---
title: "Compliance verdict for one passport."
method: GET
path: "/api/v1/passports/{id}/compliance"
tags: ["Passports"]
---

# Compliance verdict for one passport.

`GET /api/v1/passports/{id}/compliance`

## Request

- Base URL: `https://app.tracepass.eu`
- URL: `https://app.tracepass.eu/api/v1/passports/{id}/compliance`
- Auth: one of:
  - HTTP bearer
  - OAuth 2 (authorization code, authorization URL `https://app.tracepass.eu/api/oauth/authorize`, token URL `https://app.tracepass.eu/api/oauth/token`, scopes: `passports:read`)

Returns a three-tier compliance verdict
(`compliant` / `compliant_with_warnings` / `incomplete`) with
regulation-cited findings, so an integration can gap-check a
passport and re-check after fixing — the read → fix → verify
loop.

Findings come from three tiers:
- **static** — required template fields present + approved,
  required economic-operator parties present (critical), and
  well-formed field values (warning);
- **conditional** — per-category rules (battery Reg (EU)
  2023/1542 Art. 77(1) scope, a warning until the obligation
  applies on 18 February 2027 and critical from then, plus
  Annex XIII field-applicability; construction Reg (EU)
  2024/3110; CE-marking consistency),
  plus the cross-cutting EU-economic-operator rule
  (Reg (EU) 2019/1020 Art. 4). For batteries, applicability
  findings (`ruleId: "BAT-APP"`, warning) flag fields filled but
  not applicable to the battery's type — e.g. carbon footprint on
  a non-rechargeable cell. These reuse the standard
  `ComplianceFinding` shape (no new fields);
- **coverage** — `conditionalCoverage` reports whether
  conditional rules were evaluated for this category or it is
  `static-only` (no binding conditional in force yet), so the
  absence of conditional findings is never read as compliance.

`byRegulation` additionally groups those same findings by the
regulation that raised them, worst first, so a single REACH gap
does not read as "the DPP obligation is unmet" when it is fully
met. It is derived from the findings above and never contradicts
`verdict` — the rolled-up verdict stays authoritative for
publishing. A regulation with no findings is absent from the
array rather than reported as passing.

Read-only; counts as one v1 passport read against the daily cap.

## Response `200`

Compliance verdict.

- ComplianceVerdict: Three-tier compliance verdict for a passport.
  - `verdict` 'compliant' | 'compliant_with_warnings' | 'incomplete', required
  - `category` string, required
  - `conditionalCoverage` 'evaluated' | 'static-only', required: Whether per-category conditional rules ran (`evaluated`) or no binding conditional exists yet for this category (`static-only`). Absence of conditional findings is only meaningful alongside this flag.
  - `critical` ComplianceFinding[], required: Findings that force the `incomplete` verdict.
    - `type` 'missing_field' | 'unapproved_field' | 'missing_party' | 'invalid_format' | 'conditional_missing' | 'unverifiable_conditional', required
    - `severity` 'critical' | 'warning', required
    - `target` string: Field key or party role this finding concerns.
    - `regulation` string: Regulation number, e.g. "(EU) 2023/1542".
    - `article` string: Article / annex citation, e.g. "Art. 77".
    - `ruleId` string: Rule id from the verified spec (e.g. "BAT-1", "CC-1").
    - `why` string, required: One-line explanation of why this matters.
    - `fix` string: One-line actionable next step.
  - `warnings` ComplianceFinding[], required: Findings that downgrade to `compliant_with_warnings`.
    - `type` 'missing_field' | 'unapproved_field' | 'missing_party' | 'invalid_format' | 'conditional_missing' | 'unverifiable_conditional', required
    - `severity` 'critical' | 'warning', required
    - `target` string: Field key or party role this finding concerns.
    - `regulation` string: Regulation number, e.g. "(EU) 2023/1542".
    - `article` string: Article / annex citation, e.g. "Art. 77".
    - `ruleId` string: Rule id from the verified spec (e.g. "BAT-1", "CC-1").
    - `why` string, required: One-line explanation of why this matters.
    - `fix` string: One-line actionable next step.
  - `checkedRules` string[], required: Rule ids that actually ran (static checks + each conditional rule).
  - `completionPercentage` integer, required
  - `byRegulation` RegimeResult[], required: The same findings grouped by the regulation that raised them, worst first. Additive and purely derived — it never disagrees with `verdict`, it explains it. `verdict` answers "is this publishable"; this answers "which regime do I go and fix", which a single `incomplete` cannot. A regulation appears ONLY if it raised at least one finding, so an absent regulation means "no finding", never "passed" — listing every regulation a category could touch would assert a pass for checks that never ran.
    - `regulation` string, required: Regulation number exactly as the findings carry it, e.g. `(EU) 2023/1542`. Findings that carry no regulation are grouped under the literal `unattributed` rather than dropped, so the two presentations always account for the same number of findings.
    - `verdict` 'compliant' | 'compliant_with_warnings' | 'incomplete', required
    - `critical` ComplianceFinding[], required
      - `type` 'missing_field' | 'unapproved_field' | 'missing_party' | 'invalid_format' | 'conditional_missing' | 'unverifiable_conditional', required
      - `severity` 'critical' | 'warning', required
      - `target` string: Field key or party role this finding concerns.
      - `regulation` string: Regulation number, e.g. "(EU) 2023/1542".
      - `article` string: Article / annex citation, e.g. "Art. 77".
      - `ruleId` string: Rule id from the verified spec (e.g. "BAT-1", "CC-1").
      - `why` string, required: One-line explanation of why this matters.
      - `fix` string: One-line actionable next step.
    - `warnings` ComplianceFinding[], required
      - `type` 'missing_field' | 'unapproved_field' | 'missing_party' | 'invalid_format' | 'conditional_missing' | 'unverifiable_conditional', required
      - `severity` 'critical' | 'warning', required
      - `target` string: Field key or party role this finding concerns.
      - `regulation` string: Regulation number, e.g. "(EU) 2023/1542".
      - `article` string: Article / annex citation, e.g. "Art. 77".
      - `ruleId` string: Rule id from the verified spec (e.g. "BAT-1", "CC-1").
      - `why` string, required: One-line explanation of why this matters.
      - `fix` string: One-line actionable next step.

## Other responses

- `401`: Missing or invalid API key.
- `404`: Resource doesn't exist or is in a different workspace.
- `429`: Daily v1 write or passport-read budget exhausted. Resets at 00:00 UTC.

---

[API](https://skmtc.dev/tracepass/apis/tracepass-api.md) · [All operations](https://skmtc.dev/tracepass/apis/tracepass-api/llms.txt) · [OpenAPI document](https://skmtc.dev/tracepass/apis/tracepass-api/revisions/60ddeb25638b?raw)