---
title: "Compliance Catalog"
description: "Policies API v1 endpoints for the compliance standards and controls catalog."
diataxis: reference
applies_to:
  product: "nirmata-control-hub"
audience: ["platform-engineer","developer"]
last_updated: 2026-10-06
url: https://docs.nirmata.io/docs/reference/rest-api/policies_api_v1/compliance_catalog/
---


<!-- Generated by scripts/gen-policies-api-v1/gen.py. Edit inventory.json, not this file. -->

Read the compliance standards and controls catalog, including control results and summaries.

All paths are relative to `/policies/api/v1`. See [Policies API v1](../) for authentication and conventions.

## Endpoints

| Operation | Method | Path |
|---|---|---|
| [List compliance controls](#list-compliance-controls) | `GET` | `/compliance-controls` |
| [List compliance standards](#list-compliance-standards) | `GET` | `/compliance-standards` |
| [Count compliance controls](#count-compliance-controls) | `GET` | `/compliance-controls/count` |
| [Get compliance controls summary](#get-compliance-controls-summary) | `GET` | `/compliance-controls/summary` |
| [Get a compliance control](#get-a-compliance-control) | `GET` | `/compliance-controls/{id}` |
| [List built-in compliance standards](#list-built-in-compliance-standards) | `GET` | `/compliance-standards/built-in` |
| [Count compliance standards](#count-compliance-standards) | `GET` | `/compliance-standards/count` |
| [Get compliance standards summary](#get-compliance-standards-summary) | `GET` | `/compliance-standards/summary` |
| [Get a compliance standard](#get-a-compliance-standard) | `GET` | `/compliance-standards/{id}` |
| [List compliance controls by admin state](#list-compliance-controls-by-admin-state) | `GET` | `/compliance-controls/by-admin-state/{adminState}` |
| [List compliance controls by cloud provider](#list-compliance-controls-by-cloud-provider) | `GET` | `/compliance-controls/by-cloud-provider/{cloudProvider}` |
| [List compliance controls by control ID](#list-compliance-controls-by-control-id) | `GET` | `/compliance-controls/by-control-id/{controlId}` |
| [List compliance controls by status](#list-compliance-controls-by-status) | `GET` | `/compliance-controls/by-status/{status}` |
| [List compliance controls by subject area](#list-compliance-controls-by-subject-area) | `GET` | `/compliance-controls/by-subject-area/{subjectArea}` |
| [Get results for a compliance control](#get-results-for-a-compliance-control) | `GET` | `/compliance-controls/{id}/results` |
| [List compliance standards by category](#list-compliance-standards-by-category) | `GET` | `/compliance-standards/by-category/{category}` |
| [List compliance standards by type](#list-compliance-standards-by-type) | `GET` | `/compliance-standards/by-type/{type}` |
| [Refresh compliance results for a standard](#refresh-compliance-results-for-a-standard) | `POST` | `/compliance-standards/{id}/refresh` |

## Reference

### List compliance controls

```http
GET /policies/api/v1/compliance-controls
```

Returns all compliance controls for the tenant, paginated in memory.

**Roles:** `admin`

**Query parameters**

| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| `limit` | `integer` | No | `50` | Maximum number of items to return |
| `offset` | `integer` | No | `0` | Number of items to skip |

**Response** `200` (`application/json`)

`Paginated: {items: ComplianceControlDto[], total, limit, offset}`

| Field | Type | Description |
|---|---|---|
| `id` | `string` | Control ID (UUID) |
| `name` | `string` | Control name |
| `controlId` | `string` | Standard control identifier, e.g. 1.1.1 |
| `subControlId` | `string` | — |
| `description` | `string` | — |
| `subjectArea` | `string` | — |
| `cloudProviders` | `string[]` | — |
| `adminState` | `string` | enabled \| disabled |
| `status` | `string` | Control state |
| `statusBySourceType` | `object` | Status per source type |
| `policies` | `string[]` | Mapped policy names |
| `properties` | `object` | — |
| `isManual` | `boolean` | Requires manual attestation |
| `manualComplianceDetails` | `object` | — |
| `validSourceTypes` | `string[]` | — |
| `fullControlId` | `string` | controlId plus subControlId (computed) |
| `displayName` | `string` | computed |
| `policyCount` | `integer` | computed |

**Errors**

- `500` — Retrieval failed
- `401` — Not authenticated
- `403` — Caller's role is not permitted for this operation

### List compliance standards

```http
GET /policies/api/v1/compliance-standards
```

Returns all compliance standards for the tenant, paginated in memory. Controls are not included.

