Beta module namespace
compliance
Beta routes may change with notice and are NOT covered by the 24-month stable window of the core contract.
Every module route is enumerated with method, path, auth and required permission; request/response schemas are not published for the beta surface.
86 operations
| Method | Path | Required permission | Authentication | Summary |
|---|---|---|---|---|
| get | /v1/m/compliance/aims/pack | compliance:aims:read | Bearer token | compliance module route (requires compliance:aims:read) |
| post | /v1/m/compliance/aims/pack | compliance:aims:admin | Bearer token | Structures operator-supplied organizational context + the live ISO 42001 assessment into a certification-readiness pack (deny-closed: 501 without a configured packager, 422 on a document the packager rejects), persists the pack (one per tenant, replace-on-regenerate) anchored to the ledger head, and self-audits. |
| get | /v1/m/compliance/aims/pack/{id} | compliance:aims:read | Bearer token | compliance module route (requires compliance:aims:read) |
| delete | /v1/m/compliance/aims/pack/{id} | compliance:aims:admin | Bearer token | Removes a maintained pack; admin-tier and self-audited. |
| get | /v1/m/compliance/aims/pack/{id}/export | compliance:aims:read | Bearer token | compliance module route (requires compliance:aims:read) |
| get | /v1/m/compliance/calendar | compliance:framework:read | Bearer token | Returns the regulatory calendar + watchlist (read-tier; static verified data, not tenant evidence). |
| get | /v1/m/compliance/capabilities | compliance:framework:read | Bearer token | Returns the capability catalog with the tenant's live evidence state — the "what the platform can evidence right now" map. |
| get | /v1/m/compliance/claude-files | compliance:erasure:read | Bearer token | Serves the observe inventory (read-tier). |
| post | /v1/m/compliance/claude-files/{id}/erase | compliance:erasure:admin | Bearer token | Serves the governed point delete (admin-tier; the dual-control gate + hold gate + receipt are inside eraseClaudeFile). |
| post | /v1/m/compliance/data-subjects/{id}/erase | compliance:erasure:admin | Bearer token | compliance module route (requires compliance:erasure:admin) |
| get | /v1/m/compliance/data-subjects/{id}/erasure-status | compliance:erasure:read | Bearer token | compliance module route (requires compliance:erasure:read) |
| get | /v1/m/compliance/depth/ccm/drift | compliance:ccm:read | Bearer token | compliance module route (requires compliance:ccm:read) |
| post | /v1/m/compliance/depth/ccm/drift | compliance:ccm:admin | Bearer token | Compares two CCM snapshots (the two latest, or a specified snapshot_id and its predecessor) and persists per-control drift findings (deny-closed: 501 without the depth packager). |
| post | /v1/m/compliance/depth/ccm/snapshot | compliance:ccm:admin | Bearer token | Re-evaluates the assessment engine for a set of frameworks (or all catalog frameworks when none specified) at the current instant and persists the timestamped snapshot (deny-closed: 501 without the depth packager). |
| get | /v1/m/compliance/depth/ccm/snapshots | compliance:ccm:read | Bearer token | compliance module route (requires compliance:ccm:read) |
| get | /v1/m/compliance/depth/ccm/snapshots/{id} | compliance:ccm:read | Bearer token | compliance module route (requires compliance:ccm:read) |
| get | /v1/m/compliance/depth/fedramp | compliance:depth:read | Bearer token | compliance module route (requires compliance:depth:read) |
| post | /v1/m/compliance/depth/fedramp | compliance:depth:admin | Bearer token | Structures the live assessment into FedRAMP 20x Key Security Indicators in OSCAL v1.1.3 format with DoD impact-level framing (deny-closed: 501 without the depth packager, 422 on reject). |
| get | /v1/m/compliance/depth/fedramp/{id} | compliance:depth:read | Bearer token | compliance module route (requires compliance:depth:read) |
| delete | /v1/m/compliance/depth/fedramp/{id} | compliance:depth:admin | Bearer token | compliance module route (requires compliance:depth:admin) |
| get | /v1/m/compliance/depth/fedramp/{id}/export | compliance:depth:read | Bearer token | Exports the maintained FedRAMP KSI document with a LIVE ledger integrity proof. |
| get | /v1/m/compliance/depth/sector | compliance:depth:read | Bearer token | compliance module route (requires compliance:depth:read) |
| post | /v1/m/compliance/depth/sector | compliance:depth:admin | Bearer token | Structures operator-supplied sector context + the live assessment of sector-overlay frameworks into a compliance pack (deny-closed: 501 without the depth packager, 422 on reject), persists it (one per tenant, replace-on-regenerate) anchored to the ledger head, and self-audits. |
| get | /v1/m/compliance/depth/sector/{id} | compliance:depth:read | Bearer token | compliance module route (requires compliance:depth:read) |
| delete | /v1/m/compliance/depth/sector/{id} | compliance:depth:admin | Bearer token | compliance module route (requires compliance:depth:admin) |
| get | /v1/m/compliance/depth/sector/{id}/export | compliance:depth:read | Bearer token | Exports the maintained sector overlay pack with a LIVE ledger integrity proof. |
