GetComplianceReport

Returns structured, device-state compliance evidence for a named regulatory framework. The response never includes a pass/fail verdict — only the raw evidence a caller needs to evaluate compliance independently.
Framework and control definitions are maintained in the SDK data package (libwaresource), so newly supported frameworks, framework versions, and controls do not require an SDK engine update.

Syntax

Method ID

#define WAAPI_MID_GET_COMPLIANCE_REPORT 1035

JSON Input Structure

{
  "input": {
    "method": 1035,
    "framework_id": string,
    "framework_version": string
  }
}

Input Properties

Parameter	Type	Description
`framework_id`	string	Regulatory framework identifier. Use `"generic"` for framework-agnostic reporting (all supported controls, no requirement mapping) or a specific framework identifier (e.g. `"pci_dss"`) for named-framework reporting with requirement mappings. The current set of supported `framework_id` values is maintained as SDK data (`libwaresource`) and may expand over time without an SDK engine update.
`framework_version`	string	Version of the requested framework (e.g. `"1.0"`, `"4.0.1"`). The supported `framework_id`/`framework_version` combinations are maintained as SDK data (`libwaresource`).

JSON Output Structure

{
  "result": {
    "method": 1035,
    "code": number,
    "timing": number,
    "timestamp": string,
    "framework_id": string,
    "framework_version": string,
    "report_time": string,
    "endpoint": {
      "get_os_info": object,
      "get_device_identity": object,
      "get_active_user_info": object
    },
    "controls": [
      {
        "id": string,
        "description": string,
        "requirements": [
          string,
          ...
        ],
        "detect": [
          {
            "detected_products": [
              {
                "methods": [
                  {},
                  ...
                ]
              },
              ...
            ]
          },
          ...
        ]
      },
      ...
    ]
  }
}

Output Properties

Property	Type	Description
`result.method`	number	The method ID that generated this result.
`result.code`	number	The result code. See Result Codes.
`result.timing`	number	The measured time for the method call in milliseconds.
`result.timestamp`	string	The timestamp in seconds of when the call was made.
`result.framework_id`	string	Echoes the requested `framework_id`.
`result.framework_version`	string	Echoes the requested `framework_version`.
`result.report_time`	string	Epoch timestamp (seconds) of when the report snapshot was taken, encoded as a string.
`result.endpoint`	object	Shared device/OS/user context collected once per report, keyed by method name. Each entry carries that method's own result envelope (`method`, `code`, `timing`, `timestamp`) plus the output fields returned by the corresponding API.
`result.endpoint.get_os_info`	object	Contains OS information. See the `GetOSInfo` API documentation for field details.
`result.endpoint.get_device_identity`	object	Contains the device identity. See the `GetDeviceIdentity` API documentation for field details.
`result.endpoint.get_active_user_info`	object	Contains the active user account. See the `GetActiveUserInfo` API documentation for field details.
`result.controls`	array<object>	One entry per control supported for the requested framework. The specific set of controls returned depends on the requested `framework_id`/`framework_version` and the SDK's currently loaded compliance data (`libwaresource`).
`result.controls.id`	string	Control identifier (e.g. `anti_malware`, `firewall`, `vpn`).
`result.controls.description`	string	Human-readable control name.
`result.controls.requirements`	array<string>	(optional) Requirement identifiers this control satisfies under the requested framework. Present only when `framework_id` is a named framework (e.g. `pci_dss`); absent when `framework_id` is `"generic"`.
`result.controls.detect`	object	(optional) Present when this control's evidence is based on product detection. A control may instead carry a different, control-specific evidence field.
`result.controls.detect.detected_products`	array<object>	Detected products relevant to this control. Each entry uses the same fields as the `DetectProducts` API response (including `signature`, `sig_name`, `product`, `vendor`, `categories`, and `labels`) and adds a `methods` field. Empty if no matching product exists on the endpoint.
`result.controls.detect.detected_products.methods`	array<object>	One entry per method used to collect this control's evidence for a detected product. Each entry contains the fields returned by the successful method call; on failure, it contains the SDK's standard error fields excluding the `errors` array.

Result Codes

Code	Name	Description
0	`WAAPI_OK`	The operation completed successfully.

note

Other codes may be returned. See the full Result Codes reference for the complete list.

Remarks

Error Handling

The results of this function are determined by the error code returned by the call. If successful, WAAPI_OK or a special success code will be returned. Always check both the function return value and the result.code field in the output JSON.

Examples

Examples will be added here demonstrating the usage of this method.

Syntax​

Method ID​

JSON Input Structure​

Input Properties​

JSON Output Structure​

Output Properties​

Result Codes​

Remarks​

Error Handling​

Examples​

See Also​