> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cybedefend.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Get compliance result for a scan

> Returns the compliance result from the most recent policy evaluation for this scan.



## OpenAPI

````yaml get /projects/{projectId}/scans/{scanId}/compliance
openapi: 3.0.0
info:
  title: Cybedefend API
  description: >-
    CybeDefend is an advanced API for application security analysis. Key
    features include OAuth 2.0 authentication, user/organization/project
    management, and REBAC-based permissions. It excels in static, dynamic, and
    IaC security analyses (SAST, DAST, IaC, etc.).
  version: '1.0'
  contact: {}
servers:
  - url: https://api-eu.cybedefend.com
    description: EU
  - url: https://api-us.cybedefend.com
    description: US
security: []
tags: []
paths:
  /projects/{projectId}/scans/{scanId}/compliance:
    get:
      tags:
        - Policy
      summary: Get compliance result for a scan
      description: >-
        Returns the compliance result from the most recent policy evaluation for
        this scan.
      operationId: PolicyController_getComplianceResult
      parameters:
        - name: projectId
          required: true
          in: path
          schema:
            format: uuid
            type: string
        - name: scanId
          required: true
          in: path
          schema:
            format: uuid
            type: string
        - name: evaluationId
          required: false
          in: query
          description: Specific evaluation ID (optional)
          schema:
            type: string
      responses:
        '200':
          description: Compliance result
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ComplianceResultResponseDto'
      security:
        - bearer: []
components:
  schemas:
    ComplianceResultResponseDto:
      type: object
      properties:
        evaluationId:
          type: string
          description: Evaluation ID (may not be available)
          example: 550e8400-e29b-41d4-a716-446655440000
        scanId:
          type: string
          description: Scan ID that was evaluated
          example: 550e8400-e29b-41d4-a716-446655440001
        projectId:
          type: string
          description: Project ID
          example: 550e8400-e29b-41d4-a716-446655440002
        status:
          type: string
          description: Evaluation status
          enum:
            - PENDING
            - IN_PROGRESS
            - COMPLETED
            - FAILED
            - NOT_STARTED
          example: COMPLETED
        result:
          description: Compliance result (only present when completed)
          allOf:
            - $ref: '#/components/schemas/ComplianceResultDto'
        violations:
          description: Violations found during evaluation
          type: array
          items:
            $ref: '#/components/schemas/ViolationDto'
        error:
          type: string
          description: Error message if evaluation failed
      required:
        - scanId
        - projectId
        - status
    ComplianceResultDto:
      type: object
      properties:
        compliant:
          type: boolean
          description: Whether the scan is compliant with all policies
          example: false
        exitCode:
          type: number
          description: Exit code for CI/CD (0=pass, 1=fail)
          example: 1
        summary:
          type: string
          description: Human-readable summary
          example: 'Policy check failed: 2 critical violations found.'
        blockingViolationsCount:
          type: number
          description: Number of blocking violations
          example: 2
        warningViolationsCount:
          type: number
          description: Number of warning violations
          example: 5
        totalViolationsCount:
          type: number
          description: Total violations count
          example: 7
        evaluatedAt:
          type: string
          description: When the evaluation was completed
          example: '2024-01-15T10:31:00Z'
        evaluatedPoliciesCount:
          type: number
          description: Number of policies that were evaluated
          example: 3
        breakingRulesCount:
          type: number
          description: Number of unique rules broken
          example: 2
      required:
        - compliant
        - blockingViolationsCount
        - warningViolationsCount
        - totalViolationsCount
        - evaluatedAt
        - breakingRulesCount
    ViolationDto:
      type: object
      properties:
        id:
          type: string
          description: Violation ID
          example: 550e8400-e29b-41d4-a716-446655440000
        policyId:
          type: string
          description: Policy ID
          example: 550e8400-e29b-41d4-a716-446655440001
        projectId:
          type: string
          description: Project ID
          example: 550e8400-e29b-41d4-a716-446655440002
        scanId:
          type: string
          description: Scan ID
          example: 550e8400-e29b-41d4-a716-446655440003
        organizationId:
          type: string
          description: Organization ID
          example: 550e8400-e29b-41d4-a716-446655440004
        actionTaken:
          type: string
          description: Action taken (WARN or BLOCK)
          enum:
            - WARN
            - BLOCK
          example: BLOCK
        affectedVulnerabilitiesCount:
          type: number
          description: Number of vulnerabilities affected by this violation
          example: 12
        rule:
          description: The rule that was violated
          allOf:
            - $ref: '#/components/schemas/PolicyRuleResponseDto'
        affectedVulnerabilities:
          description: List of affected vulnerabilities
          type: array
          items:
            $ref: '#/components/schemas/AffectedVulnerabilityDto'
        createdAt:
          type: string
          description: Creation timestamp (ISO 8601)
          example: '2024-01-15T10:30:00Z'
        updatedAt:
          type: string
          description: Last update timestamp (ISO 8601)
          example: '2024-01-15T10:30:00Z'
      required:
        - id
        - policyId
        - projectId
        - scanId
        - organizationId
        - actionTaken
        - affectedVulnerabilitiesCount
        - rule
        - createdAt
        - updatedAt
    PolicyRuleResponseDto:
      type: object
      properties:
        id:
          type: string
          description: Rule ID
        name:
          type: string
          description: Rule name
        description:
          type: string
          description: Rule description
        type:
          type: string
          description: Rule type
        value:
          type: object
          description: Rule value (for non-composite rules)
        action:
          type: string
          description: Action taken (WARN or BLOCK)
        operator:
          type: string
          description: Operator (for non-composite rules)
        criteria:
          description: Child rule criteria (for composite_and / composite_or rules)
          type: array
          items:
            $ref: '#/components/schemas/RuleCriterionDto'
      required:
        - id
        - name
        - type
        - action
    AffectedVulnerabilityDto:
      type: object
      properties:
        id:
          type: string
          description: Vulnerability ID
        name:
          type: string
          description: Vulnerability name/title
        severity:
          type: string
          description: Severity level (CRITICAL, HIGH, MEDIUM, LOW, INFORMATIONAL)
        cvssScore:
          type: number
          description: CVSS score (0-10)
        cwe:
          description: CWE identifiers
          type: array
          items:
            type: string
        owaspTop10:
          description: OWASP Top 10 categories
          type: array
          items:
            type: string
        filePath:
          type: string
          description: File path where vulnerability was found
        startLine:
          type: number
          description: Start line number
        endLine:
          type: number
          description: End line number
        vulnerabilityType:
          type: string
          description: Vulnerability type (sast, iac, sca, secret, cicd, container)
        branch:
          type: string
          description: Branch where vulnerability was found
        packageName:
          type: string
          description: Package name (for SCA vulnerabilities)
        packageVersion:
          type: string
          description: Package version (for SCA vulnerabilities)
        artifactName:
          type: string
          description: Artifact name (for Container vulnerabilities)
      required:
        - id
        - name
        - severity
        - vulnerabilityType
    RuleCriterionDto:
      type: object
      properties:
        id:
          type: string
          description: Child rule ID
        name:
          type: string
          description: Child rule name
        description:
          type: string
          description: Child rule description
        type:
          type: string
          description: >-
            Child rule type (severity, cvss_score, cwe, vulnerability_age_days,
            etc.)
        value:
          type: object
          description: Rule value (severity level, cvss threshold, etc.)
        operator:
          type: string
          description: Operator (equals, gte, lte, contains, etc.)
      required:
        - id
        - name
        - type
  securitySchemes:
    bearer:
      scheme: bearer
      bearerFormat: JWT
      type: http
      description: JWT access token.

````