API reference

Compliance

The compliance score and the rules behind it.

GET/v1/compliance/alerts
GET/v1/compliance/domains/{domainId}/checks
GET/v1/compliance/rule-sets
GET/v1/compliance/summary

GET/v1/compliance/alerts

What is currently wrong with this workspace

Derived from live state — banner findings, unverified domains, failed scans, verified domains recording no traffic. An alert exists only while its cause does, and its id is stable for that whole time.

Needs: A signed-in panel session, sent as Authorization: Bearer <access token>.

Parameters
Name	Where	Type	What it is
limit	query	number
severity	query	"critical" \| "warning" \| "info"

Responses
Status	Body	When
200	ComplianceAlertsDto

200 body · ComplianceAlertsDto
Field	Type	What it is
alerts required	ComplianceAlertDto[]
alerts[].id required	string	Stable for as long as the underlying condition holds, so a client can dismiss one and not have it reappear on the next poll under a new id.
alerts[].kind required	"compliance_finding" \| "domain_unverified" \| "scan_failed" \| "no_traffic"
alerts[].severity required	"critical" \| "warning" \| "info"
alerts[].at required	string	When the underlying condition was last observed. For a derived condition (a misconfigured banner) this is when the thing it derives from last changed, not when the alert was generated.
alerts[].title required	string
alerts[].detail required	string	What to do about it. Safe to show verbatim.
alerts[].domainId	string \| null
alerts[].hostname	string \| null
total required	number	Total before `limit` was applied.

GET/v1/compliance/domains/{domainId}/checks

Dark-pattern / GDPR checks for a domain’s banner

Needs: A signed-in panel session, sent as Authorization: Bearer <access token>.

Parameters
Name	Where	Type	What it is
domainId required	path	string

Responses
Status	Body	When
200	DomainComplianceDto

200 body · DomainComplianceDto
Field	Type	What it is
domainId required	string
hostname required	string
published required	boolean	Whether these checks run against the published config (else the draft).
score required	number
byJurisdiction required	JurisdictionScoresDto
byJurisdiction.all required	number
byJurisdiction.eea_uk required	number
byJurisdiction.us required	number
critical required	number
warnings required	number
info required	number
findings required	ComplianceFindingDto[]
findings[].id required	string
findings[].severity required	"info" \| "warning" \| "critical"
findings[].jurisdiction required	"eea_uk" \| "us" \| "all"
findings[].title required	string
findings[].description required	string
findings[].fix required	string
findings[].regulation required	string
findings[].field required	string
findings[].impact required	number	Points this finding costs — and so exactly what clearing it returns.
notes required	string[]	Settings that shape this banner's behaviour without being scored, such as the six-month rejection memory. Empty when there is nothing to say.

GET/v1/compliance/rule-sets

The consent rules each domain’s banner applies

One row per domain: its regimes (EEA/UK, US, rest of world), consent expiry, rejection memory, blocking rules, sensitive categories and Global Privacy Control — read from the published banner, which is what visitors are served, else from the draft, and saying which. Read-only: every one of these is changed in the banner builder.

Needs: A signed-in panel session, sent as Authorization: Bearer <access token>.

Responses
Status	Body	When
200	ComplianceRuleSetsDto

200 body · ComplianceRuleSetsDto
Field	Type	What it is
domains required	DomainRuleSetDto[]
domains[].domainId required	string
domains[].hostname required	string
domains[].status required	"pending" \| "verified" \| "failed"
domains[].published required	boolean	A banner is live: visitors get `ruleSet`.
domains[].source required	"none" \| "draft" \| "published"
domains[].publishedAt required	string \| null	ISO timestamp of the last publish, or null if never published.
domains[].ruleSet required	RuleSetDto \| null	Null only when `source` is `none` — there is no banner config to read.

GET/v1/compliance/summary

The workspace’s compliance score, and the issues on each domain

Needs: A signed-in panel session, sent as Authorization: Bearer <access token>.

Parameters
Name	Where	Type	What it is
status	query	"healthy" \| "warning" \| "critical"
q	query	string

Responses
Status	Body	When
200	ComplianceSummaryDto

200 body · ComplianceSummaryDto
Field	Type	What it is
score required	number	Average score across all domains (100 when there are none).
domains required	number
critical required	number
warnings required	number
info required	number
rows required	DomainComplianceRowDto[]
rows[].domainId required	string
rows[].hostname required	string
rows[].score required	number
rows[].critical required	number
rows[].warnings required	number
rows[].info required	number
rows[].status required	"warning" \| "critical" \| "healthy"
facets required	ComplianceFacetsDto	Filter-independent counts for the status filters and severity chips.
facets.status required	ComplianceStatusFacetsDto
facets.severity required	ComplianceSeverityFacetsDto
checksRun required	number	How many rule checks this score is based on, and how many of them passed. Counted over every domain in the workspace, not only the filtered rows.
checksPassed required	number

Next groupScanner