> ## Documentation Index > Fetch the complete documentation index at: https://mintlify.hoop.dev/docs/llms.txt > Use this file to discover all available pages before exploring further. # Get Compliance Report > Computes the compliance report with an overall score, category summaries, actionable items and per-framework control evaluations. ## OpenAPI ````yaml https://use.hoop.dev/api/openapiv3.json get /reports/compliance openapi: 3.0.3 info: contact: email: help@hoop.dev name: Help url: https://help.hoop.dev description: >- Hoop.dev is an access gateway for databases and servers with an API for packet manipulation license: name: MIT url: https://opensource.org/license/mit termsOfService: https://hoop.dev/docs/legal/tos title: Hoop Api version: 1.160.1 servers: - url: https://use.hoop.dev/api security: [] tags: - description: > Hoop implements Oauth2 and OIDC protocol to authenticate users in the system. To obtain a valid access token users need to authenticate in their own identity provider which is generated as a JSON response to the endpoint `http(s)://use.hoop.dev/api/login`. The identity provider them redirects the user to the callback endpoint containing the access token. The recommended approach of obtaining an access token is by visiting the Webapp main's page or using the **Hoop command line**. Example: ```sh hoop config create --api-url https://use.hoop.dev # save the token after authenticating at $HOME/.hoop/config.toml hoop login # show token information hoop config view --raw ``` With an access token you could use any HTTP client to interact with the documented endpoints. The token must be sent through the `Authorization` header. Example: ```sh # obtain the current configuration of the server curl https://use.hoop.dev/api/serverinfo -H "Authorization: Bearer $ACCESS_TOKEN" ``` name: Authentication - description: > Users are active and assigned to the default organization when they signup. A user could be set to an inactive state preventing it from accessing the platform, however it’s recommended to manage the state of users in the identity provider. - The `sub` claim is used as the main identifier of the user in the platform. - The profile of the user is derived from the id_token claims `email` and `name`. When a user authenticates for the first time, it performs an automatic signup that persist the profile claims along with it’s unique identifier. ​ ### Groups Groups allows defining who may access or interact with certain resources. - For connection resources it’s possible to define which groups has access to a specific connection, this is enforced when the Access Control feature is enabled. - For review resources, it’s possible to define which groups are allowed to approve an execution, this is enforced when the Review feature is enabled. > This resource could be managed manually via Webapp or propagated by the identity provider via ID Token. In this mode, groups are sync when a user performs a login. ### Roles - The `admin` group is a special role that grants full access to all resources This role should be granted to users that are responsible for managing the Gateway. All other users are regular, meaning that they can access their own resources and interact with connections. name: User Management - name: Machine Identities - description: Routes used to manage and obtain information about the runtime server. name: Server Management - description: Features available in the gateway. See also **Plugin** resources. name: Features - description: >- Proxy manager endpoints controls how clients connect via gRPC in the gateway. These endpoints are meant to be used when a client is initialized via `hoop proxy-manager`. name: Proxy Manager - name: Connections - name: Agents - name: Sidecars - name: Runbooks - name: Guard Rails - name: Reviews - name: Sessions - name: Organization Management - name: Reports - description: > Security audit log API. Only users in the **admin** group can access these endpoints. Audit log entries record security-relevant events (who performed an action, when, on which resource, and whether it succeeded). Use the list endpoint with filters to query by actor, resource type, action, outcome, or date range. Results are paginated and ordered by `created_at` descending. name: Audit Logs paths: /reports/compliance: get: tags: - Reports summary: Get Compliance Report description: >- Computes the compliance report with an overall score, category summaries, actionable items and per-framework control evaluations. responses: '200': content: application/json: schema: $ref: '#/components/schemas/openapi.ComplianceReport' description: OK '500': content: application/json: schema: $ref: '#/components/schemas/openapi.HTTPError' description: Internal Server Error components: schemas: openapi.ComplianceReport: properties: action_required: description: >- ActionRequired lists actionable checks with warning or non_compliant status items: $ref: '#/components/schemas/openapi.ComplianceCheckResult' type: array categories: description: Categories summarize the checks by security domain items: $ref: '#/components/schemas/openapi.ComplianceCategorySummary' type: array frameworks: description: Frameworks are the per-framework control evaluations items: $ref: '#/components/schemas/openapi.ComplianceFramework' type: array generated_at: description: GeneratedAt is the UTC timestamp when the report was computed type: string overall: allOf: - $ref: '#/components/schemas/openapi.ComplianceOverall' description: Overall is the