Compliance API surfaces

Compliance-related API work is split across two boundaries. Do not assume that a compliance field or operation in one boundary is available in the other.

Core platform API

The main Biztraak API exposes authenticated management operations for compliance catalog data when the corresponding workflow is enabled:

• /api/compliance/frameworks
• /api/compliance/framework-versions
• /api/compliance/v1/controls
• GraphQL framework, version, control, policy-pack, and compliance-event operations exposed by the current main schema

These operations support catalog and configuration management. They are subject to normal tenant and role authorization.

Standalone Compliance API

The repository also contains a separately deployed Compliance API with its own host, authentication configuration, and route boundary. When that service is provisioned and exposed for your organization, its routes use /v1/... paths for compliance state such as:

• frameworks, controls, policies, coverage, evidence, issues, risks, and reports
• audit plans, assessment runs, action requests, and remediation
• integrations, trust-portal content, and security scan results
• GraphQL at /gql

The standalone service is not the same endpoint as the main platform /graphql API. Your organization’s deployment and enabled workflow determine whether these routes are available.

Integration guidance

1. Confirm which API host and compliance workflow your organization has enabled.
2. Use the host’s GraphQL schema or published route contract as the contract for that deployment.
3. Send the bearer token and tenant context required by that service.
4. Treat evidence, assessment, issue, risk, report, and action-request operations as workflow-specific rather than assuming they are available on the main platform API.

For the main API transport and tooling, see GraphQL, REST API reference, and API errors.