Skip to main content
Use the REST API to work with the compliance data shown in Governance, including frameworks, requirements, rule results, and evidence. You can use this data in audit reports, internal dashboards, or governance, risk, and compliance tools, and you can create and activate frameworks programmatically.

​
Authentication

Authenticate each request with a workspace API key:
See Find your API key if you don’t have one. Governance list endpoints use a workspace ID. Each project returned by List projects includes its workspaceId.

​
Pull your compliance state

1

List your frameworks

Start with the frameworks in your workspace. Pass enabled=true to return only active frameworks.
Each framework includes an id that you use in subsequent requests. Its projectSelector identifies the projects it covers.See List frameworks.
2

Read workspace statistics

Retrieve a compliance roll-up instead of counting rule results yourself. Add frameworkId to limit the response to one framework or projectId to limit it to one project.
See Retrieve workspace compliance statistics.
3

Break down compliance by project

Retrieve one row per project for a framework. The example sorts projects by the number of failing rule results.
See List a framework’s per-project compliance.
4

Retrieve individual requirements

A rule is one requirement. A rule result is that requirement’s status for a project, or for the workspace when projectId is null.List rule results and filter them by framework, project, rule, or status:
A result’s status is running, passing, failing, skipped, error, pending, or due_soon. Its statusMessage provides a human-readable explanation, and its ruleId identifies the associated rule.You can also list rules with their results included:
See List rule results and List rules.
5

Include framework document text

A framework document contains the source standard’s text, sections, subsections, and mapped rules. List the documents first, then retrieve the document you need:
To retrieve the rules and statuses for a specific part of the document, use its section or subsection endpoint with includeResults=true.See Retrieve a framework document, List a section’s rules, and List a subsection’s rules.
6

Collect supporting evidence

For an evidence-based rule, retrieve the evidence attached to its rule result:
The evidence uses storageUri for an uploaded document, text for a written statement, or url for a link, according to the rule’s evidenceType.See List a rule result’s evidence.

​
Create and activate a framework

Openlayer ships with built-in frameworks such as the EU AI Act and ISO/IEC 42001, and you can add your own. Both are managed through the API.
1

Create a custom framework

Create a framework to track compliance against an internal policy, or against a standard Openlayer does not ship as a built-in framework. Only name is required:
The response is the new framework, including the id you use in subsequent requests. A new framework has no rules — add them from the Openlayer app.Use projectSelector to scope the framework to a subset of projects. An empty or omitted selector applies it to every project in the workspace:
See Create a framework.
2

Activate or deactivate a framework

A framework only counts towards compliance while it is enabled. Rules of a disabled framework are not evaluated. Activate one — built-in or custom — by setting enabled:
Only the fields you send are changed. You can also update tags, projectSelector, name, avatar, href, and extendedDescription.
Frameworks that ship with Openlayer report immutable: true. For those, only enabled, tags, and projectSelector can be changed — their name and definition are managed by Openlayer.
See Update a framework.

​
Manage rules and evidence

A rule is one requirement. A rule result is that requirement’s status for a project, or for the workspace when projectId is null.
1

Create a rule

A rule’s type decides how it is satisfied, and the two types accept different fields.An evidence rule is satisfied by attaching evidence. Set evidenceType to the kind of evidence that satisfies it, and optionally renewalCadenceDays to require periodic renewal:
A platform rule is evaluated automatically from the state of your workspace. Set automationType to the signal to check. Its scope must be project, and evidenceType and renewalCadenceDays must be omitted:
name, scope, and type are required. A new rule belongs to no framework — map it to one from the Openlayer app.See Create a rule.
2

Update or delete a rule

Only the fields you send are changed. A rule’s scope, type, evidenceType, and automation are fixed once it exists.
Deleting a rule also deletes its rule results:
Rules that ship with Openlayer report immutable: true and can be neither edited nor deleted. To exclude one from compliance, set deactivated on its rule result instead.
See Update a rule and Delete a rule.
3

Assign or exclude a rule result

Assign an owner, or exclude a single result from compliance without deactivating the rule everywhere. deactivatedReason is required when deactivating:
A result’s status is computed by Openlayer and cannot be set directly.See Update a rule result.
4

Attach evidence

Send the field that matches the rule’s evidenceType: text for a written statement, url for a link, or storageUri for an uploaded document.
For a document, upload the file first with Create a presigned URL and send the resulting storage URI as storageUri.Attaching evidence re-evaluates the rule result. If the rule sets renewalCadenceDays, the renewal window restarts from this evidence.See Attach evidence to a rule result.

​
Export an audit-ready archive

You can export a framework’s evidence and progress as a zip archive. The archive contains uploaded evidence files, a Markdown progress report, and CSV manifests of rules and evidence with SHA-256 checksums.
1

Queue the export

To export the workspace-wide view across every project in the framework, omit the request body:
To export one project, include its projectId:
The API returns 202 with the path and ID of the background task:
Export requests are limited to two per minute for each framework. If an identical export is already queued, the API returns that task instead of starting another one.See Export a framework.
2

Wait for the archive

Poll the background task using taskResultId:
Continue until complete is true. If error is not null, it explains why the task failed. A completed export returns outputs.storageUri and also includes filename, controlCount, evidenceCount, and missingEvidenceCount.See Retrieve a background task.
3

Download the archive

Exchange outputs.storageUri for a short-lived download URL. Use URL encoding because a storage URI contains reserved characters:
The response contains a url. Download it promptly:
See Retrieve a download URL.

​
Pagination

List endpoints accept page and perPage, with up to 100 items per page. Request successive pages until a response contains fewer items than perPage.
Mapping a rule to a framework, and editing a framework’s document text, are not yet part of the public API — do those in the Openlayer app. See Set up a framework.