aggregated compliance score type: object openapi.HTTPError: properties: message: example: the error description type: string type: object openapi.ComplianceCheckResult: properties: action: allOf: - $ref: '#/components/schemas/openapi.ComplianceControlAction' description: Action is the remediation action for this check, when one exists category: description: Category groups checks by security domain enum: - identity - access_control - data_protection - audit_trail - monitoring_response - infrastructure type: string evidence: description: Evidence is the data supporting the evaluated status example: 'Authentication method: OIDC' type: string id: description: ID is the stable evaluator id of the check example: sso_enabled type: string message: description: Message describes the evaluated result example: SSO is enabled via OIDC provider type: string status: allOf: - $ref: '#/components/schemas/openapi.ComplianceStatusType' description: Status is the evaluated compliance status title: description: Title is the human readable name of the check example: Single Sign-On Enabled type: string type: object openapi.ComplianceCategorySummary: properties: compliant: description: Compliant is the number of compliant checks in this category type: integer id: description: ID is the category identifier example: identity type: string title: description: Title is the category display name example: Identity type: string total: description: >- Total is the number of applicable checks (excludes not_applicable, unable_to_verify and informational) type: integer type: object openapi.ComplianceFramework: properties: breakdown: allOf: - $ref: '#/components/schemas/openapi.ComplianceStatusBreakdown' description: Breakdown counts controls by status compliant: description: Compliant is the number of compliant controls type: integer groups: description: Groups are the framework control groups items: $ref: '#/components/schemas/openapi.ComplianceControlGroup' type: array id: description: ID is the framework identifier enum: - soc2 - gdpr - pci_dss - hipaa - best_practices type: string level: description: >- Level classifies the score: low (0-39), moderate (40-69), strong (70-100) enum: - low - moderate - strong type: string name: description: Name is the framework display name example: SOC 2 Type II type: string score_percent: description: ScorePercent is the weighted compliance score in the 0-100 range example: 85 type: integer total_applicable: description: >- TotalApplicable is the number of controls excluding not_applicable, unable_to_verify and informational type: integer type: object openapi.ComplianceOverall: properties: compliant: description: >- Compliant is the number of compliant control rows across all frameworks type: integer level: description: >- Level classifies the score: low (0-499), moderate (500-749), strong (750-1000) enum: - low - moderate - strong type: string score: description: Score is the weighted compliance score in the 0-1000 range example: 812 type: integer total_applicable: description: >- TotalApplicable is the number of control rows excluding not_applicable, unable_to_verify and informational type: integer type: object openapi.ComplianceControlAction: properties: label: description: Label is the display text of the action example: Go to Resources ↗ type: string target: description: Target is the in-app route or docs path; empty for external actions example: /resources type: string type: description: Type classifies the action target enum: - app - docs - external type: string type: object openapi.ComplianceStatusType: enum: - compliant - warning - non_compliant - not_applicable - unable_to_verify - idp_dependent - informational type: string x-enum-varnames: - ComplianceStatusCompliant - ComplianceStatusWarning - ComplianceStatusNonCompliant - ComplianceStatusNotApplicable - ComplianceStatusUnableToVerify - ComplianceStatusIdpDependent - ComplianceStatusInformational openapi.ComplianceStatusBreakdown: properties: compliant: type: integer idp_dependent: type: integer informational: type: integer non_compliant: type: integer not_applicable: type: integer unable_to_verify: type: integer warning: type: integer type: object openapi.ComplianceControlGroup: properties: controls: description: Controls are the evaluated controls of this group items: $ref: '#/components/schemas/openapi.ComplianceControl' type: array id: description: ID is the control group identifier example: CC6 type: string title: description: Title is the control group name example: Logical and Physical Access Controls type: string type: object openapi.ComplianceControl: properties: action: allOf: - $ref: '#/components/schemas/openapi.ComplianceControlAction' description: Action is the remediation action for this control, when one exists category: description: Category groups the control by security domain type: string check_id: description: CheckID references the check that evaluates this control example: sso_enabled type: string description: description: Description explains how the product satisfies the control type: string evidence: description: Evidence is the data supporting the evaluated status type: string id: description: ID is the framework control identifier example: CC6.1 type: string message: description: Message describes the evaluated result type: string status: allOf: - $ref: '#/components/schemas/openapi.ComplianceStatusType' description: Status is the evaluated compliance status title: description: Title is the control name type: string type: object ````