> ## Documentation Index
> Fetch the complete documentation index at: https://docs.alignr.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Get client compliance

> Requires `detection.read`. Results are scoped to the authenticated tenant. This reference is generated from source; consult the authenticated live schema for deployment-specific availability.



## OpenAPI

````yaml /api-reference/openapi.json get /api/v1/organizations/{organization_id}/compliance
openapi: 3.1.0
info:
  title: Alignr API
  version: 0.1.0
  description: >-
    Selected read operations. Generated from the Alignr application; no tenant
    data is included.
servers:
  - url: https://api.alignr.io
security: []
paths:
  /api/v1/organizations/{organization_id}/compliance:
    get:
      tags:
        - Alignment
      summary: Get client compliance
      description: >-
        Requires `detection.read`. Results are scoped to the authenticated
        tenant. This reference is generated from source; consult the
        authenticated live schema for deployment-specific availability.
      operationId: >-
        get_organization_compliance_api_v1_organizations__organization_id__compliance_get
      parameters:
        - name: organization_id
          in: path
          required: true
          schema:
            type: string
            format: uuid
            title: Organization Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ComplianceGridRead'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
      security:
        - BearerAuth: []
components:
  schemas:
    ComplianceGridRead:
      properties:
        organizationId:
          type: string
          format: uuid
          title: Organizationid
        organizationName:
          type: string
          title: Organizationname
        rollup:
          $ref: '#/components/schemas/ControlStatus'
        items:
          items:
            $ref: '#/components/schemas/ComplianceRow'
          type: array
          title: Items
      type: object
      required:
        - organizationId
        - organizationName
        - rollup
        - items
      title: ComplianceGridRead
      description: |-
        `GET /organizations/{orgId}/compliance` (`ComplianceGrid` in
        `frontend/src/types/standards.ts`).
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    ControlStatus:
      type: string
      enum:
        - pass
        - fail
        - no_data
        - not_covered
        - not_applicable
      title: ControlStatus
      description: >-
        The outcome of one control evaluated against one organisation — spec §5,

        decided by ADR-0014 §4. Three of the five members are not "fail", even
        though

        none of them is "pass" either: a control that has not affirmatively
        fired has

        proved nothing, so `no_data` (population exists, no facts arrived),

        `not_covered` (nothing connected here could ever supply the facts) and

        `not_applicable` (disabled, or overridden out, for this organisation)
        stay

        distinct outcomes rather than being folded into whichever of
        `pass`/`fail` is

        cheaper to compute. Collapsing any of them into `pass` reproduces the
        exact

        failure this design exists to rule out — a compliance grid rendering
        green for

        a client nobody is actually monitoring.


        `PASS` is spelled upper-case like every other member in this module —
        that

        convention, not the keyword collision, is why it is not written `pass`.
        Its

        *value* is still the reserved word `"pass"`, which is fine: only the
        bare name

        `pass` is a Python keyword, and nothing here ever writes one.
    ComplianceRow:
      properties:
        ruleId:
          type: string
          format: uuid
          title: Ruleid
        ruleName:
          type: string
          title: Rulename
        standardId:
          type: string
          format: uuid
          title: Standardid
        standardName:
          type: string
          title: Standardname
        category:
          type: string
          title: Category
        severity:
          $ref: '#/components/schemas/Severity'
        status:
          $ref: '#/components/schemas/ControlStatus'
        subjectsEvaluated:
          type: integer
          title: Subjectsevaluated
        subjectsFailing:
          type: integer
          title: Subjectsfailing
        detail:
          anyOf:
            - $ref: '#/components/schemas/ComplianceRowDetail'
            - type: 'null'
        evaluatedAt:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Evaluatedat
        standardVersion:
          anyOf:
            - type: integer
            - type: 'null'
          title: Standardversion
        effectiveEnabled:
          type: boolean
          title: Effectiveenabled
        parameters:
          additionalProperties: true
          type: object
          title: Parameters
        effectiveParameters:
          additionalProperties: true
          type: object
          title: Effectiveparameters
        requiredPredicates:
          items:
            type: string
          type: array
          title: Requiredpredicates
        sourceTypeCodes:
          additionalProperties:
            items:
              type: string
            type: array
          type: object
          title: Sourcetypecodes
        sourceOptions:
          additionalProperties:
            items:
              type: string
            type: array
          type: object
          title: Sourceoptions
        connectedSourceTypeCodes:
          items:
            type: string
          type: array
          title: Connectedsourcetypecodes
        isOverridden:
          type: boolean
          title: Isoverridden
