This endpoint returns your tenant's compliance framework responses, so you can track assessment progress and scores alongside your other Cranium data.

List Compliance Framework Responses

Returns a paginated list of compliance framework responses for your tenant. Each record is one assessment against a framework, not a definition of the framework itself; this endpoint does not enumerate the frameworks Cranium supports.

Request:

GET /api/public/complianceframeworks

Authentication:

Bearer token. See Authentication & Generating Credentials.

Required Permission

Api_ComplianceFrameworks_Read

Query Parameters

Response Fields

Sample Response

json

{
  "data": [
    {
      "complianceFrameworkResponseId": "e6b34c0d-8f5a-4b7c-9d0e-3f4a5b6c7d8e",
      "name": "NIST AI RMF 1.0",
      "status": "Completed",
      "validationStatus": "Validated",
      "score": 4.2,
      "createdAt": "2026-01-10T08:00:00Z",
      "updatedAt": "2026-06-01T20:11:09Z"
    },
    {
      "complianceFrameworkResponseId": "f7c45d1e-9a6b-4c8d-ae1f-4a5b6c7d8e9f",
      "name": "EU AI Act - High Risk",
      "status": "InProgress",
      "validationStatus": "Pending",
      "score": null,
      "createdAt": "2026-05-20T12:14:00Z",
      "updatedAt": "2026-07-02T09:15:33Z"
    }
  ],
  "pagination": {
    "limit": 100,
    "nextCursor": "eyJ1cGRhdGVkQXQiOiIyMDI2LTA3LTAyVDA5OjE1OjMzWiIsImlkIjoiZjdjNDVkMWUifQ==",
    "hasMore": false
  },
  "error": null,
  "meta": {
    "requestId": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
    "timestamp": "2026-08-13T10:50:00Z"
  }
}

Individual questions responses are not exposed by this endpoint. It returns assessment-level metadata only; there is no field for per-control answers or evidence. Supporting documents are a separate feed; see the Documents endpoint. hasMore: false with a non-null nextCursor is the normal end-of-feed state. Store the cursor and replay it on your next poll.

Error Responses

• 400 VALIDATION_FAILED: the cursor is invalid, or cursor and updatedAfter were supplied together.
• 401 UNAUTHORIZED: the request is missing a token, or the token lacks Api_ComplianceFrameworks_Read.
• 500 INTERNAL_ERROR: an unexpected server error.