ScenarioResults

scenario_idstringrequired

scenario_namestringrequired

violations object[]required

Array [

policystringrequired

Example: SEC-5

statusstringrequired

Possible values: [fail, warn, pass, n-a]

severitystringrequired

Display-time source of truth should be the catalog's severity from GET /governance/policies. Treat this per-violation field as contextual information only.

Possible values: [critical, high, medium, low]

titlestringrequired

Human-readable policy name (e.g. Hardcoded credentials). Populated from the policy catalog (GET /governance/policies) when the evaluator does not supply its own title, so it is safe to render directly. May be an empty string only for an unmapped/unknown code.

descriptionstringrequired

Best-effort policy description. Always present, but may be an empty string when the evaluator does not supply detail for this finding. For a guaranteed human-readable name, use title.

summarystring

Optional one-line reason for this specific failure. Omitted when the evaluator captured no evidence for the finding.

compliance_frameworks object[]

Best-effort compliance mappings for this policy. Optional — may be empty or omitted entirely. Render only the frameworks present and never infer a compliance gap from its absence.

Array [

oneOf

• object
• object
• object
• object
• object

frameworkstringrequired

Possible values: [SOC 2]

controlstringrequired

Example: CC6.1

]

remediation_availablebooleanrequired

remediation_pendingboolean

Present and true only on POST /evaluate/inline with include_remediation=true when step generation for this violation did not finish within the endpoint's remediation time budget. The violation is returned without a remediation block; re-request remediation (or re-run with a smaller blueprint) to obtain steps. See the inline endpoint description for the budget behavior.

failing_modules object[]required

Array [

module_idstring

module_namestring

module_typestring

reasonstring

badgestring

]

sourcestringrequired

Possible values: [automated]

]

module_summary object[]required

Array [

module_idstringrequired

module_namestringrequired

module_typestringrequired

Example: google-sheets:updateRow

badgestringrequired

Possible values: [critical, high, medium, low, pass]

violation_countintegerrequired

policiesstring[]required

]

evaluated_codesstring[]required

passing_countintegerrequired

failing_countintegerrequired

evaluation_statusstringrequired

Possible values: [evaluated, not_evaluated]

ScenarioResults

{
  "scenario_id": "string",
  "scenario_name": "string",
  "violations": [
    {
      "policy": "SEC-5",
      "status": "fail",
      "severity": "critical",
      "title": "string",
      "description": "string",
      "summary": "string",
      "compliance_frameworks": [
        {
          "framework": "SOC 2",
          "control": "CC6.1"
        },
        {
          "framework": "GDPR",
          "article": "Art.32"
        },
        {
          "framework": "PCI-DSS",
          "requirement": "Req.3.4"
        },
        {
          "framework": "HIPAA",
          "section": "164.312(a)(1)"
        },
        {
          "framework": "ISO 27001",
          "control": "A.14.2"
        }
      ],
      "remediation_available": true,
      "remediation_pending": true,
      "failing_modules": [
        {
          "module_id": "string",
          "module_name": "string",
          "module_type": "string",
          "reason": "string",
          "badge": "string"
        }
      ],
      "source": "automated"
    }
  ],
  "module_summary": [
    {
      "module_id": "string",
      "module_name": "string",
      "module_type": "google-sheets:updateRow",
      "badge": "critical",
      "violation_count": 0,
      "policies": [
        "string"
      ]
    }
  ],
  "evaluated_codes": [
    "string"
  ],
  "passing_count": 0,
  "failing_count": 0,
  "evaluation_status": "evaluated"
}