Create Compliance Check

Run an automated compliance check against a regulation for an entity

Executes an automated compliance assessment for a specific entity (agent, model, dataset, or workflow) against a supported regulation. The check evaluates the entity’s configuration, access patterns, data handling, and audit trail against the regulation’s requirements and produces a compliance determination with detailed findings.

Compliance checks are idempotent for the same entity-regulation pair within a 24-hour window. Repeated calls within that window return the cached result.

Authentication

Requires X-API-Key header or Bearer JWT token. Tenant-scoped via X-Tenant-ID.

Request Body

entity_type · string · required

The type of entity to assess. One of: - agent — a registered machine agent

• model — an AI/ML model - dataset — a data asset or training dataset - workflow — an automated workflow or pipeline

entity_id · string · required

The unique identifier of the entity to assess. Must exist within the tenant.

regulation · string · required

The regulation or framework to assess against. Supported values: - SOC2 — SOC 2 Type II controls - ISO27001 — ISO 27001 information security management - GDPR — EU General Data Protection Regulation - HIPAA — US Health Insurance Portability and Accountability Act - EU_AI_ACT — EU Artificial Intelligence Act

scope · string

Optional scope qualifier to narrow the assessment. For example, access-control to assess only access-control-related controls, or data-handling for data processing controls. If omitted, a full-scope assessment is performed.

Response

id · string

Unique identifier for the compliance check record. Format: maip-cc:ULID.

entity_type · string

The type of entity that was assessed.

entity_id · string

The identifier of the assessed entity.

regulation · string

The regulation that was assessed.

scope · string

The scope of the assessment. full if no scope was specified.

status · string

The compliance determination. One of: - compliant — entity meets all assessed requirements - non_compliant — entity fails one or more critical requirements - partial — entity meets some but not all requirements

findings · object[]

Detailed list of individual findings from the assessment.

Show Finding fields

findings[].control_id · string

The control identifier within the regulation (e.g., CC6.1 for SOC2, A.9.1.1 for ISO27001).

findings[].control_name · string

Human-readable name of the control.

findings[].status · string

Status of this specific control: pass, fail, partial, not_applicable.

findings[].severity · string

Severity of the finding if not passing: critical, high, medium, low.

findings[].description · string

Detailed description of the finding and remediation guidance.

receipt_id · string

The MAIP receipt minted for this compliance check, providing an immutable audit record.

checked_at · string

ISO 8601 timestamp of when the assessment was performed.

Supported Regulations

Regulation	Controls Assessed	Typical Duration
SOC2	Trust Service Criteria (CC1-CC9)	2-5 seconds
ISO27001	Annex A controls (A.5-A.18)	2-5 seconds
GDPR	Articles 5, 6, 12-22, 25, 32-34	3-8 seconds
HIPAA	Administrative, Physical, Technical Safeguards	3-8 seconds
EU_AI_ACT	Risk classification, transparency, human oversight	5-10 seconds