**Roles:** `admin`

**Query parameters**

| Name | Type | Required | Default | Description |
|---|---|---|---|---|
| `limit` | `integer` | No | `50` | Maximum number of items to return |
| `offset` | `integer` | No | `0` | Number of items to skip |

**Response** `200` (`application/json`)

`Paginated: {items: ComplianceStandardDto[], total, limit, offset}`

| Field | Type | Description |
|---|---|---|
| `id` | `string` | Standard ID (UUID) |
| `name` | `string` | — |
| `version` | `string` | — |
| `description` | `string` | — |
| `type` | `string` | nirmataManaged (built-in) \| userManaged (custom) |
| `category` | `string` | Standard category, e.g. cis |
| `adminState` | `string` | enabled \| disabled |
| `score` | `integer` | Compliance score |
| `lastUpdateTime` | `integer (epoch ms)` | — |
| `k8sMinVersion` | `string` | Minimum supported Kubernetes version |
| `k8sMaxVersion` | `string` | Maximum supported Kubernetes version |
| `grade` | `string` | A-F derived from score, N/A if no score (computed) |
| `displayName` | `string` | computed |
| `controlCount` | `integer` | computed; controls are not populated by this API |

**Errors**

- `500` — Retrieval failed
- `401` — Not authenticated
- `403` — Caller's role is not permitted for this operation

### Count compliance controls

```http
GET /policies/api/v1/compliance-controls/count
```

Returns the number of compliance controls for the tenant.

**Roles:** `admin`

**Response** `200` (`application/json`)

`{count}`

| Field | Type | Description |
|---|---|---|
| `count` | `integer` | — |

### Get compliance controls summary

```http
GET /policies/api/v1/compliance-controls/summary
```

Returns counts of total, active/inactive, and enabled/disabled compliance controls.

**Roles:** `admin`

**Response** `200` (`application/json`)

`{total, active, inactive, enabled, disabled}`

| Field | Type | Description |
|---|---|---|
| `total` | `integer` | — |
| `active` | `integer` | — |
| `inactive` | `integer` | — |
| `enabled` | `integer` | — |
| `disabled` | `integer` | — |

### Get a compliance control

```http
GET /policies/api/v1/compliance-controls/{id}
```

Returns a single compliance control by ID.

**Roles:** `admin`

**Path parameters**

| Name | Type | Description |
|---|---|---|
| `id` | `string` | Control UUID |

**Response** `200` (`application/json`)

ComplianceControlDto

| Field | Type | Description |
|---|---|---|
| `id` | `string` | Control ID (UUID) |
| `name` | `string` | Control name |
| `controlId` | `string` | Standard control identifier, e.g. 1.1.1 |
| `subControlId` | `string` | — |
| `description` | `string` | — |
| `subjectArea` | `string` | — |
| `cloudProviders` | `string[]` | — |
| `adminState` | `string` | enabled \| disabled |
| `status` | `string` | Control state |
| `statusBySourceType` | `object` | Status per source type |
| `policies` | `string[]` | Mapped policy names |
| `properties` | `object` | — |
| `isManual` | `boolean` | Requires manual attestation |
| `manualComplianceDetails` | `object` | — |
| `validSourceTypes` | `string[]` | — |
| `fullControlId` | `string` | controlId plus subControlId (computed) |
| `displayName` | `string` | computed |
| `policyCount` | `integer` | computed |

**Errors**

- `404` — Control not found
- `401` — Not authenticated
- `403` — Caller's role is not permitted for this operation

### List built-in compliance standards

```http
GET /policies/api/v1/compliance-standards/built-in
```

Returns Nirmata-managed (built-in) compliance standards for the tenant. Not paginated.

