---
title: "List compliance findings"
method: GET
path: "/v1/compliance/findings"
tags: ["Compliance"]
---

# List compliance findings

`GET /v1/compliance/findings`

## Request

- Base URL: `https://api.peppolstatus.com`
- URL: `https://api.peppolstatus.com/v1/compliance/findings`
- Auth: one of:
  - HTTP bearer
  - API key in header `X-API-Key`

Deterministic verdicts against the published rules, newest first and keyset-paginated on (`first_detected_at`, `finding_id`). A finding stays `open` until the registration is corrected, at which point the next scan stamps `resolved_at`; `first_detected_at` survives every re-scan. Distinct from `/v1/anomalies`, which reports observed behaviour rather than rule breaches. The first page's `meta.facets` gives rule and grade counts over the filtered set.

## Query parameters

- `rule` string
- `country` string
- `seat` string
- `scheme` string
- `grade` 'fatal' | 'warning' | 'notice'
- `status` 'open' | 'resolved' | 'all'
- `since` string, date-time
- `limit` integer
- `cursor` string

## Response `200`

A page of compliance findings with rule/grade facets.

- ComplianceFindingPage: A keyset page of compliance findings with first-page facets.
  - `items` ComplianceFinding[], required
    - `finding_id` string, required: Stable id of this (rule, subject) pair; survives re-scans.
    - `rule_code` string, required
    - `rule_version` string, required: The rule version that judged it.
    - `grade` 'fatal' | 'warning' | 'notice', required
    - `status` 'open' | 'resolved', required: `resolved` once a scan no longer confirms the breach.
    - `subject_kind` string, required: What the finding is about (e.g. `host_cert`).
    - `smp_seat_id` string, nullable, required: The operating seat, when known.
    - `smp_url` string, nullable, required: The SMP base URL, for SMP subjects.
    - `smp_owner_name` string, nullable, required: The operating provider's name.
    - `participant_id` string, nullable, required: The participant, for participant-grain rules.
    - `scheme_id` string, nullable, required
    - `participant_name` string, nullable, required
    - `country_code` string, nullable, required: ISO 3166-1 alpha-2, when known.
    - `sub_provider` string, nullable, required: The reseller, when attributable.
    - `affected_pa` string, nullable, required: Peppol Authority affected.
    - `affecting_pa` string, nullable, required: Peppol Authority responsible for the non-compliant party.
    - `detail` object, required: Evidence behind the verdict (issuer, fingerprint, reason, …).
    - `first_detected_at` string, date-time, required: When the breach was first seen; preserved across re-scans.
    - `last_confirmed_at` string, date-time, required: The last scan that opened, reopened or changed the finding. A scan that re-confirms a high-volume finding unchanged does not restamp it, so this is an evidence-change instant, not a heartbeat — read `last_seen_at`.
    - `last_seen_at` string, date-time, required: When the finding was last CONFIRMED to exist: the later of `last_confirmed_at` and the last completed scan of its rule, because a scan closes everything it stops confirming and therefore still sees everything it leaves open. Equal to `last_confirmed_at` for a resolved finding, and for a rule that has not completed a scan yet.
    - `resolved_at` string, date-time, nullable, required: When it stopped being confirmed.
  - `next_cursor` string, nullable, required: Opaque cursor for the next page, or null on the last page.
  - `meta` object, required
    - `facets` object, required: Value→count maps over the filtered set.
      - `rule` object, required
      - `grade` object, required

## Other responses

- `400`: An invalid `grade`, `status`, `since`, `limit` or `cursor`.

---

[API](https://skmtc.dev/peppolstatus/apis/peppolstatus-api.md) · [All operations](https://skmtc.dev/peppolstatus/apis/peppolstatus-api/llms.txt) · [OpenAPI document](https://skmtc.dev/peppolstatus/apis/peppolstatus-api/revisions/7e74fb32f23c?raw)