        disabledReason:
          anyOf:
            - type: string
            - type: 'null'
          title: Disabledreason
        disabledByName:
          anyOf:
            - type: string
            - type: 'null'
          title: Disabledbyname
        disabledAt:
          anyOf:
            - type: string
              format: date-time
            - type: 'null'
          title: Disabledat
        openDetectionCount:
          type: integer
          title: Opendetectioncount
      type: object
      required:
        - ruleId
        - ruleName
        - standardId
        - standardName
        - category
        - severity
        - status
        - subjectsEvaluated
        - subjectsFailing
        - effectiveEnabled
        - parameters
        - effectiveParameters
        - requiredPredicates
        - sourceTypeCodes
        - sourceOptions
        - connectedSourceTypeCodes
        - isOverridden
        - openDetectionCount
      title: ComplianceRow
      description: >-
        One row of the per-client compliance grid — `GET /organizations/{orgId}/

        compliance` (`ComplianceRow` in `frontend/src/types/standards.ts`).
        Mirrors a

        `control_evaluations` row joined against the §4 cascade, already
        resolved

        server-side (`effectiveEnabled`/`effectiveParameters`/`isOverridden`) so
        the

        grid never re-derives the cascade itself.
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
              - type: string
              - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
        - loc
        - msg
        - type
      title: ValidationError
    Severity:
      type: string
      enum:
        - high
        - medium
        - low
      title: Severity
    ComplianceRowDetail:
      properties:
        missingPredicates:
          items:
            type: string
          type: array
          title: Missingpredicates
          default: []
        satisfiedBy:
          additionalProperties:
            items:
              type: string
            type: array
          type: object
          title: Satisfiedby
          default: {}
        connectedHere:
          items:
            type: string
          type: array
          title: Connectedhere
          default: []
        refusedHere:
          items:
            $ref: '#/components/schemas/ComplianceRefusal'
          type: array
          title: Refusedhere
          default: []
        degradedCoverage:
          items:
            $ref: '#/components/schemas/DegradedCoverageEntry'
          type: array
          title: Degradedcoverage
          default: []
      type: object
      title: ComplianceRowDetail
      description: >-
        `control_evaluations.detail`, reshaped onto the wire's camelCase

        contract. Two independent reasons a row carries one instead of `null`:


        - the row is `notCovered` (spec §5/§5a) — `missingPredicates`,
          `satisfiedBy`, `connectedHere`, `refusedHere` are populated, and
          `degradedCoverage` is always empty (a predicate that reconciled off an
          existing fact is, by definition, not `notCovered` — see step 3a);
        - the row is `pass`/`fail`/`no_data` but evaluated against at least one
          predicate whose live coverage is `degradedCoverage` (step 3a) — only
          that field is populated, and every `notCovered`-only field stays at its
          empty default.

        A `fail` row's `failing_subjects` and a `notApplicable` row's disable

        metadata are already surfaced through `ComplianceRow`'s own

        `subjectsFailing`/`disabledReason`/`disabledByName`/`disabledAt` fields,
        so

        restating them here would be a second, divergeable copy of the same
        fact.
    ComplianceRefusal:
      properties:
        connector:
          type: string
          title: Connector
        reason:
          type: string
          title: Reason
      type: object
      required:
        - connector
        - reason
      title: ComplianceRefusal
      description: |-
        One connector — already connected and mapped to this organisation — that
        explicitly declines to emit one of a `notCovered` control's required
        predicates (spec §5a). `reason` is the connector's own declared string,
        carried through unchanged.
    DegradedCoverageEntry:
      properties:
        typeCode:
          type: string
          title: Typecode
        predicate:
          type: string
          title: Predicate
        status:
          $ref: '#/components/schemas/IntegrationStatus'
      type: object
      required:
        - typeCode
        - predicate
        - status
      title: DegradedCoverageEntry
      description: >-
        One connector that would supply a predicate this row's control needed,

        but is not currently `connected` here — surfaced on a `pass`/`fail`/

        `no_data` row that only evaluated at all because an *existing* fact

        reconciled a live coverage gap (`control_evaluation_service` module

        docstring, step 3a — the fix for "an open detection citing a predicate
        the

        grid claims nothing can check"). This is **not** a failure of the
        control:

        the control evaluated normally, off the last observation this connector

        wrote before it stopped being healthy. `status` is the connector's
        current

        `IntegrationStatus` (`error`, `disabled`, or `available` — never

        `connected`, or this predicate would not have been a gap at all).
    IntegrationStatus:
      type: string
      enum:
        - connected
        - error
        - disabled
        - available
      title: IntegrationStatus
  securitySchemes:
    BearerAuth:
      type: http
      scheme: bearer
      description: An Alignr API key.

````