Skip to main content
GET
/
v1
/
compliance
/
reports
List Compliance Reports
curl --request GET \
  --url https://api.truthlocks.com/v1/compliance/reports \
  --header 'X-API-Key: <api-key>'
{
  "items": [
    {
      "check_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "agent_id": "3c90c3cc-0d44-4b50-8888-8dd25736052a",
      "framework": "soc2",
      "scope": {},
      "status": "pending",
      "findings": [
        {
          "finding_id": "<string>",
          "severity": "low",
          "title": "<string>",
          "description": "<string>"
        }
      ],
      "created_at": "2023-11-07T05:31:56Z"
    }
  ],
  "total": 123
}
Generates an aggregated compliance report for an entity across all checks performed within a specified time period. Reports provide executive-level summaries, trend analysis, and a consolidated view of all findings — suitable for sharing with auditors, compliance officers, and regulators. Reports are generated asynchronously for large time ranges. For periods under 30 days, results are typically returned synchronously.

​
Authentication

Requires X-API-Key header or Bearer JWT token. Tenant-scoped via X-Tenant-ID.

​
Request Body

​
entity_type
string
required
The type of entity to report on. One of: agent, model, dataset, workflow.
​
entity_id
string
required
The unique identifier of the entity.
​
regulation
string
required
The regulation or framework to report against. Supported values: SOC2, ISO27001, GDPR, HIPAA, EU_AI_ACT.
​
period_start
string
required
ISO 8601 date for the start of the reporting period (inclusive). Example: 2026-01-01.
​
period_end
string
required
ISO 8601 date for the end of the reporting period (inclusive). Example: 2026-03-31.

​
Response

​
id
string
Unique identifier for the compliance report. Format: maip-report:ULID.
​
entity_type
string
The type of entity reported on.
​
entity_id
string
The identifier of the entity reported on.
​
regulation
string
The regulation assessed.
​
period_start
string
Start of the reporting period.
​
period_end
string
End of the reporting period.
​
status
string
Report generation status. One of: generating, ready, failed.
​
summary
object
High-level summary of compliance across the reporting period.
​
findings
object[]
Aggregated findings across all checks in the period. Deduplicated by control ID with the most recent status.
​
generated_at
string
ISO 8601 timestamp of when the report was generated.

Authorizations

​
X-API-Key
string
header
required

API key for machine-to-machine authentication

Query Parameters

​
agent_id
string<uuid>

Filter by agent

​
framework
enum<string>

Filter by framework

Available options:
soc2,
iso27001,
hipaa,
gdpr
​
status
enum<string>

Filter by result status

Available options:
pending,
passed,
failed,
partial
​
limit
integer
default:25
Required range: 1 <= x <= 100
​
offset
integer
default:0
Required range: x >= 0

Response

Paginated compliance reports

​
items
object[]
​
total
integer