---
title: "Request a compliance report"
method: POST
path: "/api/v1/compliance/reports"
tags: ["Compliance"]
---

# Request a compliance report

`POST /api/v1/compliance/reports`

## Request

- Base URL: `https://orchestrator.getaxonflow.com`
- URL: `https://orchestrator.getaxonflow.com/api/v1/compliance/reports`
- Auth: none declared
- TypeScript: <https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/docs/api/v1/compliance/reports/post.ts> (a function with typed inputs; its response is checked against the schema)

Queue an asynchronous compliance report for a regulator and period. The
job is returned immediately with `status` and `progress`; poll
`GET /api/v1/compliance/reports/{id}` and then follow
`GET /api/v1/compliance/reports/{id}/download`.

The request body is decoded with unknown fields REJECTED and a 32 KiB
limit. `period_start` and `period_end` are RFC 3339.

This route is additionally gated by the tenant-wide audit export check,
which refuses a caller without an admin or owner role with a 403 in the
FLAT envelope rather than this module's own.

## Request body

- object
  - `regulator` string, required
  - `framework` string
  - `period_start` string, date-time, required
  - `period_end` string, date-time, required
  - `format` string, required

## Response `202`

Report job accepted

- ComplianceReportJob: An asynchronous compliance-report job. `org_id`, `tenant_id` and `storage_key` are deliberately NOT on the wire (json:"-" in the platform type); the tenancy is the caller's own and the storage key is internal.
  - `id` string
  - `regulator` string
  - `framework` string
  - `format` string
  - `period_start` string, date-time
  - `period_end` string, date-time
  - `status` string
  - `report_state` '' | 'not_available' | 'enabled_empty' | 'populated'
  - `progress` integer
  - `record_count` integer
  - `size_bytes` integer
  - `checksum` string
  - `error` string
  - `requested_by` string
  - `created_at` string, date-time
  - `started_at` string, date-time
  - `completed_at` string, date-time

## Other responses

- `400`: Invalid body, period, regulator, framework or format
- `401`: Tenant scope required
- `403`: Forbidden - insufficient permissions or enterprise license required
- `405`: Method not allowed on this collection
- `503`: The compliance report module is not available on this deployment

---

[API](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api.md) - [All operations](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/revisions/f408ef3ec9dd?raw)