Compliance Catalog

Policies API v1 endpoints for the compliance standards and controls catalog.

Read the compliance standards and controls catalog, including control results and summaries.

All paths are relative to /policies/api/v1. See Policies API v1 for authentication and conventions.

Endpoints

Operation	Method	Path
List compliance controls	`GET`	`/compliance-controls`
List compliance standards	`GET`	`/compliance-standards`
Count compliance controls	`GET`	`/compliance-controls/count`
Get compliance controls summary	`GET`	`/compliance-controls/summary`
Get a compliance control	`GET`	`/compliance-controls/{id}`
List built-in compliance standards	`GET`	`/compliance-standards/built-in`
Count compliance standards	`GET`	`/compliance-standards/count`
Get compliance standards summary	`GET`	`/compliance-standards/summary`
Get a compliance standard	`GET`	`/compliance-standards/{id}`
List compliance controls by admin state	`GET`	`/compliance-controls/by-admin-state/{adminState}`
List compliance controls by cloud provider	`GET`	`/compliance-controls/by-cloud-provider/{cloudProvider}`
List compliance controls by control ID	`GET`	`/compliance-controls/by-control-id/{controlId}`
List compliance controls by status	`GET`	`/compliance-controls/by-status/{status}`
List compliance controls by subject area	`GET`	`/compliance-controls/by-subject-area/{subjectArea}`
Get results for a compliance control	`GET`	`/compliance-controls/{id}/results`
List compliance standards by category	`GET`	`/compliance-standards/by-category/{category}`
List compliance standards by type	`GET`	`/compliance-standards/by-type/{type}`
Refresh compliance results for a standard	`POST`	`/compliance-standards/{id}/refresh`

Reference

List compliance controls

GET /policies/api/v1/compliance-controls

Returns all compliance controls for the tenant, paginated in memory.

Roles: admin

Query parameters

Name	Type	Required	Default	Description
`limit`	`integer`	No	`50`	Maximum number of items to return
`offset`	`integer`	No	`0`	Number of items to skip

Response 200 (application/json)

Paginated: {items: ComplianceControlDto[], total, limit, offset}

Field	Type	Description
`id`	`string`	Control ID (UUID)
`name`	`string`	Control name
`controlId`	`string`	Standard control identifier, e.g. 1.1.1
`subControlId`	`string`	—
`description`	`string`	—
`subjectArea`	`string`	—
`cloudProviders`	`string[]`	—
`adminState`	`string`	enabled \| disabled
`status`	`string`	Control state
`statusBySourceType`	`object`	Status per source type
`policies`	`string[]`	Mapped policy names
`properties`	`object`	—
`isManual`	`boolean`	Requires manual attestation
`manualComplianceDetails`	`object`	—
`validSourceTypes`	`string[]`	—
`fullControlId`	`string`	controlId plus subControlId (computed)
`displayName`	`string`	computed
`policyCount`	`integer`	computed

Errors

500 — Retrieval failed
401 — Not authenticated
403 — Caller’s role is not permitted for this operation

List compliance standards

GET /policies/api/v1/compliance-standards

Returns all compliance standards for the tenant, paginated in memory. Controls are not included.

Roles: admin

Query parameters

Name	Type	Required	Default	Description
`limit`	`integer`	No	`50`	Maximum number of items to return
`offset`	`integer`	No	`0`	Number of items to skip

Response 200 (application/json)

Paginated: {items: ComplianceStandardDto[], total, limit, offset}

Field	Type	Description
`id`	`string`	Standard ID (UUID)
`name`	`string`	—
`version`	`string`	—
`description`	`string`	—
`type`	`string`	nirmataManaged (built-in) \| userManaged (custom)
`category`	`string`	Standard category, e.g. cis
`adminState`	`string`	enabled \| disabled
`score`	`integer`	Compliance score
`lastUpdateTime`	`integer (epoch ms)`	—
`k8sMinVersion`	`string`	Minimum supported Kubernetes version
`k8sMaxVersion`	`string`	Maximum supported Kubernetes version
`grade`	`string`	A-F derived from score, N/A if no score (computed)
`displayName`	`string`	computed
`controlCount`	`integer`	computed; controls are not populated by this API

Errors

500 — Retrieval failed
401 — Not authenticated
403 — Caller’s role is not permitted for this operation

Count compliance controls

GET /policies/api/v1/compliance-controls/count

Returns the number of compliance controls for the tenant.

