For AI agents: A markdown version of this page is available at https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/api/latest/compliance/get-the-rule-based-view-of-compliance-findings.md. A documentation index is available at /llms.txt.
homeHomedocsDocsapiAPI
Language
Datadog site

Get the rule-based view of compliance findings

WARNINGNote: This endpoint is in Preview and subject to change. If you have any feedback, contact Datadog support.
GEThttps://api.datadoghq.com/api/v2/compliance_findings/rule_based_viewhttps://api.us3.datadoghq.com/api/v2/compliance_findings/rule_based_viewhttps://api.us5.datadoghq.com/api/v2/compliance_findings/rule_based_viewhttps://api.datadoghq.eu/api/v2/compliance_findings/rule_based_viewhttps://api.ap1.datadoghq.com/api/v2/compliance_findings/rule_based_viewhttps://api.ap2.datadoghq.com/api/v2/compliance_findings/rule_based_viewhttps://api.uk1.datadoghq.com/api/v2/compliance_findings/rule_based_viewhttps://api.ddog-gov.com/api/v2/compliance_findings/rule_based_viewhttps://api.us2.ddog-gov.com/api/v2/compliance_findings/rule_based_view

Overview

This endpoint is deprecated. Use the Security Monitoring - Search Security Findings endpoint instead.

Get an aggregated view of compliance rules with their pass, fail, and muted finding counts. Supports filtering by compliance framework, framework version, and additional query filters.

This endpoint requires the security_monitoring_findings_read permission.

OAuth apps require the security_monitoring_findings_read authorization scope to access this endpoint.

Arguments

Query Strings

Name
Type
Description
to [required]
integer

Timestamp of the query end, in milliseconds since the Unix epoch.

framework
string

Compliance framework handle to filter rules and findings by.

Default: ""
version
string

Version of the compliance framework to filter rules and findings by.

query_findings_without_framework_version
boolean

When true, returns findings without a framework_version tag. Used for findings from custom frameworks or those created before framework versioning was introduced.

Default: false
include_rules_without_findings
boolean

When true, includes rules in the response that have no associated findings.

Default: false
is_custom
boolean

Set to true when the requested framework is a custom framework.

query
string

Additional event-platform filters applied to the underlying findings query. For example, scored:true project_id:datadog-prod-us5.

Default: ""

Response

OK

Response containing an aggregated view of compliance rules with their finding statistics.

Field
Type
Description
data [required]
object

Data envelope for the rule-based view response.

Code Example

Get the rule-based view of compliance findings
# Required query arguments
export to="1739982278000"

# Set your Datadog site and credentials
export DD_SITE="datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/compliance_findings/rule_based_view?to=${to}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export to="1739982278000"

# Set your Datadog site and credentials
export DD_SITE="us3.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/compliance_findings/rule_based_view?to=${to}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export to="1739982278000"

# Set your Datadog site and credentials
export DD_SITE="us5.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/compliance_findings/rule_based_view?to=${to}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export to="1739982278000"

# Set your Datadog site and credentials
export DD_SITE="datadoghq.eu"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/compliance_findings/rule_based_view?to=${to}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export to="1739982278000"

# Set your Datadog site and credentials
export DD_SITE="ap1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/compliance_findings/rule_based_view?to=${to}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export to="1739982278000"

# Set your Datadog site and credentials
export DD_SITE="ap2.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/compliance_findings/rule_based_view?to=${to}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export to="1739982278000"

# Set your Datadog site and credentials
export DD_SITE="uk1.datadoghq.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/compliance_findings/rule_based_view?to=${to}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export to="1739982278000"

# Set your Datadog site and credentials
export DD_SITE="ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/compliance_findings/rule_based_view?to=${to}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"
# Required query arguments
export to="1739982278000"

# Set your Datadog site and credentials
export DD_SITE="us2.ddog-gov.com"
# Use a Personal Access Token or Service Access Token
export DD_BEARER_TOKEN="<PERSONAL_ACCESS_TOKEN OR SERVICE_ACCESS_TOKEN>"

curl -X GET "https://api.${DD_SITE}/api/v2/compliance_findings/rule_based_view?to=${to}" \
-H "Accept: application/json" \
-H "Authorization: Bearer ${DD_BEARER_TOKEN}"