Compliance API

Generate compliance report

Generate a compliance assessment report for any of 7 supported frameworks.

GET /v1/compliance/report?framework=pctf&level=substantial
Authorization: Bearer <token>

Permission required: compliance:report

Query parameters

Parameter	Type	Default	Description
framework	string	Required	pctf, eidas, haip, nist, tdif, mosip, diatf
level	string	substantial	Target level: low, substantial, high

Response

{
  "framework": "pctf",
  "level": {
    "pctf": "Level 2",
    "eidas": "Substantial",
    "nist": "IAL2",
    "tdif": "IP2",
    "target": "substantial"
  },
  "components": [
    { "component": "Identity Assurance", "status": "pass", "details": "Target level: Level 2" },
    { "component": "DID Infrastructure", "status": "pass", "details": "At least one DID is configured" },
    { "component": "Credential Issuance", "status": "pass", "details": "Credentials have been issued" },
    { "component": "Audit Trail", "status": "pass", "details": "Hash-chained audit log is active" },
    { "component": "Bilingual Support", "status": "pass", "details": "EN/FR bilingual reports supported" },
    { "component": "Consent Management", "status": "pass", "details": "Consent record/revoke lifecycle available" }
  ],
  "overall_status": "compliant",
  "summary_en": "PCTF compliance report: 6/6 components pass at substantial assurance level.",
  "summary_fr": "Rapport de conformit\u00e9 PCTF : 6/6 composants r\u00e9ussis au niveau d'assurance substantial."
}

Supported frameworks

Framework	Key checks
PCTF (Canada)	Bilingual EN/FR, consent management
eIDAS (EU)	PID data model, HAIP compliance
HAIP	SD-JWT VC + mso_mdoc formats, ES256/EdDSA algorithms
NIST (US)	Assurance level mapping
TDIF (Australia)	Assurance level mapping
MOSIP (Africa/Asia)	Offline QR credential support
DIATF (UK)	Assurance level mapping

---

Record consent

Record a data-sharing consent.

POST /v1/compliance/consent
Authorization: Bearer <token>

Permission required: compliance:consent

Request body

Field	Type	Required	Description
subject	string	Yes	Data subject (DID or identifier)
recipient	string	Yes	Data recipient (DID or identifier)
purpose	string	Yes	Purpose of data sharing
elements	string[]	Yes	Data elements being shared
expires_at	string	No	ISO 8601 expiry timestamp

Response

{
  "id": "550e8400-...",
  "subject": "did:key:z6MkHolder",
  "recipient": "did:key:z6MkVerifier",
  "purpose": "age verification",
  "elements": ["dateOfBirth", "age_over_18"],
  "status": "active",
  "granted_at": "2026-03-26T12:00:00Z",
  "expires_at": null
}

---

List consents

GET /v1/compliance/consent?subject=did:key:z6Mk...&limit=50
Authorization: Bearer <token>

Permission required: compliance:consent

Query parameters

Parameter	Type	Default	Description
subject	string	—	Filter by data subject
limit	integer	50	Max results (1-100)
offset	integer	0	Pagination offset

---

Revoke consent

POST /v1/compliance/consent/:id/revoke
Authorization: Bearer <token>

Permission required: compliance:consent

Response

{ "status": "revoked", "consent_id": "550e8400-..." }

---

Query audit trail

Query the tamper-evident audit trail. Each entry is hash-chained to the previous one.

GET /v1/compliance/audit?limit=50&action=credential.issued
Authorization: Bearer <token>

Permission required: compliance:audit

Query parameters

Parameter	Type	Default	Description
action	string	—	Filter by action type
limit	integer	50	Max results (1-100)
offset	integer	0	Pagination offset

Audit actions

Action	Triggered when
user.registered	New user registration
credential.issued	Credential issued
credential.verified	Credential verified
credential.revoked	Credential revoked
did.created	DID created
did.deactivated	DID deactivated
consent.granted	Consent recorded
consent.revoked	Consent revoked
member.invited	Team invitation sent
member.removed	Team member removed
member.role_changed	Member’s role changed
api_key.created	API key created
api_key.revoked	API key revoked

---

Evaluate assurance level

Evaluate the assurance level based on evidence, with cross-framework mapping.

POST /v1/compliance/assurance
Authorization: Bearer <token>

Permission required: compliance:report

Request body

{
  "evidence": [
    { "evidence_type": "government_photo_id", "verification_method": "database_check" },
    { "evidence_type": "biometric", "verification_method": "biometric_match" }
  ]
}

Response

{
  "level": "Substantial",
  "pctf": "Level 2",
  "eidas": "Substantial",
  "nist": "IAL2",
  "tdif": "IP2",
  "evidence_count": 2,
  "upgrade_possible": true,
  "upgrade_hints": ["Add biometric verification", "Add in-person identity proofing"]
}

---

Validate HAIP profile

Check if credential parameters conform to the HAIP v1.0 profile.

POST /v1/compliance/haip/validate
Authorization: Bearer <token>

Permission required: compliance:report

Request body

Field	Type	Description
credential_format	string	dc+sd-jwt or mso_mdoc
algorithm	string	ES256, ES384, ES512, EdDSA
client_id_scheme	string	x509_san_dns, verifier_attestation, etc.
response_mode	string	direct_post

All fields are optional. Only provided fields are checked.

Response

{
  "profile": "HAIP v1.0",
  "checks": [
    { "check": "credential_format", "value": "dc+sd-jwt", "allowed": true },
    { "check": "algorithm", "value": "ES256", "allowed": true }
  ],
  "overall": "conformant"
}

---

See also

• Compliance Frameworks concept — all 7 frameworks explained
• Security Model concept — audit trail architecture
• Console: Compliance — dashboard guide