Skip to main content
POST
Create Compliance Check
Executes an automated compliance assessment for a specific entity (agent, model, dataset, or workflow) against a supported regulation. The check evaluates the entity’s configuration, access patterns, data handling, and audit trail against the regulation’s requirements and produces a compliance determination with detailed findings. Compliance checks are idempotent for the same entity-regulation pair within a 24-hour window. Repeated calls within that window return the cached result.

Authentication

Requires X-API-Key header or Bearer JWT token. Tenant-scoped via X-Tenant-ID.

Request Body

string
required
The type of entity to assess. One of: - agent — a registered machine agent
  • model — an AI/ML model - dataset — a data asset or training dataset - workflow — an automated workflow or pipeline
string
required
The unique identifier of the entity to assess. Must exist within the tenant.
string
required
The regulation or framework to assess against. Supported values: - SOC2 — SOC 2 Type II controls - ISO27001 — ISO 27001 information security management - GDPR — EU General Data Protection Regulation - HIPAA — US Health Insurance Portability and Accountability Act - EU_AI_ACT — EU Artificial Intelligence Act
string
Optional scope qualifier to narrow the assessment. For example, access-control to assess only access-control-related controls, or data-handling for data processing controls. If omitted, a full-scope assessment is performed.

Response

string
Unique identifier for the compliance check record. Format: maip-cc:ULID.
string
The type of entity that was assessed.
string
The identifier of the assessed entity.
string
The regulation that was assessed.
string
The scope of the assessment. full if no scope was specified.
string
The compliance determination. One of: - compliant — entity meets all assessed requirements - non_compliant — entity fails one or more critical requirements - partial — entity meets some but not all requirements
object[]
Detailed list of individual findings from the assessment.
string
The MAIP receipt minted for this compliance check, providing an immutable audit record.
string
ISO 8601 timestamp of when the assessment was performed.

Supported Regulations

Authorizations

X-API-Key
string
header
required

API key for machine-to-machine authentication

Body

application/json
agent_id
string<uuid>
required

Agent to evaluate

framework
enum<string>
required

Compliance framework

Available options:
soc2,
iso27001,
hipaa,
gdpr
scope
object

Scope parameters for the check

Response

Compliance check created

check_id
string<uuid>
agent_id
string<uuid>
framework
enum<string>
Available options:
soc2,
iso27001,
hipaa,
gdpr
scope
object
status
enum<string>
Available options:
pending,
passed,
failed,
partial
findings
object[]
created_at
string<date-time>