--- title: Get the rule-based view of compliance findings description: This endpoint is deprecated. breadcrumbs: Documentation > API > Get the rule-based view of compliance findings --- > For the complete documentation index, see [llms.txt](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/llms.txt). # Get the rule-based view of compliance findings ## v2 (deprecated) {% alert level="warning" %} **Note**: This endpoint is in Preview and subject to change. If you have any feedback, contact [Datadog support](https://docs.datadoghq.com/help.md). {% /alert %} | Datadog site | API endpoint | | ----------------- | ---------------------------------------------------------------------------- | | app.datadoghq.com | GET https://api.datadoghq.com/api/v2/compliance_findings/rule_based_view | | us3.datadoghq.com | GET https://api.us3.datadoghq.com/api/v2/compliance_findings/rule_based_view | | us5.datadoghq.com | GET https://api.us5.datadoghq.com/api/v2/compliance_findings/rule_based_view | | app.datadoghq.eu | GET https://api.datadoghq.eu/api/v2/compliance_findings/rule_based_view | | ap1.datadoghq.com | GET https://api.ap1.datadoghq.com/api/v2/compliance_findings/rule_based_view | | ap2.datadoghq.com | GET https://api.ap2.datadoghq.com/api/v2/compliance_findings/rule_based_view | | uk1.datadoghq.com | GET https://api.uk1.datadoghq.com/api/v2/compliance_findings/rule_based_view | | app.ddog-gov.com | GET https://api.ddog-gov.com/api/v2/compliance_findings/rule_based_view | | us2.ddog-gov.com | GET https://api.us2.ddog-gov.com/api/v2/compliance_findings/rule_based_view | ### Overview **This endpoint is deprecated.** Use the [Security Monitoring - Search Security Findings](https://docs.datadoghq.com/api/latest/security-monitoring/search-security-findings.md) endpoint instead. Get an aggregated view of compliance rules with their pass, fail, and muted finding counts. Supports filtering by compliance framework, framework version, and additional query filters. This endpoint requires the `security_monitoring_findings_read` permission. OAuth apps require the `security_monitoring_findings_read` authorization [scope](https://dnd37xeb23o8n.cloudfront.net/stefon.simmons/docs-astro-web-10435/fr/api/latest/scopes.md#compliance) to access this endpoint. ### Arguments #### Query Strings | Field | Type | Description | | ---------------------------------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | to [*required*] | integer | Timestamp of the query end, in milliseconds since the Unix epoch. | | framework | string | Compliance framework handle to filter rules and findings by. Default: `""`. | | version | string | Version of the compliance framework to filter rules and findings by. | | query_findings_without_framework_version | boolean | When `true`, returns findings without a `framework_version` tag. Used for findings from custom frameworks or those created before framework versioning was introduced. Default: `false`. | | include_rules_without_findings | boolean | When `true`, includes rules in the response that have no associated findings. Default: `false`. | | is_custom | boolean | Set to `true` when the requested `framework` is a custom framework. | | query | string | Additional event-platform filters applied to the underlying findings query. For example, `scored:true project_id:datadog-prod-us5`. Default: `""`. | ### Response {% tabs %} {% tab label="200" %} OK {% tabs %} {% tab label="Model" %} Response containing an aggregated view of compliance rules with their finding statistics. | Parent field | Field | Type | Description | | --------------------- | ---------------------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------- | | | data [*required*] | object | Data envelope for the rule-based view response. | | data | attributes [*required*] | object | Attributes of the rule-based view. | | attributes | count [*required*] | int64 | Total number of rules in the view. | | attributes | rules [*required*] | [object] | List of rules in the rule-based view. | | rules | compliance_frameworks [*required*] | [object] | List of compliance framework mappings associated with the rule. | | compliance_frameworks | control | string | Identifier of the control inside the requirement. | | compliance_frameworks | framework | string | Handle of the compliance framework. | | compliance_frameworks | is_default | boolean | Whether the framework is a Datadog default framework. `true` indicates a Datadog framework and `false` indicates a custom framework. | | compliance_frameworks | message | string | Optional message describing the framework mapping for the rule. | | compliance_frameworks | requirement | string | Name of the requirement that contains the control. | | compliance_frameworks | version | string | Version of the compliance framework. | | rules | enabled [*required*] | boolean | Whether the rule is enabled. | | rules | id [*required*] | string | Unique identifier of the rule. | | rules | name [*required*] | string | Human-readable name of the rule. | | rules | resourceAttributes [*required*] | [string] | List of resource attribute names exposed by the rule. | | rules | resourceCategory [*required*] | string | Resource category targeted by the rule. | | rules | resourceType [*required*] | string | Resource type