**Roles:** Any role with permission for this resource. See [Roles](../#roles).

**Response** `200` (`application/json`)

`ComplianceStandardDto[] (plain array)`

| Field | Type | Description |
|---|---|---|
| `id` | `string` | Standard ID (UUID) |
| `name` | `string` | — |
| `version` | `string` | — |
| `description` | `string` | — |
| `type` | `string` | nirmataManaged (built-in) \| userManaged (custom) |
| `category` | `string` | Standard category, e.g. cis |
| `adminState` | `string` | enabled \| disabled |
| `score` | `integer` | Compliance score |
| `lastUpdateTime` | `integer (epoch ms)` | — |
| `k8sMinVersion` | `string` | Minimum supported Kubernetes version |
| `k8sMaxVersion` | `string` | Maximum supported Kubernetes version |
| `grade` | `string` | A-F derived from score, N/A if no score (computed) |
| `displayName` | `string` | computed |
| `controlCount` | `integer` | computed; controls are not populated by this API |

**Errors**

- `500` — Query failed
- `401` — Not authenticated
- `403` — Caller's role is not permitted for this operation

### Count compliance standards

```http
GET /policies/api/v1/compliance-standards/count
```

Returns the number of compliance standards for the tenant.

**Roles:** `admin`

**Response** `200` (`application/json`)

`{count}`

| Field | Type | Description |
|---|---|---|
| `count` | `integer` | — |

### Get compliance standards summary

```http
GET /policies/api/v1/compliance-standards/summary
```

Returns counts of total, built-in, custom, active (adminState enabled), and inactive compliance standards.

**Roles:** Any role with permission for this resource. See [Roles](../#roles).

**Response** `200` (`application/json`)

`{total, builtIn, custom, active, inactive}`

| Field | Type | Description |
|---|---|---|
| `total` | `integer` | — |
| `builtIn` | `integer` | — |
| `custom` | `integer` | — |
| `active` | `integer` | — |
| `inactive` | `integer` | — |

### Get a compliance standard

```http
GET /policies/api/v1/compliance-standards/{id}
```

Returns a single compliance standard by ID.

**Roles:** `admin`

**Path parameters**

| Name | Type | Description |
|---|---|---|
| `id` | `string` | Standard UUID |

**Response** `200` (`application/json`)

ComplianceStandardDto

| Field | Type | Description |
|---|---|---|
| `id` | `string` | Standard ID (UUID) |
| `name` | `string` | — |
| `version` | `string` | — |
| `description` | `string` | — |
| `type` | `string` | nirmataManaged (built-in) \| userManaged (custom) |
| `category` | `string` | Standard category, e.g. cis |
| `adminState` | `string` | enabled \| disabled |
| `score` | `integer` | Compliance score |
| `lastUpdateTime` | `integer (epoch ms)` | — |
| `k8sMinVersion` | `string` | Minimum supported Kubernetes version |
| `k8sMaxVersion` | `string` | Maximum supported Kubernetes version |
| `grade` | `string` | A-F derived from score, N/A if no score (computed) |
| `displayName` | `string` | computed |
| `controlCount` | `integer` | computed; controls are not populated by this API |

**Errors**

- `404` — Standard not found
- `401` — Not authenticated
- `403` — Caller's role is not permitted for this operation

### List compliance controls by admin state

```http
GET /policies/api/v1/compliance-controls/by-admin-state/{adminState}
```

Returns all compliance controls whose admin state matches the given value. Not paginated.

