Compliance Checks
Manage compliance check definitions (Continuous product).
List compliance checks
Search checks. Filter by `severity` (CRITICAL/WARNING/INFO), `source` (NATIVE/EXTERNAL/OHO_STANDARD), `enabled` (boolean), or free-text `query` across displayName + description. Soft-deleted entries are excluded by default.
Create compliance check
Create a new compliance check. The `id` field in the body is the entity ID — it must match `^[a-z0-9][a-z0-9_-]{0,63}$` and be unique. Returns 409 if the id is taken.
Re-evaluate a compliance check now
Synchronously runs this check against its in-scope workers, persists the `metadataTestEvaluationResult` aspect and per-worker run events, and returns the fresh summary. Evaluation is offloaded to a bounded worker pool and scales linearly with scope size; if it exceeds the server's synchronous budget the request returns 503 — use the async job endpoint (`POST /evaluate/jobs`) for large scopes.
Enable a compliance check
Sets `enabled` = true — check participates in evaluation runs.
Disable a compliance check
Sets `enabled` = false — check is skipped on the next evaluation run. Existing evaluation results stay visible for historical reporting.
Bulk re-evaluate compliance checks
Synchronously re-evaluates a set of checks in one pass. With no filters supplied, runs every enabled check. Provide `ids` to limit to specific checks, or `severity` (CRITICAL / WARNING / INFO) to limit by severity. The two filters AND when both are supplied. Returns a fresh summary per evaluated check. Work is offloaded to a bounded worker pool; if it exceeds the server's synchronous budget the request returns 503 — for large tenants or unfiltered runs, prefer the async job endpoint (`POST /evaluate/jobs`).
Submit an async bulk evaluation job
Non-blocking alternative to `POST /evaluate` for large tenants. Accepts the same `ids` / `severity` filters (no body = every enabled check), validates and authorizes the targets synchronously, then returns 202 with a `jobId` and a `Location` header. Poll `GET /evaluate/jobs/{jobId}` for status and results. Returns 503 (with `Retry-After`) if the evaluation backlog is full.
Get compliance check
Fetch a single check by id.
Soft delete compliance check
Marks the check as removed. Stops contributing to evaluations on the next run. Existing evaluation history is preserved.
Partially update compliance check
Apply a partial update. The path id is the entity ID; any `id` field in the body is rejected if it does not match the path.
List evaluation run history
Returns timeseries `metadataTestRunEvent` records — one entry per worker per evaluation run, with PASS / FAIL / ERROR / SKIPPED outcome, optional per-condition breakdown, and any actions applied. Newest first. Use `startTimeMillis` and `endTimeMillis` to bound the range; default cap is the last 1000 runs.
Get latest evaluation summary
Returns the most recent `metadataTestEvaluationResult` aspect — pass / fail / error counts, evaluation timestamp, and the URNs of failing workers. Returns an empty summary if the check has never been evaluated.
List failing workers
Paginated list of workers currently failing this check, hydrated from the latest evaluation summary. Returns an empty page if the check has never been evaluated or has no failures.
Get async evaluation job status
Returns the status of an async bulk evaluation job — PENDING / RUNNING / SUCCEEDED / FAILED — plus the per-check summaries once complete. Jobs are only visible to the actor that submitted them; unknown or foreign job ids return 404.
Condition catalogue
Static catalogue describing the fields and operators supported when authoring a compliance check rule tree. Use this to drive form UIs, validate payloads, and build language bindings without scraping the PDL.