# Get the compliance posture overview (scores, counts, trend)

Requires the `compliance:read` scope.

`GET /compliance/overview`

Scope `compliance:read` | Plan **Growth+**

Requires the `compliance:read` scope. Needs the `compliance_overview` plan feature.

## Returns

The `data` field of the standard `{ data, error, meta }` envelope:

- `dimensions`: object Per-dimension scores and counts.
  - `evidenceFreshness`: object Evidence freshness.
    - `fresh`: integer Fresh items.
    - `score`: integer Sub-score (0-100).
    - `stale`: integer Stale items.
    - `total`: integer Evidence items.
    - No other fields.
  - `gapCompliance`: array of object Gap compliance per framework.
    - `compliant`: integer Compliant controls.
    - `framework`: string iso27001 or UNKNOWN.
    - `missing`: integer Missing controls.
    - `na`: integer Not applicable controls.
    - `partial`: integer Partially compliant controls.
    - `score`: integer Sub-score (0-100).
    - `totalControls`: integer Controls assessed.
    - No other fields.
  - `riskExposure`: object Residual risk exposure.
    - `activeHigh`: integer Active high risks.
    - `activeMedium`: integer Active medium risks.
    - `mitigated`: integer Mitigated risks.
    - `score`: integer Sub-score (0-100).
    - `totalRecords`: integer Risk records.
    - No other fields.
  - `supplierPosture`: object Supplier posture.
    - `agreementExpiring`: integer Agreements expiring soon.
    - `compliant`: integer Compliant suppliers.
    - `criticalMissingAssessment`: integer Critical suppliers without a completed assessment.
    - `reviewOverdue`: integer Suppliers with an overdue review.
    - `score`: integer Sub-score (0-100).
    - `totalSuppliers`: integer Suppliers.
    - No other fields.
  - `vulnFindingPosture`: optional object or null Supply-chain vulnerability posture, when the plan has it and findings are open.
    - `critical`: integer Open critical findings.
    - `high`: integer Open high findings.
    - `low`: integer Open low findings.
    - `medium`: integer Open medium findings.
    - `score`: integer Sub-score (0-100).
    - `totalOpen`: integer Open findings.
    - No other fields.
  - No other fields.
- `generatedAt`: string (date-time) Computation time (UTC).
- `overallScore`: integer Unified posture score (0-100).
- `trend`: array of object Daily posture snapshots, oldest first.
  - `date`: string Snapshot date (YYYY-MM-DD, UTC).
  - `score`: integer Posture score that day.
  - No other fields.
- No other fields.

## Errors

| Status | Code | Retry | Meaning |
|---|---|---|---|
| 401 | - | no | The token is missing, malformed, expired or revoked. |
| 402 | - | no | The organisation's plan does not include the feature this route needs. |
| 403 | - | no | The token may not use this route. |
| 429 | - | yes | Rate limit or row budget exceeded; retry after the time in Retry-After. |
| 500 | - | no | Unexpected server error. |
| 503 | - | yes | A dependency is temporarily unavailable; retry later. |

## Example

### curl

```bash
curl "https://api.autociso.io/api/v1/compliance/overview" \
  -H "Authorization: Bearer <your-api-token>"
```

### Python

```python
import requests

response = requests.get(
    "https://api.autociso.io/api/v1/compliance/overview",
    headers={"Authorization": "Bearer <your-api-token>"},
)
print(response.json())
```

### JavaScript

```javascript
const response = await fetch("https://api.autociso.io/api/v1/compliance/overview", {
  method: "GET",
  headers: { "Authorization": "Bearer <your-api-token>" },
});
console.log(await response.json());
```

## Response (200)

```json
{
  "data": {
    "dimensions": {
      "evidenceFreshness": {
        "fresh": 98,
        "score": 82,
        "stale": 22,
        "total": 120
      },
      "gapCompliance": [
        {
          "compliant": 58,
          "framework": "iso27001",
          "missing": 15,
          "na": 8,
          "partial": 12,
          "score": 71,
          "totalControls": 93
        }
      ],
      "riskExposure": {
        "activeHigh": 3,
        "activeMedium": 9,
        "mitigated": 14,
        "score": 68,
        "totalRecords": 31
      },
      "supplierPosture": {
        "agreementExpiring": 2,
        "compliant": 17,
        "criticalMissingAssessment": 1,
        "reviewOverdue": 3,
        "score": 77,
        "totalSuppliers": 24
      },
      "vulnFindingPosture": {
        "critical": 1,
        "high": 7,
        "low": 17,
        "medium": 21,
        "score": 70,
        "totalOpen": 46
      }
    },
    "generatedAt": "2026-10-13T06:00:00Z",
    "overallScore": 74,
    "trend": [
      {
        "date": "2026-10-11",
        "score": 72
      },
      {
        "date": "2026-10-12",
        "score": 73
      },
      {
        "date": "2026-10-13",
        "score": 74
      }
    ]
  },
  "error": null
}
```