**Roles:** `admin`

**Path parameters**

| Name | Type | Description |
|---|---|---|
| `adminState` | `string` | enabled \| disabled |

**Response** `200` (`application/json`)

`ComplianceControlDto[] (plain array)`

| Field | Type | Description |
|---|---|---|
| `id` | `string` | Control ID (UUID) |
| `name` | `string` | Control name |
| `controlId` | `string` | Standard control identifier, e.g. 1.1.1 |
| `subControlId` | `string` | — |
| `description` | `string` | — |
| `subjectArea` | `string` | — |
| `cloudProviders` | `string[]` | — |
| `adminState` | `string` | enabled \| disabled |
| `status` | `string` | Control state |
| `statusBySourceType` | `object` | Status per source type |
| `policies` | `string[]` | Mapped policy names |
| `properties` | `object` | — |
| `isManual` | `boolean` | Requires manual attestation |
| `manualComplianceDetails` | `object` | — |
| `validSourceTypes` | `string[]` | — |
| `fullControlId` | `string` | controlId plus subControlId (computed) |
| `displayName` | `string` | computed |
| `policyCount` | `integer` | computed |

**Errors**

- `500` — Query failed
- `401` — Not authenticated
- `403` — Caller's role is not permitted for this operation

### List compliance controls by cloud provider

```http
GET /policies/api/v1/compliance-controls/by-cloud-provider/{cloudProvider}
```

Returns controls whose cloudProviders list contains the given provider (case-insensitive) or ALL. Not paginated.

**Roles:** `admin`

**Path parameters**

| Name | Type | Description |
|---|---|---|
| `cloudProvider` | `string` | Cloud provider name |

**Response** `200` (`application/json`)

`ComplianceControlDto[] (plain array)`

| Field | Type | Description |
|---|---|---|
| `id` | `string` | Control ID (UUID) |
| `name` | `string` | Control name |
| `controlId` | `string` | Standard control identifier, e.g. 1.1.1 |
| `subControlId` | `string` | — |
| `description` | `string` | — |
| `subjectArea` | `string` | — |
| `cloudProviders` | `string[]` | — |
| `adminState` | `string` | enabled \| disabled |
| `status` | `string` | Control state |
| `statusBySourceType` | `object` | Status per source type |
| `policies` | `string[]` | Mapped policy names |
| `properties` | `object` | — |
| `isManual` | `boolean` | Requires manual attestation |
| `manualComplianceDetails` | `object` | — |
| `validSourceTypes` | `string[]` | — |
| `fullControlId` | `string` | controlId plus subControlId (computed) |
| `displayName` | `string` | computed |
| `policyCount` | `integer` | computed |

**Errors**

- `500` — Query failed
- `401` — Not authenticated
- `403` — Caller's role is not permitted for this operation

### List compliance controls by control ID

```http
GET /policies/api/v1/compliance-controls/by-control-id/{controlId}
```

Returns all compliance controls whose control ID matches the given value. Not paginated.

**Roles:** `admin`

**Path parameters**

| Name | Type | Description |
|---|---|---|
| `controlId` | `string` | Standard control identifier (exact match) |

**Response** `200` (`application/json`)

`ComplianceControlDto[] (plain array)`

| Field | Type | Description |
|---|---|---|
| `id` | `string` | Control ID (UUID) |
| `name` | `string` | Control name |
| `controlId` | `string` | Standard control identifier, e.g. 1.1.1 |
| `subControlId` | `string` | — |
| `description` | `string` | — |
| `subjectArea` | `string` | — |
| `cloudProviders` | `string[]` | — |
| `adminState` | `string` | enabled \| disabled |
| `status` | `string` | Control state |
| `statusBySourceType` | `object` | Status per source type |
| `policies` | `string[]` | Mapped policy names |
| `properties` | `object` | — |
| `isManual` | `boolean` | Requires manual attestation |
| `manualComplianceDetails` | `object` | — |
| `validSourceTypes` | `string[]` | — |
| `fullControlId` | `string` | controlId plus subControlId (computed) |
| `displayName` | `string` | computed |
| `policyCount` | `integer` | computed |

**Errors**

- `500` — Query failed
- `401` — Not authenticated
- `403` — Caller's role is not permitted for this operation

### List compliance controls by status

```http
GET /policies/api/v1/compliance-controls/by-status/{status}
```

Returns all compliance controls whose status matches the given value. Not paginated.

