Docs

The REST surface for the Compliance Yoke — frameworks, readiness, connectors, simulator, evidence, engagements, OSCAL export, ZIP package, Trust Center, AI Q&A.

API reference

Every endpoint is tenant-scoped. The platform derives the tenant_id from the JWT; you never pass it in the body or in a path segment.

Auth and gating

  • Auth: tenant JWT in the Authorization: Bearer … header.
  • Gating: every endpoint returns 402 Payment Required unless the tenant holds either fastyoke.compliance (paid) or fastyoke.compliance-demo (free demo). The body of the 402 carries a machine-readable error code and the listing slug:
{
  "error": "compliance_not_entitled",
  "listing_id": "fastyoke.compliance"
}

Frameworks & readiness

MethodPathPurpose
GET/api/v1/tenant/compliance/frameworksList frameworks available on this tenant.
GET/api/v1/tenant/compliance/readinessPer-framework readiness, broken down by category score.

Connectors

MethodPathPurpose
GET/api/v1/tenant/compliance/connectorsList configured connectors and their status.
POST/api/v1/tenant/compliance/connectors/githubConnect or update GitHub.
POST/api/v1/tenant/compliance/connectors/flyConnect or update Fly.
POST/api/v1/tenant/compliance/connectors/workosConnect or update WorkOS.
POST/api/v1/tenant/compliance/connectors/awsConnect or update AWS.
POST/api/v1/tenant/compliance/runFire an ad-hoc run; writes to the same results store the scheduler uses.
GET/api/v1/tenant/compliance/resultsConsolidated results across every connector.

Controls simulator

MethodPathPurpose
GET/api/v1/tenant/compliance/simulationCurrent simulation state.
POST/api/v1/tenant/compliance/simulation/startBegin a new simulation against a framework.
POST/api/v1/tenant/compliance/simulation/advanceStep the simulator forward.

The simulator never writes to real readiness or evidence; it is a read-only modeling surface.

Evidence vault

MethodPathPurpose
GET/api/v1/tenant/compliance/evidenceList evidence.
POST/api/v1/tenant/compliance/evidenceUpload a new piece of evidence.
POST/api/v1/tenant/compliance/evidence/:id/attestAttest to evidence — irrevocable.

Audit engagements

MethodPathPurpose
GET/api/v1/tenant/compliance/audit/engagementsList engagements.
POST/api/v1/tenant/compliance/audit/engagementsCreate an engagement.
GET/api/v1/tenant/compliance/audit/engagements/:idEngagement detail.
POST/api/v1/tenant/compliance/audit/engagements/:id/statusTransition status (draft → in_progress → submitted → closed).
GET/api/v1/tenant/compliance/audit/engagements/:id/export.oscalNIST OSCAL JSON.
GET/api/v1/tenant/compliance/audit/engagements/:id/package.zipZIP of OSCAL + sampled evidence + cover sheet.

Trust Center

MethodPathPurpose
GET/api/v1/tenant/compliance/trust-centerRead the Trust Center config.
PUT/api/v1/tenant/compliance/trust-centerUpdate the Trust Center config (slug, allowlisted controls, AI toggle).

AI Q&A

MethodPathPurpose
POST/api/v1/tenant/compliance/ai/answerAnswer a natural-language question grounded in the published posture only.

The AI endpoint returns 404 when the per-tenant AI toggle is off.

See also

  • Overview — what the surface is and who installs it.
  • Auditor Room — what OSCAL and ZIP actually contain.
  • Trust Center — the allowlist model around the public surface.