Skip to main content
The platform includes foundational endpoints intended to support EU AI Act compliance reporting.
In v0.1, these are foundational stubs (no PDF generation, no immutable/WORM storage). Deployments may gate these to Enterprise tiers.

Signing key is required outside local

Compliance exports are signed with an Ed25519 key (COMPLIANCE_SIGNING_KEY_ED25519, COMPLIANCE_SIGNING_KEY_ID). Outside ENVIRONMENT=local, the platform refuses to start if no key is configured, so exports can never silently ship as "unsigned" in staging or production. Set COMPLIANCE_ALLOW_UNSIGNED=true to explicitly opt out of this check. GET /api/v1/utils/health-check/ reports current signing status under signing.configured / signing.key_id.

Health

Returns the subscription tier and whether compliance features are enabled.

Export report

Generates a compliance export response containing summary stats, incidents, oversight log stubs, and model-card aggregation (when present in action metadata).

Oversight log

Returns actions that required human approval (based on compliance_metadata).

Export history

List previously generated exports for the current organization, or fetch a specific export by ID. Useful for re-downloading a report without regenerating it.

Verify a deployment

Runs a server-side check that asserts the org’s current configuration meets a given standard’s required mappings. Returns a structured verdict (per-control pass/fail) suitable for embedding in a compliance dashboard.

Standards catalog

Lists supported compliance standards (EU AI Act, SOC 2, etc.) and the per-standard set of ComplianceMapping rows. Mappings link platform features (interventions, approvals, audit log) to the controls they satisfy.

Edit a mapping

Update a single ComplianceMapping row (typically used by the console’s compliance editor to attach evidence or notes to a control).