docs

Get a project's audit readiness (codes and counts)

GET /iso/projects/{projectId}/readiness

Scope iso:read Plan Growth+

Requires the iso:read scope. Needs the iso27001 plan feature.

Example

curl "https://api.autociso.io/api/v1/iso/projects/<projectId>/readiness" \
  -H "Authorization: Bearer <your-api-token>"

Response 200

{
  "data": {
    "blockers": [
      {
        "code": "CONTROL_MISSING_EVIDENCE",
        "count": 15
      },
      {
        "code": "SOA_NOT_SIGNED",
        "count": 1
      }
    ],
    "computedAt": "2026-10-13T07:30:00Z",
    "projectId": "iso_1hfa8m2c4x0p",
    "projectStatus": "ACTIVE",
    "score": 68,
    "warnings": [
      {
        "code": "CONTROL_EVIDENCE_STALE",
        "count": 22
      },
      {
        "code": "POLICY_ACK_RATE_LOW",
        "count": 1
      }
    ]
  },
  "error": null
}

Path parameters

  • projectId string required

Returns

The data field of the standard { data, error, meta } envelope:

  • blockers array of object required
    Blocker codes and counts, sorted by code.
    • code string required
      SCOPE_NOT_SIGNED, SOA_NOT_SIGNED, CONTROL_MISSING_EVIDENCE, CONTROL_EVIDENCE_STALE, OPEN_NONCONFORMITIES, POLICY_ACK_RATE_LOW or ACCESS_REVIEW_OVERDUE.
    • count integer required
      Number of occurrences.
    • No other fields.
  • computedAt string (date-time) required
    Computation time (UTC, RFC 3339).
  • projectId string required
    ISO project id (iso_).
  • projectStatus string required
    ACTIVE, CERTIFIED, SURVEILLANCE, ARCHIVED or UNKNOWN.
  • score integer required
    Readiness score (0-100) computed now.
  • warnings array of object required
    Warning codes and counts, sorted by code.
    • code string required
      SCOPE_NOT_SIGNED, SOA_NOT_SIGNED, CONTROL_MISSING_EVIDENCE, CONTROL_EVIDENCE_STALE, OPEN_NONCONFORMITIES, POLICY_ACK_RATE_LOW or ACCESS_REVIEW_OVERDUE.
    • count integer required
      Number of occurrences.
    • No other fields.
  • No other fields.

Errors

Status Code Retry Meaning
400 - no The request is invalid.
401 - no The token is missing, malformed, expired or revoked.
402 - no The organisation’s plan does not include the feature this route needs.
403 - no The token may not use this route.
404 - no The resource does not exist in this organisation.
429 - yes Rate limit or row budget exceeded; retry after the time in Retry-After.
500 - no Unexpected server error.
503 - yes A dependency is temporarily unavailable; retry later.
Last reviewed: 2026-10-13

Was this page helpful?

Esc