targeted by the rule. | | rules | stats [*required*] | object | Counts of findings for the rule, grouped by their evaluation status. | | stats | fail [*required*] | int64 | Number of findings that failed evaluation. | | stats | muted [*required*] | int64 | Number of findings that have been muted. | | stats | pass [*required*] | int64 | Number of findings that passed evaluation. | | rules | status [*required*] | string | Severity associated with the rule (for example, `info`, `low`, `medium`, `high`, or `critical`). | | rules | tags [*required*] | [string] | List of tags attached to the rule. | | rules | type [*required*] | enum | The category of the security rule. Allowed enum values: `cloud_configuration`, `infrastructure_configuration`, `api_security`. | | data | id [*required*] | string | Unique identifier of the rule-based view document. | | data | type [*required*] | enum | The type of the resource. The value should always be `rule_based_view`. Allowed enum values: `rule_based_view`. Default: `rule_based_view`. | {% /tab %} {% tab label="Example" %} ```json { "data": { "attributes": { "count": 1, "rules": [ { "compliance_frameworks": [ { "control": "164.308-a-4-i", "framework": "hipaa", "is_default": true, "message": "", "requirement": "Information-Access-Management", "version": "1" } ], "enabled": true, "id": "qjx-udx-xo8", "name": "IAM roles should not allow untrusted GitHub Actions to assume them", "resourceAttributes": [ "instance_id" ], "resourceCategory": "identity", "resourceType": "aws_iam_role", "stats": { "fail": 0, "muted": 0, "pass": 3 }, "status": "critical", "tags": [ "security:compliance" ], "type": "cloud_configuration" } ] }, "id": "JSONAPI_USELESS_ID", "type": "rule_based_view" } } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="400" %} Bad Request {% tabs %} {% tab label="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------- | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="403" %} Not Authorized {% tabs %} {% tab label="Model" %} API error response. | Field | Type | Description | | ------------------- | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="429" %} Too many requests {% tabs %} {% tab label="Model" %} API error response. | Field | Type | Description | | ------------------- | -------- | ----------------- | | errors [*required*] | [string] | A list of errors. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ "Bad Request" ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% tab label="503" %} Service Unavailable {% tabs %} {% tab label="Model" %} API error response. | Parent field | Field | Type | Description | | ------------ | ------------------- | -------- | ------------------------------------------------------------------------------- | | | errors [*required*] | [object] | A list of errors. | | errors | detail | string | A human-readable explanation specific to this occurrence of the error. | | errors | meta | object | Non-standard meta-information about the error | | errors | source | object | References to the source of the error. | | source | header | string | A string indicating the name of a single request header which caused the error. | | source | parameter | string | A string indicating which URI query parameter caused the error. | | source | pointer | string | A JSON pointer to the value in the request document that caused the error. | | errors | status | string | Status code of the response. | | errors | title | string | Short human-readable summary of the error. | {% /tab %} {% tab label="Example" %} ```json { "errors": [ { "detail": "Missing required attribute in body", "meta": {}, "source": { "header": "Authorization", "parameter": "limit", "pointer": "/data/attributes/title" }, "status": "400", "title": "Bad Request" } ] } ``` {% /tab %} {% /tabs %} {% /tab %} {% /tabs %} ### Code Example {% tabs %} {% tab label="Curl" %} ```bash # Required query arguments export to="1739982278000" # Set your Datadog site and credentials export DD_SITE="datadoghq.com" # Or us3.datadoghq.com, us5.datadoghq.com, datadoghq.eu, ap1.datadoghq.com, ap2.datadoghq.com, uk1.datadoghq.com, ddog-gov.com, us2.ddog-gov.com # Use a Personal Access Token or Service Access Token export DD_BEARER_TOKEN="" curl -X GET "https://api.${DD_SITE}/api/v2/compliance_findings/rule_based_view?to=${to}" \ -H "Accept: application/json" \ -H "Authorization: Bearer ${DD_BEARER_TOKEN}" ``` {% /tab %} {% tab label="Go" %} ```go // Get the rule-based view of compliance findings returns "OK" response package main import ( "context" "encoding/json" "fmt" "os" "github.com/DataDog/datadog-api-client-go/v2/api/datadog" "github.com/DataDog/datadog-api-client-go/v2/api/datadogV2" ) func main() { ctx := datadog.NewDefaultContext(context.Background()) ctx = context.WithValue(ctx, datadog.ContextAccessToken, os.Getenv("DD_BEARER_TOKEN")) configuration := datadog.NewConfiguration() configuration.SetUnstableOperationEnabled("v2.GetRuleBasedView", true) apiClient := datadog.NewAPIClient(configuration) api := datadogV2.NewComplianceApi(apiClient) resp, r, err := api.GetRuleBasedView(ctx, 1739982278000, *datadogV2.NewGetRuleBasedViewOptionalParameters()) if err != nil { fmt.Fprintf(os.Stderr, "Error when calling `ComplianceApi.GetRuleBasedView`: %v\n", err) fmt.Fprintf(os.Stderr, "Full