Roles: admin

Response 200 (application/json)

{count}

Field	Type	Description
`count`	`integer`	—

Get compliance controls summary

GET /policies/api/v1/compliance-controls/summary

Returns counts of total, active/inactive, and enabled/disabled compliance controls.

Roles: admin

Response 200 (application/json)

{total, active, inactive, enabled, disabled}

Field	Type	Description
`total`	`integer`	—
`active`	`integer`	—
`inactive`	`integer`	—
`enabled`	`integer`	—
`disabled`	`integer`	—

Get a compliance control

GET /policies/api/v1/compliance-controls/{id}

Returns a single compliance control by ID.

Roles: admin

Path parameters

Name	Type	Description
`id`	`string`	Control UUID

Response 200 (application/json)

ComplianceControlDto

Field	Type	Description
`id`	`string`	Control ID (UUID)
`name`	`string`	Control name
`controlId`	`string`	Standard control identifier, e.g. 1.1.1
`subControlId`	`string`	—
`description`	`string`	—
`subjectArea`	`string`	—
`cloudProviders`	`string[]`	—
`adminState`	`string`	enabled \| disabled
`status`	`string`	Control state
`statusBySourceType`	`object`	Status per source type
`policies`	`string[]`	Mapped policy names
`properties`	`object`	—
`isManual`	`boolean`	Requires manual attestation
`manualComplianceDetails`	`object`	—
`validSourceTypes`	`string[]`	—
`fullControlId`	`string`	controlId plus subControlId (computed)
`displayName`	`string`	computed
`policyCount`	`integer`	computed

Errors

404 — Control not found
401 — Not authenticated
403 — Caller’s role is not permitted for this operation

List built-in compliance standards

GET /policies/api/v1/compliance-standards/built-in

Returns Nirmata-managed (built-in) compliance standards for the tenant. Not paginated.

Roles: Any role with permission for this resource. See Roles.

Response 200 (application/json)

ComplianceStandardDto[] (plain array)

Field	Type	Description
`id`	`string`	Standard ID (UUID)
`name`	`string`	—
`version`	`string`	—
`description`	`string`	—
`type`	`string`	nirmataManaged (built-in) \| userManaged (custom)
`category`	`string`	Standard category, e.g. cis
`adminState`	`string`	enabled \| disabled
`score`	`integer`	Compliance score
`lastUpdateTime`	`integer (epoch ms)`	—
`k8sMinVersion`	`string`	Minimum supported Kubernetes version
`k8sMaxVersion`	`string`	Maximum supported Kubernetes version
`grade`	`string`	A-F derived from score, N/A if no score (computed)
`displayName`	`string`	computed
`controlCount`	`integer`	computed; controls are not populated by this API

Errors

500 — Query failed
401 — Not authenticated
403 — Caller’s role is not permitted for this operation

Count compliance standards

GET /policies/api/v1/compliance-standards/count

Returns the number of compliance standards for the tenant.

Roles: admin

Response 200 (application/json)

{count}

Field	Type	Description
`count`	`integer`	—

Get compliance standards summary

GET /policies/api/v1/compliance-standards/summary

Returns counts of total, built-in, custom, active (adminState enabled), and inactive compliance standards.

Roles: Any role with permission for this resource. See Roles.

Response 200 (application/json)

{total, builtIn, custom, active, inactive}

Field	Type	Description
`total`	`integer`	—
`builtIn`	`integer`	—
`custom`	`integer`	—
`active`	`integer`	—
`inactive`	`integer`	—

Get a compliance standard

GET /policies/api/v1/compliance-standards/{id}

Returns a single compliance standard by ID.

