Skip to content

Compliance Evidence API

Zotniq Preflight writes runtime evidence — every rule fired, every leak blocked, every masked payload — and rolls it up per control per framework so it can be consumed as an audit artifact. The endpoints below expose that rollup as REST + downloadable CSV / JSON / PDF / ZIP.

Typical consumers:

  • Vanta / Drata / Secureframe / Sprinto / Hyperproof / OneTrust / AuditBoard — pull the JSON on a schedule and attach it to the matching framework controls in their evidence room.
  • In-house auditors — download the PDF or the ZIP evidence pack for their quarter-end evidence bundle.
  • Custom internal dashboards — call /evidence directly.

The endpoints are org-scoped and read-only.

Auth

All endpoints require a valid session cookie (dashboard use) or an X-Aegis-API-Key header (partner / automation use).

Partner-scoped API keys are minted from the Zotniq dashboard under Settings → Compliance Partner API Keys (available in the Partner API Tokens release — see Changelog). Compliance partner keys are read-only and constrained to the /compliance/* surface.

export AEGIS_ORG_ID=org_abc123
export AEGIS_API_KEY=aegis_ptak_...

curl -H "X-Aegis-API-Key: ${AEGIS_API_KEY}" \
  "https://api.aegispreflight.com/api/orgs/${AEGIS_ORG_ID}/compliance/frameworks"

Endpoints

GET /api/orgs/{org_id}/compliance/frameworks

List every framework in the Zotniq control catalog with a flag for which ones the org has opted into.

{
  "frameworks": [
    {
      "framework": "SOC2",
      "display_name": "SOC 2",
      "enabled": true,
      "enabled_at": "2026-06-17T12:01:27.902359+00:00",
      "control_count": 11
    },
    {
      "framework": "GDPR",
      "display_name": "GDPR",
      "enabled": false,
      "enabled_at": null,
      "control_count": 3
    }
  ]
}

GET /api/orgs/{org_id}/compliance/evidence

Per-control coverage + evidence rollup for one framework.

Query parameters:

Name Type Default Description
framework string, required — SOC2, GDPR, HIPAA, PCI_DSS, ISO27001
days integer, optional 30 Window for evidence rollup (1–180)

Response:

{
  "framework": "SOC2",
  "display_name": "SOC 2",
  "window_days": 30,
  "controls": [
    {
      "control_id": "CC6.1",
      "title": "Logical Access Controls",
      "description": "...",
      "covered_by": "Per-org isolation, RBAC, ...",
      "default_owner_role": "Security Officer",
      "status": "covered",
      "rule_count": 2,
      "tagged_rules": [
        {
          "owner_kind": "team",
          "owner_id": "team_bc402cce66cd",
          "owner_name": "Engineering",
          "rule_id": "rule_31c6119424de4706",
          "policy_id": null,
          "policy_name": null
        }
      ],
      "evidence_event_count": 103,
      "evidence_blocked": 2,
      "evidence_masked": 101,
      "last_evidence_at": "2026-06-12T08:52:23.512257+00:00"
    }
  ],
  "summary": {
    "total_controls": 11,
    "covered_controls": 5,
    "uncovered_controls": 6,
    "coverage_pct": 45,
    "total_evidence_events": 238
  }
}

Control status:

  • covered — at least one enabled tagged rule
  • uncovered — no tagged rules or all tagged rules disabled

Tagged rule owner_kind:

  • team — rule owned by a team, tagged via Teams > Rules. owner_id is the team ID; owner_name is the team display name.
  • policy — legacy per-policy tag. policy_id and policy_name are populated for backward compat. This path will be retired once the team_rule_tags migration completes.

GET /api/orgs/{org_id}/compliance/export

Download one framework's evidence as CSV, JSON, or PDF.

Query parameters:

Name Type Default Description
framework string, required — Same values as /evidence
format string, required — csv | json | pdf
days integer, optional 30 1–180

Response is a file download with Content-Disposition: attachment and Cache-Control: no-store. Filename shape: evidence-{org_slug}-{yyyy-mm-dd}-{framework}.{ext}.

CSV columns (one row per catalog control):

framework, control_id, title, status, rule_count, evidence_events,
evidence_blocked, evidence_masked, last_evidence_at, tagged_by

tagged_by is a ;-joined summary like Team: Engineering; Team: Demo.

GET /api/orgs/{org_id}/compliance/export/all

Download a ZIP evidence pack covering every framework the org tracks (opt-ins + auto-discovered via team tags). If neither exists, the pack falls back to every framework in the catalog — better to hand a CRO too much than an empty ZIP.

Query parameters:

Name Type Default Description
days integer, optional 30 1–180

Response layout inside the ZIP:

evidence-{org_slug}-{yyyy-mm-dd}.zip
├── manifest.json                — index + generation metadata
├── SOC2/
│   ├── evidence.csv
│   ├── evidence.json
│   └── evidence.pdf
├── GDPR/
│   └── ...
└── summary.pdf                  — one-page pack cover

Rate limits

Read endpoints (frameworks, evidence, export) are unlimited within the normal dashboard rate ceiling. export/all bundles every framework in one request — one call every ~5 minutes is fine, one call every second is not. Cache the JSON on your side and only re-fetch when your evidence snapshot cadence requires it.

Uploading evidence into Vanta / Drata

Both platforms support a manual evidence upload flow that accepts CSV / PDF / ZIP:

  • Vanta — Evidence Library → Add evidence → Custom control → attach the PDF or CSV.
  • Drata — Evidence Library → New evidence → drop the ZIP.

For automated pulls, both offer webhook-style ingestion — point them at /compliance/evidence?framework={framework} with a compliance partner API key. The JSON response shape is stable across releases; we won't remove fields without a major version bump.

Changelog

  • 2026-07-02 — endpoints released as public API. Both legacy policy_rule_compliance_tags and new team_rule_tags are unioned under tagged_rules[]. The legacy path will be retired in a future release once the migration completes; JSON consumers should prefer owner_kind + owner_id over policy_id.