docs

Get the compliance posture overview (scores, counts, trend)

GET /compliance/overview

Scope compliance:read Plan Growth+

Requires the compliance:read scope. Needs the compliance_overview plan feature.

Example

curl "https://api.autociso.io/api/v1/compliance/overview" \
  -H "Authorization: Bearer <your-api-token>"

Response 200

{
  "data": {
    "dimensions": {
      "evidenceFreshness": {
        "fresh": 98,
        "score": 82,
        "stale": 22,
        "total": 120
      },
      "gapCompliance": [
        {
          "compliant": 58,
          "framework": "iso27001",
          "missing": 15,
          "na": 8,
          "partial": 12,
          "score": 71,
          "totalControls": 93
        }
      ],
      "riskExposure": {
        "activeHigh": 3,
        "activeMedium": 9,
        "mitigated": 14,
        "score": 68,
        "totalRecords": 31
      },
      "supplierPosture": {
        "agreementExpiring": 2,
        "compliant": 17,
        "criticalMissingAssessment": 1,
        "reviewOverdue": 3,
        "score": 77,
        "totalSuppliers": 24
      },
      "vulnFindingPosture": {
        "critical": 1,
        "high": 7,
        "low": 17,
        "medium": 21,
        "score": 70,
        "totalOpen": 46
      }
    },
    "generatedAt": "2026-10-13T06:00:00Z",
    "overallScore": 74,
    "trend": [
      {
        "date": "2026-10-11",
        "score": 72
      },
      {
        "date": "2026-10-12",
        "score": 73
      },
      {
        "date": "2026-10-13",
        "score": 74
      }
    ]
  },
  "error": null
}

Returns

The data field of the standard { data, error, meta } envelope:

  • dimensions object required
    Per-dimension scores and counts.
    • evidenceFreshness object required
      Evidence freshness.
      Show 4 propertiesHide 4 properties { fresh, score, stale, total }
      • fresh integer required
        Fresh items.
      • score integer required
        Sub-score (0-100).
      • stale integer required
        Stale items.
      • total integer required
        Evidence items.
      • No other fields.
    • gapCompliance array of object required
      Gap compliance per framework.
      Show 7 propertiesHide 7 properties { compliant, framework, missing, na, … }
      • compliant integer required
        Compliant controls.
      • framework string required
        iso27001 or UNKNOWN.
      • missing integer required
        Missing controls.
      • na integer required
        Not applicable controls.
      • partial integer required
        Partially compliant controls.
      • score integer required
        Sub-score (0-100).
      • totalControls integer required
        Controls assessed.
      • No other fields.
    • riskExposure object required
      Residual risk exposure.
      Show 5 propertiesHide 5 properties { activeHigh, activeMedium, mitigated, score, … }
      • activeHigh integer required
        Active high risks.
      • activeMedium integer required
        Active medium risks.
      • mitigated integer required
        Mitigated risks.
      • score integer required
        Sub-score (0-100).
      • totalRecords integer required
        Risk records.
      • No other fields.
    • supplierPosture object required
      Supplier posture.
      Show 6 propertiesHide 6 properties { agreementExpiring, compliant, criticalMissingAssessment, reviewOverdue, … }
      • agreementExpiring integer required
        Agreements expiring soon.
      • compliant integer required
        Compliant suppliers.
      • criticalMissingAssessment integer required
        Critical suppliers without a completed assessment.
      • reviewOverdue integer required
        Suppliers with an overdue review.
      • score integer required
        Sub-score (0-100).
      • totalSuppliers integer required
        Suppliers.
      • No other fields.
    • vulnFindingPosture object or null
      Supply-chain vulnerability posture, when the plan has it and findings are open.
      Show 6 propertiesHide 6 properties { critical, high, low, medium, … }
      • critical integer required
        Open critical findings.
      • high integer required
        Open high findings.
      • low integer required
        Open low findings.
      • medium integer required
        Open medium findings.
      • score integer required
        Sub-score (0-100).
      • totalOpen integer required
        Open findings.
      • No other fields.
    • No other fields.
  • generatedAt string (date-time) required
    Computation time (UTC).
  • overallScore integer required
    Unified posture score (0-100).
  • trend array of object required
    Daily posture snapshots, oldest first.
    • date string required
      Snapshot date (YYYY-MM-DD, UTC).
    • score integer required
      Posture score that day.
    • No other fields.
  • No other fields.

Errors

Status Code Retry Meaning
401 - no The token is missing, malformed, expired or revoked.
402 - no The organisation’s plan does not include the feature this route needs.
403 - no The token may not use this route.
429 - yes Rate limit or row budget exceeded; retry after the time in Retry-After.
500 - no Unexpected server error.
503 - yes A dependency is temporarily unavailable; retry later.
Last reviewed: 2026-10-13

Was this page helpful?

Esc