Roles: admin

Path parameters

Name	Type	Description
`id`	`string`	Standard UUID

Response 200 (application/json)

ComplianceStandardDto

Field	Type	Description
`id`	`string`	Standard ID (UUID)
`name`	`string`	—
`version`	`string`	—
`description`	`string`	—
`type`	`string`	nirmataManaged (built-in) \| userManaged (custom)
`category`	`string`	Standard category, e.g. cis
`adminState`	`string`	enabled \| disabled
`score`	`integer`	Compliance score
`lastUpdateTime`	`integer (epoch ms)`	—
`k8sMinVersion`	`string`	Minimum supported Kubernetes version
`k8sMaxVersion`	`string`	Maximum supported Kubernetes version
`grade`	`string`	A-F derived from score, N/A if no score (computed)
`displayName`	`string`	computed
`controlCount`	`integer`	computed; controls are not populated by this API

Errors

404 — Standard not found
401 — Not authenticated
403 — Caller’s role is not permitted for this operation

List compliance controls by admin state

GET /policies/api/v1/compliance-controls/by-admin-state/{adminState}

Returns all compliance controls whose admin state matches the given value. Not paginated.

Roles: admin

Path parameters

Name	Type	Description
`adminState`	`string`	enabled \| disabled

Response 200 (application/json)

ComplianceControlDto[] (plain array)

Field	Type	Description
`id`	`string`	Control ID (UUID)
`name`	`string`	Control name
`controlId`	`string`	Standard control identifier, e.g. 1.1.1
`subControlId`	`string`	—
`description`	`string`	—
`subjectArea`	`string`	—
`cloudProviders`	`string[]`	—
`adminState`	`string`	enabled \| disabled
`status`	`string`	Control state
`statusBySourceType`	`object`	Status per source type
`policies`	`string[]`	Mapped policy names
`properties`	`object`	—
`isManual`	`boolean`	Requires manual attestation
`manualComplianceDetails`	`object`	—
`validSourceTypes`	`string[]`	—
`fullControlId`	`string`	controlId plus subControlId (computed)
`displayName`	`string`	computed
`policyCount`	`integer`	computed

Errors

500 — Query failed
401 — Not authenticated
403 — Caller’s role is not permitted for this operation

List compliance controls by cloud provider

GET /policies/api/v1/compliance-controls/by-cloud-provider/{cloudProvider}

Returns controls whose cloudProviders list contains the given provider (case-insensitive) or ALL. Not paginated.

Roles: admin

Path parameters

Name	Type	Description
`cloudProvider`	`string`	Cloud provider name

Response 200 (application/json)

ComplianceControlDto[] (plain array)

Field	Type	Description
`id`	`string`	Control ID (UUID)
`name`	`string`	Control name
`controlId`	`string`	Standard control identifier, e.g. 1.1.1
`subControlId`	`string`	—
`description`	`string`	—
`subjectArea`	`string`	—
`cloudProviders`	`string[]`	—
`adminState`	`string`	enabled \| disabled
`status`	`string`	Control state
`statusBySourceType`	`object`	Status per source type
`policies`	`string[]`	Mapped policy names
`properties`	`object`	—
`isManual`	`boolean`	Requires manual attestation
`manualComplianceDetails`	`object`	—
`validSourceTypes`	`string[]`	—
`fullControlId`	`string`	controlId plus subControlId (computed)
`displayName`	`string`	computed
`policyCount`	`integer`	computed

Errors

500 — Query failed
401 — Not authenticated
403 — Caller’s role is not permitted for this operation

List compliance controls by control ID

GET /policies/api/v1/compliance-controls/by-control-id/{controlId}

Returns all compliance controls whose control ID matches the given value. Not paginated.

