> ## Documentation Index
> Fetch the complete documentation index at: https://docs.infraudit.com/llms.txt
> Use this file to discover all available pages before exploring further.

# REST API endpoints for compliance assessments

> Trigger CIS, SOC 2, NIST, and PCI-DSS compliance assessments, retrieve per-control pass/fail results, and export audit reports via the InfraAudit API.

The compliance endpoints let you enable frameworks, run assessments against your connected providers, retrieve control-level results, and export reports as PDF or CSV. Supported frameworks include CIS AWS Foundations Benchmark, SOC 2, NIST 800-53, and PCI-DSS.

Base path: `/api/v1/compliance`

***

## GET /compliance/frameworks — list available frameworks

Returns all frameworks available in your account.

```http theme={null}
GET /api/v1/compliance/frameworks
Authorization: Bearer <token>
```

### Response

```json theme={null}
[
  {
    "id": "cis-aws",
    "name": "CIS AWS Foundations Benchmark",
    "version": "2.0",
    "enabled": true
  },
  {
    "id": "soc2",
    "name": "SOC 2 Type II",
    "version": null,
    "enabled": false
  }
]
```

***

## POST /compliance/frameworks/{framework_id}/enable — enable a framework

Enables a framework for one or more providers.

```http theme={null}
POST /api/v1/compliance/frameworks/{framework_id}/enable
Authorization: Bearer <token>
Content-Type: application/json
```

### Request body (optional)

<ParamField body="provider_ids" type="array">
  IDs of the providers to scope this framework to. If omitted, all connected providers are included.
</ParamField>

```json theme={null}
{
  "provider_ids": [1, 2]
}
```

***

## DELETE /compliance/frameworks/{framework_id}/enable — disable a framework

Disables a framework and stops future assessments for it.

```http theme={null}
DELETE /api/v1/compliance/frameworks/{framework_id}/enable
Authorization: Bearer <token>
```

***

## POST /compliance/assess — run an assessment

Runs a compliance assessment. If no body is provided, all enabled frameworks run against all providers.

```http theme={null}
POST /api/v1/compliance/assess
Authorization: Bearer <token>
Content-Type: application/json
```

### Request body (optional)

<ParamField body="framework_id" type="string">
  Run only this framework.
</ParamField>

<ParamField body="provider_id" type="integer">
  Scope to a specific provider.
</ParamField>

```json theme={null}
{
  "framework_id": "cis-aws",
  "provider_id": 1
}
```

### Response `202`

```json theme={null}
{
  "job_id": 67,
  "status": "running"
}
```

***

## GET /compliance/assessments — list assessments

Returns past assessments.

```http theme={null}
GET /api/v1/compliance/assessments
Authorization: Bearer <token>
```

### Query parameters

<ParamField query="framework_id" type="string">
  Filter by framework.
</ParamField>

<ParamField query="provider_id" type="integer">
  Filter by provider.
</ParamField>

<ParamField query="page" type="integer" default="1">
  Page number.
</ParamField>

<ParamField query="per_page" type="integer" default="20">
  Results per page.
</ParamField>

***

## GET /compliance/assessments/{id} — get assessment results

Returns the full assessment with control-level results and failed resources.

```http theme={null}
GET /api/v1/compliance/assessments/{id}
Authorization: Bearer <token>
```

### Response

```json theme={null}
{
  "id": 1,
  "framework_id": "cis-aws",
  "provider_id": 1,
  "score": 0.724,
  "total_controls": 58,
  "passed": 42,
  "failed": 16,
  "created_at": "2024-01-15T04:00:00Z",
  "controls": [
    {
      "id": "cis-aws-2.1.1",
      "category": "Storage",
      "title": "Ensure S3 encryption-at-rest",
      "severity": "high",
      "status": "failed",
      "failed_resources": [
        { "resource_id": 5, "name": "data-lake-bucket" }
      ]
    }
  ]
}
```

<ResponseField name="score" type="number">
  A value between 0 and 1 representing the percentage of controls that passed.
</ResponseField>

***

## GET /compliance/assessments/{id}/export — export assessment report

Downloads the assessment as a PDF or CSV file.

```http theme={null}
GET /api/v1/compliance/assessments/{id}/export?format=pdf
Authorization: Bearer <token>
```

### Query parameters

<ParamField query="format" type="string" required>
  Export format: `pdf` or `csv`.
</ParamField>

The response uses the appropriate `Content-Type` header: `application/pdf` or `text/csv`.