--- title: "US banking examination readiness" method: GET path: "/api/v1/usbanking/exam-readiness" tags: ["US Banking Compliance"] --- # US banking examination readiness `GET /api/v1/usbanking/exam-readiness` ## Request - Base URL: `https://orchestrator.getaxonflow.com` - URL: `https://orchestrator.getaxonflow.com/api/v1/usbanking/exam-readiness` - Auth: none declared - TypeScript: (a function with typed inputs; its response is checked against the schema) Answers "if I generate the US banking examination package now, what will be in it and what will it have to disclose?" WITHOUT creating a report job. It returns COUNTS, PRESENCE and DISCLOSURES, never evidence rows. The rows come from the compliance report facade (`POST /api/v1/compliance/reports` with `regulator=usbanking`) and only from there, so this is not a second export path. It exists because the facade cannot answer this question: asking it means creating a job, spending one of an Evaluation tier's three daily reports, and waiting on an async render, purely to learn whether the package is worth generating. SCOPE: the summary covers the requesting TENANCY. Every source it reads is tenancy-keyed, and `audit_logs.org_id` is nullable, so an organization-wide count would silently omit records (ADR-063 section 4). The `unattributed_records` source reports exactly the population an organization-wide report would have dropped. AUTHORITY: gated on tenant-wide read authority, the same gate as the evidence and compliance exports. It returns aggregates rather than rows, but an aggregate over `audit_logs` still describes whole-tenant activity. **Enterprise Feature**. Community builds register no route (404). ## Response `200` Examination readiness summary - USBankingExamReadiness: The US banking examination-readiness summary. Counts, presence and disclosures only; it carries no evidence rows. - `tenant_id` string: The tenancy this summary covers. - `window_days` integer: The lookback the counts are taken over. One quarter, because that is the shortest cadence any instrument in scope sets (12 CFR Part 609 quarterly board reporting), so the window always covers at least one full cycle for the tighter profile. - `period_start` string, date-time - `period_end` string, date-time - `scope` string: One sentence stating the report's tenancy boundary. Every count is meaningless without it. - `profiles` USBankingProfile[]: The supervisory profiles and the frameworks that select each. The profile is DERIVED from the framework a report requests and is never a separate request field, so a caller cannot ask for a combination that contradicts itself (ADR-063 section 2). Served so a console learns the mapping from the deployment instead of keeping a copy that drifts. - `id` 'federal' | 'farm-credit' - `display_name` string - `frameworks` string[]: The framework tokens that select this profile. - `board_pack_cadence` 'annual' | 'quarterly': What the profile's supervisor EXPECTS, not a claim that this deployment produces a pack on that schedule. - `model_risk_citation` string - `incident_clock` string - `sources` USBankingSourceReadiness[]: Per evidence source, whether it holds anything and how much. - `key` string - `title` string - `present` boolean: An OBSERVATION, not a health check: false means the source held nothing for this tenancy in this window, which on a quiet deployment is a truthful answer and not a fault. Meaningful ONLY when `readable` is true. - `count` integer - `readable` boolean: Whether this deployment could read the source AT ALL. UNDOCUMENTED UNTIL #3532, and load-bearing since #3530 shipped: the server has always sent it, the console keys its warning styling on it, and the field is what separates "quiet deployment" from "surface this deployment cannot read". Omitting it from the schema left a generated client with no way to tell them apart except by sniffing the note's prose, which is exactly the shape the note's own description warns against. - `note` string: Why the count reads as it does. Load-bearing: a source can read zero because the deployment is quiet OR because this deployment cannot read that source at all, and `readable` is what separates them. A note beginning `NOT REPORTED` means the generated package will carry an INCOMPLETE section. - `disclosures` string[]: The sentences every generated artifact carries. Returned here so nothing in a package is a surprise at the point it reaches an examiner, and served from the same source the artifact renders from, so the two cannot say different things. - `generated_at` string, date-time ## Other responses - `401`: No organization or tenant scope on the request (`SCOPE_REQUIRED`): it did not traverse an authenticating hop. - `403`: The caller does not hold tenant-wide read authority. - `405`: Method not allowed; this route is GET-only. - `500`: The readiness summary could not be produced (`INTERNAL_ERROR`). The body carries a fixed sentence; the cause is in the orchestrator log keyed by the request. - `503`: The module is not initialized (the orchestrator has no database connection). --- [API](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api.md) - [All operations](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/llms.txt) - [OpenAPI document](https://skmtc.dev/getaxonflow/apis/axonflow-orchestrator-api/revisions/f408ef3ec9dd?raw)