| get | /v1/m/compliance/depth/us-law | compliance:depth:read | Bearer token | compliance module route (requires compliance:depth:read) |
| post | /v1/m/compliance/depth/us-law | compliance:depth:admin | Bearer token | Structures operator-supplied jurisdiction context + the live assessment of the 4 US state AI law frameworks into a compliance pack (deny-closed: 501 without a configured depth packager, 422 on input the packager rejects), persists it (one per tenant, replace-on-regenerate) anchored to the ledger head, and self-audits. |
| get | /v1/m/compliance/depth/us-law/{id} | compliance:depth:read | Bearer token | compliance module route (requires compliance:depth:read) |
| delete | /v1/m/compliance/depth/us-law/{id} | compliance:depth:admin | Bearer token | compliance module route (requires compliance:depth:admin) |
| get | /v1/m/compliance/depth/us-law/{id}/export | compliance:depth:read | Bearer token | Exports the maintained US state law pack with a LIVE ledger integrity proof so the export proves the pack was anchored to a tamper-evident ledger. |
| get | /v1/m/compliance/dora | compliance:risk:read | Bearer token | Assembles and returns the DORA export. |
| get | /v1/m/compliance/dora/incidents | compliance:dora:read | Bearer token | compliance module route (requires compliance:dora:read) |
| post | /v1/m/compliance/dora/incidents | compliance:dora:admin | Bearer token | Applies the DORA major-incident criteria to operator-supplied impact data and persists the structured classification + report draft (one per tenant+reference, replace-on-reclassify so the report evolves initial → intermediate → final). |
| get | /v1/m/compliance/dora/incidents/{id} | compliance:dora:read | Bearer token | compliance module route (requires compliance:dora:read) |
| delete | /v1/m/compliance/dora/incidents/{id} | compliance:dora:admin | Bearer token | Removes a stored classification; admin-tier and self-audited. |
| get | /v1/m/compliance/dora/incidents/{id}/report | compliance:dora:read | Bearer token | Exports the structured major-incident report draft with a LIVE ledger integrity proof. |
| get | /v1/m/compliance/dora/register | compliance:dora:read | Bearer token | compliance module route (requires compliance:dora:read) |
| post | /v1/m/compliance/dora/register | compliance:dora:admin | Bearer token | Ingests operator-supplied register data, structures it into the 2024/2956 Register of Information (deny-closed: 501 without a configured packager, 422 on a document the packager rejects), persists the maintained register (one per tenant+entity, replace-on-regenerate) anchored to the ledger head, and self-audits. |
| get | /v1/m/compliance/dora/register/{id} | compliance:dora:read | Bearer token | compliance module route (requires compliance:dora:read) |
| delete | /v1/m/compliance/dora/register/{id} | compliance:dora:admin | Bearer token | Removes a maintained register; admin-tier and self-audited (a register is a governance artifact). |
| get | /v1/m/compliance/dora/register/{id}/export | compliance:dora:read | Bearer token | compliance module route (requires compliance:dora:read) |
| get | /v1/m/compliance/erasure | compliance:erasure:read | Bearer token | compliance module route (requires compliance:erasure:read) |
| post | /v1/m/compliance/erasure | compliance:erasure:admin | Bearer token | Registers a DSR: it mints (or reuses) the subject's key-ring row, tokenizes the subject reference, derives the affected §2 classes and seals the "received" custody event + self-audit in one transaction. |
| get | /v1/m/compliance/erasure/{id} | compliance:erasure:read | Bearer token | compliance module route (requires compliance:erasure:read) |
| get | /v1/m/compliance/erasure/{id}/events | compliance:erasure:read | Bearer token | compliance module route (requires compliance:erasure:read) |
| post | /v1/m/compliance/erasure/{id}/execute | compliance:erasure:admin | Bearer token | Runs the governed erasure for one request. |
| get | /v1/m/compliance/erasure/{id}/receipt | compliance:erasure:read | Bearer token | compliance module route (requires compliance:erasure:read) |
| get | /v1/m/compliance/evidence | compliance:framework:read | Bearer token | compliance module route (requires compliance:framework:read) |
| get | /v1/m/compliance/evidence/{id} | compliance:framework:read | Bearer token | Returns a sealed package + its per-control results. |
| get | /v1/m/compliance/evidence/{id}/export | compliance:framework:read | Bearer token | Exports a sealed package as an auditor-consumable dataset + manifest. |
| get | /v1/m/compliance/frameworks | compliance:framework:read | Bearer token | compliance module route (requires compliance:framework:read) |
| get | /v1/m/compliance/frameworks/{id} | compliance:framework:read | Bearer token | compliance module route (requires compliance:framework:read) |
| post | /v1/m/compliance/frameworks/{id}/evidence | compliance:evidence:write | Bearer token | Seals an immutable evidence package for a framework: it assesses the framework against the tenant's live evidence, records the ledger head + the live hash-chain verify result (the integrity proof), persists the package and its per-control results (append-only), and self-audits the seal — all in one transaction. |
