Compliance report

The compliance report gives you a day-by-day summary of your operations, security events, offline continuity and audit trail, ready to hand to an auditor or regulator. It is designed to support evidence requests under ISO/IEC 27001:2022, DORA, GDPR and NIS2.

Endpoint

GET /v1/compliance/report

The report needs a user session with one of these roles: company_admin, country_admin, wede_tech_ops, wede_global_admin. Other roles and API keys receive 403 forbidden. A company_admin sees their own tenant. The wede and country roles see aggregate figures across tenants, never event content.

Parameters

string

default:"30 days ago"

First day of the period, YYYY-MM-DD.

string

default:"today"

Last day of the period, YYYY-MM-DD. Both days are included.

An invalid date returns 400 invalid_payload.

Example

curl "https://api.wede.pt/v1/compliance/report?from=2026-06-01&to=2026-06-30" \
  -H "Authorization: Bearer <session_token>"

Response

{
  "meta": {
    "from": "2026-06-01",
    "to": "2026-06-30",
    "granularity": "day",
    "tenant_id": "9c145f7e-...",
    "generated_at": "2026-07-01T08:30:37.000Z",
    "standards": ["ISO 27001:2022", "DORA", "GDPR", "NIS2"]
  },
  "data": {
    "events": [],
    "missions": [],
    "dispatch": [],
    "security": [],
    "offline_sync": [],
    "webhooks": [],
    "active_users": [],
    "audit_volume": []
  }
}

Each section is a list with one row per day that has activity, newest day first. meta.tenant_id is your tenant, or null in a cross-tenant report.

Counts are returned as numeric strings (for example "12"). Convert them to numbers before you add them up.

Sections

events

Your production events per day and vertical. Sandbox events are never counted.

Field	Description
`day`	Date, `YYYY-MM-DD`
`vertical`	Vertical of the events
`total`	Events created
`completed`	Events with status `completed` (delivered)
`failed`	Events with status `failed`
`pending`	Events with status `pending` (queued or not delivered yet)

missions

Missions per day.

Field	Description
`day`	Date
`total`	Missions created
`completed`	Missions that reached `COMPLETED`
`failed`	Missions that reached `FAILED`, including missions replaced after no acknowledgement
`avg_resolution_min`	Average minutes from creation to closure, for closed missions

dispatch

Field	Description
`day`	Date
`total_dispatches`	Dispatch operations recorded in the audit log

security

Security events per day.

Field	Description
`day`	Date
`auth_failures`	Rejected sign-in attempts (wrong credentials)
`parser_violations`	Attempts to change protected parser fields, all rejected

offline_sync

Continuity activity from field devices: dispatch requests they queued while offline and sent when they reconnected.

Field	Description
`day`	Date
`devices_synced`	Distinct devices that synced
`sync_operations`	Queued operations received
`processed`	Operations processed successfully
`failed`	Operations that could not be processed
`blocked_integrity`	Operations held by an integrity incident until it is resolved

Duplicates never enter this queue: the same sequence number sent twice by the same device is refused when it arrives. Every synchronisation and the result of each item, duplicates included, is in the continuity evidence pack.

webhooks

Webhook delivery attempts per day. A delivery retried after a failure counts once per attempt.

Field	Description
`day`	Date
`delivered`	Attempts your endpoint accepted
`failed`	Attempts that failed

active_users

Field	Description
`day`	Date
`active_users`	Distinct users with at least one recorded action
`total_actions`	Recorded actions performed by users

audit_volume

Size of the immutable audit trail per day.

Field	Description
`day`	Date
`total_entries`	Audit log entries
`distinct_users`	Distinct users behind those entries
`distinct_actions`	Distinct action types recorded

The response can contain further counters. Rely only on the fields documented on this page.

Export

GET /v1/compliance/report/export

Takes the same from and to and returns the same report as a file to download (wede-compliance-report-<from>-to-<to>.json):

curl "https://api.wede.pt/v1/compliance/report/export?from=2026-06-01&to=2026-06-30" \
  -H "Authorization: Bearer <session_token>" \
  -o wede-compliance-report.json

Dashboard

The report is also in the wede dashboard under Compliance, with these tabs:

Operations: events, missions and dispatch by day.
Security: security events by day.
Continuity: offline sync activity by day.
Audit Volume: audit log statistics by day.
Evidence Packs: signed evidence of an outage, see Continuity evidence packs.

You can choose the date range and export the report as JSON.

Standards alignment

Standard	Most relevant sections
ISO/IEC 27001:2022	`security`, `audit_volume`, `active_users`
DORA	`offline_sync` (continuity), `events`, `missions`, `dispatch`
GDPR	`audit_volume`, `active_users`
NIS2	`security`, `missions` (response times), `offline_sync`

The audit log behind this report is immutable: database triggers reject any update or delete of an entry, whatever the role or application behind the request. This gives auditors tamper-evident evidence.

Security Overview

Identity and access

Compliance

Endpoint

Parameters

Example

Response

Sections

events

missions

dispatch

security

offline_sync

webhooks

active_users

audit_volume

Export

Dashboard

Standards alignment

​Endpoint

​Parameters

​Example

​Response

​Sections

​events

​missions

​dispatch

​security

​offline_sync

​webhooks

​active_users

​audit_volume

​Export

​Dashboard

​Standards alignment

Endpoint

Parameters

Example

Response

Sections

events

missions

dispatch

security

offline_sync

webhooks

active_users

audit_volume

Export

Dashboard

Standards alignment