Roles: admin

Path parameters

Name	Type	Description
`controlId`	`string`	Standard control identifier (exact match)

Response 200 (application/json)

ComplianceControlDto[] (plain array)

Field	Type	Description
`id`	`string`	Control ID (UUID)
`name`	`string`	Control name
`controlId`	`string`	Standard control identifier, e.g. 1.1.1
`subControlId`	`string`	—
`description`	`string`	—
`subjectArea`	`string`	—
`cloudProviders`	`string[]`	—
`adminState`	`string`	enabled \| disabled
`status`	`string`	Control state
`statusBySourceType`	`object`	Status per source type
`policies`	`string[]`	Mapped policy names
`properties`	`object`	—
`isManual`	`boolean`	Requires manual attestation
`manualComplianceDetails`	`object`	—
`validSourceTypes`	`string[]`	—
`fullControlId`	`string`	controlId plus subControlId (computed)
`displayName`	`string`	computed
`policyCount`	`integer`	computed

Errors

500 — Query failed
401 — Not authenticated
403 — Caller’s role is not permitted for this operation

List compliance controls by status

GET /policies/api/v1/compliance-controls/by-status/{status}

Returns all compliance controls whose status matches the given value. Not paginated.

Roles: admin

Path parameters

Name	Type	Description
`status`	`string`	Control status (exact match)

Response 200 (application/json)

ComplianceControlDto[] (plain array)

Field	Type	Description
`id`	`string`	Control ID (UUID)
`name`	`string`	Control name
`controlId`	`string`	Standard control identifier, e.g. 1.1.1
`subControlId`	`string`	—
`description`	`string`	—
`subjectArea`	`string`	—
`cloudProviders`	`string[]`	—
`adminState`	`string`	enabled \| disabled
`status`	`string`	Control state
`statusBySourceType`	`object`	Status per source type
`policies`	`string[]`	Mapped policy names
`properties`	`object`	—
`isManual`	`boolean`	Requires manual attestation
`manualComplianceDetails`	`object`	—
`validSourceTypes`	`string[]`	—
`fullControlId`	`string`	controlId plus subControlId (computed)
`displayName`	`string`	computed
`policyCount`	`integer`	computed

Errors

500 — Query failed
401 — Not authenticated
403 — Caller’s role is not permitted for this operation

List compliance controls by subject area

GET /policies/api/v1/compliance-controls/by-subject-area/{subjectArea}

Returns all compliance controls whose subject area matches the given value. Not paginated.

Roles: admin

Path parameters

Name	Type	Description
`subjectArea`	`string`	Subject area (exact match)

Response 200 (application/json)

ComplianceControlDto[] (plain array)

Field	Type	Description
`id`	`string`	Control ID (UUID)
`name`	`string`	Control name
`controlId`	`string`	Standard control identifier, e.g. 1.1.1
`subControlId`	`string`	—
`description`	`string`	—
`subjectArea`	`string`	—
`cloudProviders`	`string[]`	—
`adminState`	`string`	enabled \| disabled
`status`	`string`	Control state
`statusBySourceType`	`object`	Status per source type
`policies`	`string[]`	Mapped policy names
`properties`	`object`	—
`isManual`	`boolean`	Requires manual attestation
`manualComplianceDetails`	`object`	—
`validSourceTypes`	`string[]`	—
`fullControlId`	`string`	controlId plus subControlId (computed)
`displayName`	`string`	computed
`policyCount`	`integer`	computed

Errors

500 — Query failed
401 — Not authenticated
403 — Caller’s role is not permitted for this operation

Get results for a compliance control

GET /policies/api/v1/compliance-controls/{id}/results

Returns compliance results for this control collected from all cluster, repository, and namespace compliance reports in the tenant.