**Roles:** `admin`

**Path parameters**

| Name | Type | Description |
|---|---|---|
| `status` | `string` | Control status (exact match) |

**Response** `200` (`application/json`)

`ComplianceControlDto[] (plain array)`

| Field | Type | Description |
|---|---|---|
| `id` | `string` | Control ID (UUID) |
| `name` | `string` | Control name |
| `controlId` | `string` | Standard control identifier, e.g. 1.1.1 |
| `subControlId` | `string` | — |
| `description` | `string` | — |
| `subjectArea` | `string` | — |
| `cloudProviders` | `string[]` | — |
| `adminState` | `string` | enabled \| disabled |
| `status` | `string` | Control state |
| `statusBySourceType` | `object` | Status per source type |
| `policies` | `string[]` | Mapped policy names |
| `properties` | `object` | — |
| `isManual` | `boolean` | Requires manual attestation |
| `manualComplianceDetails` | `object` | — |
| `validSourceTypes` | `string[]` | — |
| `fullControlId` | `string` | controlId plus subControlId (computed) |
| `displayName` | `string` | computed |
| `policyCount` | `integer` | computed |

**Errors**

- `500` — Query failed
- `401` — Not authenticated
- `403` — Caller's role is not permitted for this operation

### List compliance controls by subject area

```http
GET /policies/api/v1/compliance-controls/by-subject-area/{subjectArea}
```

Returns all compliance controls whose subject area matches the given value. Not paginated.

**Roles:** `admin`

**Path parameters**

| Name | Type | Description |
|---|---|---|
| `subjectArea` | `string` | Subject area (exact match) |

**Response** `200` (`application/json`)

`ComplianceControlDto[] (plain array)`

| Field | Type | Description |
|---|---|---|
| `id` | `string` | Control ID (UUID) |
| `name` | `string` | Control name |
| `controlId` | `string` | Standard control identifier, e.g. 1.1.1 |
| `subControlId` | `string` | — |
| `description` | `string` | — |
| `subjectArea` | `string` | — |
| `cloudProviders` | `string[]` | — |
| `adminState` | `string` | enabled \| disabled |
| `status` | `string` | Control state |
| `statusBySourceType` | `object` | Status per source type |
| `policies` | `string[]` | Mapped policy names |
| `properties` | `object` | — |
| `isManual` | `boolean` | Requires manual attestation |
| `manualComplianceDetails` | `object` | — |
| `validSourceTypes` | `string[]` | — |
| `fullControlId` | `string` | controlId plus subControlId (computed) |
| `displayName` | `string` | computed |
| `policyCount` | `integer` | computed |

**Errors**

- `500` — Query failed
- `401` — Not authenticated
- `403` — Caller's role is not permitted for this operation

### Get results for a compliance control

```http
GET /policies/api/v1/compliance-controls/{id}/results
```

Returns compliance results for this control collected from all cluster, repository, and namespace compliance reports in the tenant.

**Roles:** `admin`

**Path parameters**

| Name | Type | Description |
|---|---|---|
| `id` | `string` | Control UUID |

**Response** `200` (`application/json`)

`{controlId, controlName, results: ComplianceResult[], totalResults, message}`

| Field | Type | Description |
|---|---|---|
| `controlId` | `string` | — |
| `controlName` | `string` | — |
| `totalResults` | `integer` | — |
| `results[].complianceControlName` | `string` | — |
| `results[].complianceControlId` | `string` | — |
| `results[].policy` | `string` | — |
| `results[].rule` | `string` | — |
| `results[].status` | `string` | pass \| failed \| warn \| notapplicable \| notavailable (lowercased) |
| `results[].kubeBenchIndex` | `string` | — |
| `results[].nistToCisMappings` | `object` | — |

**Errors**

- `404` — Control not found
- `500` — Retrieval failed
- `401` — Not authenticated
- `403` — Caller's role is not permitted for this operation

### List compliance standards by category

```http
GET /policies/api/v1/compliance-standards/by-category/{category}
```

Returns standards in the given category. Not paginated.

