Compliance Frameworks

This endpoint returns your tenant's compliance framework responses, so you can track assessment progress and scores alongside your other Cranium data.

List Compliance Framework Responses

Returns a paginated list of compliance framework responses for your tenant. Each record is one assessment against a framework, not a definition of the framework itself; this endpoint does not enumerate the frameworks Cranium supports.

Request:

GET /api/public/complianceframeworks

Authentication:

Bearer token. See Authentication & Generating Credentials.

Required Permission

Api_ComplianceFrameworks_Read

Query Parameters

Parameter	Type	Value
`limit`	integer	Results per page. Maximum 200.
`cursor`	string	Sync cursor. Omit on the first call to begin from the beginning. Pass `nextCursor` from the previous response on subsequent calls.
`updatedAfter`	ISO 8601 timestamp	Return only records updated at or after this timestamp. Use to recover a lost cursor or reset to a known point in time.

Response Fields

Field	Type	Rules
`complianceFrameworkResponseId`	GUID	Unique identifier for this assessment response.
`name`	string	Framework name, e.g. “NIST AIR RMF 1.0.”
`status`	string	Assessment progress: `NotStarted`, `InProgress`, or `Completed`.
`validationStatus`	string	Outcome of Cranium’s content validation: `Pending` or `Validated`. Independent of `status`.
`score`	decimal or null	On a 0-5 scale, not a percentage. `null` until the assessment produces a score. Treat `null` as “not yet scored,” never as zero.
`createdAt`	ISO 8601 timestamp	When the response was created.
`updatedAt`	ISO 8601 timestamp or null	When the response was last modified. `null` if it has never been modified since creation; treat `updatedAt ?? createdAt` as the effective last-changed time.

Sample Response

json

{
  "data": [
    {
      "complianceFrameworkResponseId": "e6b34c0d-8f5a-4b7c-9d0e-3f4a5b6c7d8e",
      "name": "NIST AI RMF 1.0",
      "status": "Completed",
      "validationStatus": "Validated",
      "score": 4.2,
      "createdAt": "2026-01-10T08:00:00Z",
      "updatedAt": "2026-06-01T20:11:09Z"
    },
    {
      "complianceFrameworkResponseId": "f7c45d1e-9a6b-4c8d-ae1f-4a5b6c7d8e9f",
      "name": "EU AI Act - High Risk",
      "status": "InProgress",
      "validationStatus": "Pending",
      "score": null,
      "createdAt": "2026-05-20T12:14:00Z",
      "updatedAt": "2026-07-02T09:15:33Z"
    }
  ],
  "pagination": {
    "limit": 100,
    "nextCursor": "eyJ1cGRhdGVkQXQiOiIyMDI2LTA3LTAyVDA5OjE1OjMzWiIsImlkIjoiZjdjNDVkMWUifQ==",
    "hasMore": false
  },
  "error": null,
  "meta": {
    "requestId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "timestamp": "2026-08-13T10:50:00Z"
  }
}

Individual questions responses are not exposed by this endpoint. It returns assessment-level metadata only; there is no field for per-control answers or evidence. Supporting documents are a separate feed; see the Documents endpoint. hasMore: false with a non-null nextCursor is the normal end-of-feed state. Store the cursor and replay it on your next poll.

Error Responses

400 VALIDATION_FAILED: the cursor is invalid, or cursor and updatedAfter were supplied together.
401 UNAUTHORIZED: the request is missing a token, or the token lacks Api_ComplianceFrameworks_Read.
500 INTERNAL_ERROR: an unexpected server error.

Did this answer your question?