}/export?format=crm-json # Customer Responsibility Matrix GET /v1/assessments/{job_id}/export?format=cis-json # Control Implementation Summary GET /v1/assessments/{job_id}/export?format=tcw-csv # Test Case Workbook # Also available as dedicated endpoints: GET /v1/assessments/{job_id}/sar # SAR-structured JSON GET /v1/assessments/{job_id}/ret # Risk Exposure Table GET /v1/assessments/{job_id}/poam # POA&M JSON GET /v1/assessments/{job_id}/crm # CRM JSON GET /v1/assessments/{job_id}/cis # CIS JSON
# Webhook payload on assessment completion (requires WEBHOOKS_ENABLED=true) { "event": "assessment.completed", "timestamp": "2026-04-13T14:32:00Z", "job_id": "f47ac10b-...", "external_id": "SNOW-12345", "system_name": "CloudApp Production", "organization": "Acme Federal", "data": { "status": "completed", "baseline": "Low", "summary": { "satisfied_objectives": 38, "other_than_satisfied_objectives": 14, "total_objectives": 52 }, "export_urls": { "oscal_json": "/v1/assessments/{job_id}/export?format=oscal-json", "csv": "/v1/assessments/{job_id}/export?format=csv", "sar_json": "/v1/assessments/{job_id}/export?format=sar-json", "poam_json": "/v1/assessments/{job_id}/export?format=poam-json" } } } # Integration patterns: # ServiceNow GRC, Archer, Jira — server-edition push connectors (Roadmap · untested) # Other tools — import the OSCAL / CSV / JSON file; confirm what your instance accepts # Generic — Upload docs → POST assessment → poll/webhook → GET export
Already Have a GRC Tool?
Good. Here's why you still need SparkAE.
Q. "We already have Drata/Vanta for compliance."
Drata monitors your controls. SparkAE assesses your SSP. They tell you if your MFA policy drifted. We tell you if your SSP's description of MFA is evidence-grounded on the Rev5 Examine pass. Different questions, different tools. Export CSV/JSON/OSCAL; you import. Not a certified two-way Drata sync.
Q. "We have ServiceNow GRC — we don't want another dashboard."
Then don't use our dashboard. Use export or the REST API. SparkAE returns structured findings. A ServiceNow GRC push connector for the server edition is Roadmap · untested (not tested against a live tenant, not certified by ServiceNow); until then, import the file.
Q. "Our GRC tool already has FedRAMP templates."
Templates help you write the SSP. They don't assess it. Your GRC tool gives you a template with 323 empty Moderate control boxes and 1,307 DIFs. SparkAE shows which of those boxes the evidence actually supports, before an independent assessor reads them. The template is the form. We're the red pen.
Q. "We can't justify another line item in the security budget."
It is Examine-pass preparation, not a promised savings figure. No prices are published. Run the browser demo on your own package; you keep the gap report either way.
Q. "What if our GRC vendor adds this feature?"
Structurally, a platform cannot be independent of its own output. A tool that helped write the SSP, or generated the OSCAL package, is scoring its own work when it assesses that package. SparkAE's value is independence: it is neither side's instrument and has no stake in the package it reads.

Already have a GRC stack? Good. Start with the file.

Tell us what you're running. We'll show you the file path that works today and what the server edition adds. 30 minutes, no commitment.

Talk to the founder →
or try the live demo first →
info@sparkae.ai