| get | /v1/m/compliance/frameworks/{id}/gaps | compliance:framework:read | Bearer token | compliance module route (requires compliance:framework:read) |
| get | /v1/m/compliance/frameworks/{id}/status | compliance:framework:read | Bearer token | compliance module route (requires compliance:framework:read) |
| get | /v1/m/compliance/hipaa/gap-report | compliance:framework:read | Bearer token | compliance module route (requires compliance:framework:read) |
| get | /v1/m/compliance/holds | compliance:hold:read | Bearer token | compliance module route (requires compliance:hold:read) |
| post | /v1/m/compliance/holds | compliance:hold:admin | Bearer token | Sets an ACTIVE hold immediately — no approval gate, because preservation is the safe direction and the duty to preserve admits no waiting (§4). |
| get | /v1/m/compliance/holds/check | compliance:hold:read | Bearer token | compliance module route (requires compliance:hold:read) |
| get | /v1/m/compliance/holds/{id} | compliance:hold:read | Bearer token | compliance module route (requires compliance:hold:read) |
| get | /v1/m/compliance/holds/{id}/events | compliance:hold:read | Bearer token | compliance module route (requires compliance:hold:read) |
| post | /v1/m/compliance/holds/{id}/release | compliance:hold:admin | Bearer token | compliance module route (requires compliance:hold:admin) |
| get | /v1/m/compliance/nis2/incidents | compliance:nis2:read | Bearer token | compliance module route (requires compliance:nis2:read) |
| post | /v1/m/compliance/nis2/incidents/classify | compliance:nis2:admin | Bearer token | compliance module route (requires compliance:nis2:admin) |
| get | /v1/m/compliance/nis2/incidents/{id} | compliance:nis2:read | Bearer token | compliance module route (requires compliance:nis2:read) |
| put | /v1/m/compliance/nis2/incidents/{id} | compliance:nis2:admin | Bearer token | compliance module route (requires compliance:nis2:admin) |
| delete | /v1/m/compliance/nis2/incidents/{id} | compliance:nis2:admin | Bearer token | compliance module route (requires compliance:nis2:admin) |
| get | /v1/m/compliance/nis2/incidents/{id}/export | compliance:nis2:read | Bearer token | compliance module route (requires compliance:nis2:read) |
| get | /v1/m/compliance/oscal/profiles | compliance:oscal:read | Bearer token | compliance module route (requires compliance:oscal:read) |
| post | /v1/m/compliance/oscal/profiles | compliance:oscal:admin | Bearer token | Ingests an operator-supplied OSCAL profile/catalog/SSP and registers the resolved control selection for a framework (one active selection per tenant+framework; re-registering replaces it). |
| get | /v1/m/compliance/oscal/profiles/{id} | compliance:oscal:read | Bearer token | compliance module route (requires compliance:oscal:read) |
| delete | /v1/m/compliance/oscal/profiles/{id} | compliance:oscal:admin | Bearer token | Unregisters a profile — the export reverts to include-all for that framework. |
| get | /v1/m/compliance/residency | compliance:residency:read | Bearer token | compliance module route (requires compliance:residency:read) |
| post | /v1/m/compliance/residency | compliance:residency:write | Bearer token | Records (or updates) a per-region residency attestation. |
| post | /v1/m/compliance/residency/scan | compliance:residency:write | Bearer token | Scans EXISTING egress signals against the self-hosted attestations and, where data left a self-hosted perimeter, records a violation, emits a core Finding + a bus signal, and updates the attestation. |
| get | /v1/m/compliance/retention/classes | compliance:retention:read | Bearer token | Returns the fixed §2 registry with the advisory recommendations and the §7 provider-floor annotation. |
| get | /v1/m/compliance/retention/policies | compliance:retention:read | Bearer token | compliance module route (requires compliance:retention:read) |
| put | /v1/m/compliance/retention/policies/{class} | compliance:retention:admin | Bearer token | Upserts a per-class schedule. |
| delete | /v1/m/compliance/retention/policies/{class} | compliance:retention:admin | Bearer token | Removes a schedule. |
| get | /v1/m/compliance/retention/runs | compliance:retention:read | Bearer token | compliance module route (requires compliance:retention:read) |
| post | /v1/m/compliance/retention/sweep | compliance:retention:admin | Bearer token | Runs the tenant's sweep NOW (the same code the engine loop runs), attributed to the calling admin, and returns the summary. |
| get | /v1/m/compliance/risk | compliance:risk:read | Bearer token | compliance module route (requires compliance:risk:read) |
| post | /v1/m/compliance/risk/classify | compliance:risk:write | Bearer token | Computes (or recomputes) a suggested risk tier for a subject from observed signals and persists it as a governed, audited classification. |
| post | /v1/m/compliance/risk/{id}/review | compliance:risk:admin | Bearer token | compliance module route (requires compliance:risk:admin) |
| get | /v1/m/compliance/summary | compliance:framework:read | Bearer token | Returns a cross-framework posture summary for the tenant (the org/ tenant roll-up). |