**Roles:** Any role with permission for this resource. See [Roles](../#roles).

**Path parameters**

| Name | Type | Description |
|---|---|---|
| `category` | `string` | Category value (exact match, e.g. cis) |

**Response** `200` (`application/json`)

`ComplianceStandardDto[] (plain array)`

| Field | Type | Description |
|---|---|---|
| `id` | `string` | Standard ID (UUID) |
| `name` | `string` | — |
| `version` | `string` | — |
| `description` | `string` | — |
| `type` | `string` | nirmataManaged (built-in) \| userManaged (custom) |
| `category` | `string` | Standard category, e.g. cis |
| `adminState` | `string` | enabled \| disabled |
| `score` | `integer` | Compliance score |
| `lastUpdateTime` | `integer (epoch ms)` | — |
| `k8sMinVersion` | `string` | Minimum supported Kubernetes version |
| `k8sMaxVersion` | `string` | Maximum supported Kubernetes version |
| `grade` | `string` | A-F derived from score, N/A if no score (computed) |
| `displayName` | `string` | computed |
| `controlCount` | `integer` | computed; controls are not populated by this API |

**Errors**

- `500` — Query failed
- `401` — Not authenticated
- `403` — Caller's role is not permitted for this operation

### List compliance standards by type

```http
GET /policies/api/v1/compliance-standards/by-type/{type}
```

Returns standards of the given type. Not paginated.

**Roles:** Any role with permission for this resource. See [Roles](../#roles).

**Path parameters**

| Name | Type | Description |
|---|---|---|
| `type` | `string` | nirmataManaged \| userManaged |

**Response** `200` (`application/json`)

`ComplianceStandardDto[] (plain array)`

| Field | Type | Description |
|---|---|---|
| `id` | `string` | Standard ID (UUID) |
| `name` | `string` | — |
| `version` | `string` | — |
| `description` | `string` | — |
| `type` | `string` | nirmataManaged (built-in) \| userManaged (custom) |
| `category` | `string` | Standard category, e.g. cis |
| `adminState` | `string` | enabled \| disabled |
| `score` | `integer` | Compliance score |
| `lastUpdateTime` | `integer (epoch ms)` | — |
| `k8sMinVersion` | `string` | Minimum supported Kubernetes version |
| `k8sMaxVersion` | `string` | Maximum supported Kubernetes version |
| `grade` | `string` | A-F derived from score, N/A if no score (computed) |
| `displayName` | `string` | computed |
| `controlCount` | `integer` | computed; controls are not populated by this API |

**Errors**

- `500` — Query failed
- `401` — Not authenticated
- `403` — Caller's role is not permitted for this operation

### Refresh compliance results for a standard

```http
POST /policies/api/v1/compliance-standards/{id}/refresh
```

Requests an on-demand, asynchronous recomputation of the standard's compliance results across its applied clusters and repositories instead of waiting for the next background cycle. Repeated requests are debounced.

**Roles:** `admin`, `platform`, `security`

**Path parameters**

| Name | Type | Description |
|---|---|---|
| `id` | `string` | Standard UUID |

**Response** `202` (`application/json`)

`{id, queued, lastEvaluatedAt, message?}`

| Field | Type | Description |
|---|---|---|
| `id` | `string` | Standard ID |
| `queued` | `boolean` | true if a refresh was queued; false if there are no applied sources |
| `lastEvaluatedAt` | `integer (epoch ms)` | Last evaluation time |
| `message` | `string` | Present when nothing was queued |

**Errors**

- `404` — Standard not found (code COMPLIANCE_STANDARD_NOT_FOUND)
- `429` — Refresh requested recently (REFRESH_DEBOUNCED) or already running (REFRESH_IN_PROGRESS)
- `503` — Refresh queue full (REFRESH_QUEUE_FULL)
- `500` — REFRESH_FAILED
- `401` — Not authenticated
- `403` — Caller's role is not permitted for this operation

**Example**

```json
Errors use {status, message, code}.
```