Roles: admin

Path parameters

Name	Type	Description
`id`	`string`	Control UUID

Response 200 (application/json)

{controlId, controlName, results: ComplianceResult[], totalResults, message}

Field	Type	Description
`controlId`	`string`	—
`controlName`	`string`	—
`totalResults`	`integer`	—
`results[].complianceControlName`	`string`	—
`results[].complianceControlId`	`string`	—
`results[].policy`	`string`	—
`results[].rule`	`string`	—
`results[].status`	`string`	pass \| failed \| warn \| notapplicable \| notavailable (lowercased)
`results[].kubeBenchIndex`	`string`	—
`results[].nistToCisMappings`	`object`	—

Errors

404 — Control not found
500 — Retrieval failed
401 — Not authenticated
403 — Caller’s role is not permitted for this operation

List compliance standards by category

GET /policies/api/v1/compliance-standards/by-category/{category}

Returns standards in the given category. Not paginated.

Roles: Any role with permission for this resource. See Roles.

Path parameters

Name	Type	Description
`category`	`string`	Category value (exact match, e.g. cis)

Response 200 (application/json)

ComplianceStandardDto[] (plain array)

Field	Type	Description
`id`	`string`	Standard ID (UUID)
`name`	`string`	—
`version`	`string`	—
`description`	`string`	—
`type`	`string`	nirmataManaged (built-in) \| userManaged (custom)
`category`	`string`	Standard category, e.g. cis
`adminState`	`string`	enabled \| disabled
`score`	`integer`	Compliance score
`lastUpdateTime`	`integer (epoch ms)`	—
`k8sMinVersion`	`string`	Minimum supported Kubernetes version
`k8sMaxVersion`	`string`	Maximum supported Kubernetes version
`grade`	`string`	A-F derived from score, N/A if no score (computed)
`displayName`	`string`	computed
`controlCount`	`integer`	computed; controls are not populated by this API

Errors

500 — Query failed
401 — Not authenticated
403 — Caller’s role is not permitted for this operation

List compliance standards by type

GET /policies/api/v1/compliance-standards/by-type/{type}

Returns standards of the given type. Not paginated.

Roles: Any role with permission for this resource. See Roles.

Path parameters

Name	Type	Description
`type`	`string`	nirmataManaged \| userManaged

Response 200 (application/json)

ComplianceStandardDto[] (plain array)

Field	Type	Description
`id`	`string`	Standard ID (UUID)
`name`	`string`	—
`version`	`string`	—
`description`	`string`	—
`type`	`string`	nirmataManaged (built-in) \| userManaged (custom)
`category`	`string`	Standard category, e.g. cis
`adminState`	`string`	enabled \| disabled
`score`	`integer`	Compliance score
`lastUpdateTime`	`integer (epoch ms)`	—
`k8sMinVersion`	`string`	Minimum supported Kubernetes version
`k8sMaxVersion`	`string`	Maximum supported Kubernetes version
`grade`	`string`	A-F derived from score, N/A if no score (computed)
`displayName`	`string`	computed
`controlCount`	`integer`	computed; controls are not populated by this API

Errors

500 — Query failed
401 — Not authenticated
403 — Caller’s role is not permitted for this operation

Refresh compliance results for a standard

POST /policies/api/v1/compliance-standards/{id}/refresh

Requests an on-demand, asynchronous recomputation of the standard’s compliance results across its applied clusters and repositories instead of waiting for the next background cycle. Repeated requests are debounced.

Roles: admin, platform, security

Path parameters

Name	Type	Description
`id`	`string`	Standard UUID

Response 202 (application/json)

{id, queued, lastEvaluatedAt, message?}

Field	Type	Description
`id`	`string`	Standard ID
`queued`	`boolean`	true if a refresh was queued; false if there are no applied sources
`lastEvaluatedAt`	`integer (epoch ms)`	Last evaluation time
`message`	`string`	Present when nothing was queued

Errors

404 — Standard not found (code COMPLIANCE_STANDARD_NOT_FOUND)
429 — Refresh requested recently (REFRESH_DEBOUNCED) or already running (REFRESH_IN_PROGRESS)
503 — Refresh queue full (REFRESH_QUEUE_FULL)
500 — REFRESH_FAILED
401 — Not authenticated
403 — Caller’s role is not permitted for this operation

Example

Errors use {status, message, code}.