--- title: "Check compliance readiness" method: GET path: "/api/v1/sebi/audit/readiness" tags: ["SEBI Compliance"] --- # Check compliance readiness `GET /api/v1/sebi/audit/readiness` ## Request - Base URL: `https://orchestrator.getaxonflow.com` - URL: `https://orchestrator.getaxonflow.com/api/v1/sebi/audit/readiness` - Auth: none declared - TypeScript: (a function with typed inputs; its response is checked against the schema) Validate organization readiness for SEBI regulatory audit. Checks include: - Retention configuration (5-year minimum) - PII detection policies - Human oversight mechanisms - Audit logging completeness - Decision chain tracing Returns a score (0-100) and actionable recommendations. ## Response `200` Compliance readiness assessment - SEBIComplianceReadiness: SEBI audit readiness assessment - `ready` boolean: Organization is ready for audit - `score` integer: Readiness score (0-100) - `checks` SEBIComplianceCheck[] - `name` string: Check name - `description` string: What the check verifies - `status` 'pass' | 'fail' | 'warning' | 'unknown': `unknown` was MISSING from this enum and is emitted on the stock path (#3435 R8), so a generated strict client failed to deserialise GET /api/v1/sebi/audit/readiness on every stock deployment. A control this deployment cannot INSPECT must not be reported as one it has, so `unknown` is distinct from `fail`. THREE of the five checks assign it (sebi_audit_export_service.go: Retention Configuration, PII Detection Policies, Human Oversight). Human Oversight joined them in #3874, which gave that check the third answer its two siblings already had -- until then a deployment nobody could inspect was reported identically to one measured to have no oversight. #3874 removed the reason `unknown` was the STOCK answer for two of them rather than an edge case: they queried relations no migration creates (`policies`, `hitl_config`), so they could return nothing else on any deployment. They now read `static_policies` and `hitl_approval_queue`. Retention Configuration still answers `unknown` on a stock deployment, and that is CORRECT rather than pending. Its table exists, but nothing in the product ever writes a row to it, so no organisation has a configured retention period to read. Making it answerable needs a retention configuration surface that does not exist yet; reading the system defaults instead was tried and reverted, because it contradicts GET /api/v1/sebi/audit/retention, which reports the same data types as not_available on the stated grounds that a default is what WOULD be applied and not evidence of what is configured. `unknown` fails closed on `ready` for Retention Configuration and PII Detection Policies. It does NOT clear `ready` for Human Oversight, whose FAILING branch has always been a non-blocking warning: blocking on unknown alone would rank "nobody could inspect this control" as worse than "this control is absent". - `details` string: Additional information - `recommendations` string[]: Improvement recommendations --- [API](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api.md) - [All operations](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/revisions/f408ef3ec9dd?raw)