HTTP response: %v\n", r) } responseContent, _ := json.MarshalIndent(resp, "", " ") fmt.Fprintf(os.Stdout, "Response from `ComplianceApi.GetRuleBasedView`:\n%s\n", responseContent) } ``` #### Instructions First [install the library and its dependencies](https://dnd37xeb23o8n.cloudfront.net/api/latest.md?code-lang=go) and then save the example to `main.go` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" go run "main.go" ``` {% /tab %} {% tab label="Java" %} ```java // Get the rule-based view of compliance findings returns "OK" response import com.datadog.api.client.ApiClient; import com.datadog.api.client.ApiException; import com.datadog.api.client.v2.api.ComplianceApi; import com.datadog.api.client.v2.model.RuleBasedViewResponse; public class Example { public static void main(String[] args) { ApiClient defaultClient = ApiClient.getDefaultApiClient(); defaultClient.setAccessToken(System.getenv("DD_BEARER_TOKEN")); defaultClient.setUnstableOperationEnabled("v2.getRuleBasedView", true); ComplianceApi apiInstance = new ComplianceApi(defaultClient); try { RuleBasedViewResponse result = apiInstance.getRuleBasedView(1739982278000L); System.out.println(result); } catch (ApiException e) { System.err.println("Exception when calling ComplianceApi#getRuleBasedView"); System.err.println("Status code: " + e.getCode()); System.err.println("Reason: " + e.getResponseBody()); System.err.println("Response headers: " + e.getResponseHeaders()); e.printStackTrace(); } } } ``` #### Instructions First [install the library and its dependencies](https://dnd37xeb23o8n.cloudfront.net/api/latest.md?code-lang=java) and then save the example to `Example.java` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" java "Example.java" ``` {% /tab %} {% tab label="Python" %} ```python """ Get the rule-based view of compliance findings returns "OK" response """ from os import environ from datadog_api_client import ApiClient, Configuration from datadog_api_client.v2.api.compliance_api import ComplianceApi configuration = Configuration() configuration.access_token = environ["DD_BEARER_TOKEN"] configuration.unstable_operations["get_rule_based_view"] = True with ApiClient(configuration) as api_client: api_instance = ComplianceApi(api_client) response = api_instance.get_rule_based_view( to=1739982278000, ) print(response) ``` #### Instructions First [install the library and its dependencies](https://dnd37xeb23o8n.cloudfront.net/api/latest.md?code-lang=python) and then save the example to `example.py` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" python3 "example.py" ``` {% /tab %} {% tab label="Ruby" %} ```ruby # Get the rule-based view of compliance findings returns "OK" response require "datadog_api_client" DatadogAPIClient.configure do |config| config.access_token = ENV["DD_BEARER_TOKEN"] config.unstable_operations["v2.get_rule_based_view".to_sym] = true end api_instance = DatadogAPIClient::V2::ComplianceAPI.new p api_instance.get_rule_based_view(1739982278000) ``` #### Instructions First [install the library and its dependencies](https://dnd37xeb23o8n.cloudfront.net/api/latest.md?code-lang=ruby) and then save the example to `example.rb` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" rb "example.rb" ``` {% /tab %} {% tab label="Rust" %} ```rust // Get the rule-based view of compliance findings returns "OK" response use datadog_api_client::datadog; use datadog_api_client::datadogV2::api_compliance::ComplianceAPI; use datadog_api_client::datadogV2::api_compliance::GetRuleBasedViewOptionalParams; #[tokio::main] async fn main() { let mut configuration = datadog::Configuration::new(); configuration.set_unstable_operation_enabled("v2.get_rule_based_view", true); let api = ComplianceAPI::with_config(configuration); let resp = api .get_rule_based_view(1739982278000, GetRuleBasedViewOptionalParams::default()) .await; if let Ok(value) = resp { println!("{:#?}", value); } else { println!("{:#?}", resp.unwrap_err()); } } ``` #### Instructions First [install the library and its dependencies](https://dnd37xeb23o8n.cloudfront.net/api/latest.md?code-lang=rust) and then save the example to `src/main.rs` and run following commands: ```bash DD_SITE="datadoghq.com" DD_API_KEY="" DD_APP_KEY="" cargo run ``` {% /tab %} {% tab label="TypeScript" %} ```typescript /** * Get the rule-based view of compliance findings returns "OK" response */ import { client, v2 } from "@datadog/datadog-api-client"; const configuration = client.createConfiguration({ authMethods: { AuthZ: { accessToken: process.env.DD_BEARER_TOKEN as string, }, }, }); configuration.unstableOperations["v2.getRuleBasedView"] = true; const apiInstance = new v2.ComplianceApi(configuration); const params: v2.ComplianceApiGetRuleBasedViewRequest = { to: 1739982278000, }; apiInstance .getRuleBasedView(params) .then((data: v2.RuleBasedViewResponse) => { console.log( "API called successfully. Returned data: " + JSON.stringify(data) ); }) .catch((error: any) => console.error(error)); ``` #### Instructions First [install the library and its dependencies](https://dnd37xeb23o8n.cloudfront.net/api/latest.md?code-lang=typescript) and then save the example to `example.ts` and run following commands: ```bash DD_SITE="datadoghq.com" DD_BEARER_TOKEN="" tsc "example.ts" ``` {% /tab %} {% /tabs %}