/api/v1/soc2-readinessGet SOC 2 readiness scorecard
Returns a SOC 2 Type II readiness scorecard for an org. Requires `?orgId` (400 if missing). Reports per-category rollups across the nine Common Criteria CC1-CC9 (no Availability or Confidentiality categories are modelled). `report.overallScore` is EVIDENCE-BACKED: each control is weighted ready=1 / needs_attention=0.5 / not-assessed=0, where `ready` requires both a status of 'implemented' AND supporting evidence that is present, verified and fresh within a 180-day observation window. Evidence is joined from both stores — manual uploads in `soc2_evidence` and the hash-chained collector rows in `soc2_control_evidence`. The pre-evidence, status-only figure is still returned verbatim as `report.selfAttestedScore`, with `scoreBasis` naming which is which. A control claimed implemented on no evidence is emitted as a critical gap, so '0 gaps' is unreachable while any control falls short. Nothing is persisted — the report is computed on demand.
Authentication
Send Authorization: Bearer YOUR_API_KEY on every request. Generate API keys at /dashboard/settings/api-keys.
Response
200 example
{
"success": true
}All status codes
Code samples
cURL
curl -X GET \ https://evalguard.ai/api/v1/soc2-readiness \ -H "Authorization: Bearer $EVALGUARD_API_KEY"
TypeScript
// The TypeScript SDK (@evalguard/sdk) exposes TYPED methods — runEval,
// getEval, runSecurityScan, checkFirewall, … — not a generic request().
// For an arbitrary endpoint, call it directly:
const res = await fetch("https://evalguard.ai/api/v1/soc2-readiness", {
method: "GET",
headers: { Authorization: `Bearer ${process.env.EVALGUARD_API_KEY}` },
});
console.log(res.status, await res.json());Python
# The Python SDK (pip install evalguardai) exposes TYPED methods on
# EvalGuardClient — run_eval, get_eval, … — not a generic request().
# For an arbitrary endpoint, call it directly:
import os
import requests
headers = {"Authorization": f"Bearer {os.environ['EVALGUARD_API_KEY']}"}
response = requests.request("GET", "https://evalguard.ai/api/v1/soc2-readiness", headers=headers)
print(response.status_code, response.json())Go
package main
import (
"context"
"fmt"
"net/http"
"os"
)
func main() {
req, _ := http.NewRequestWithContext(context.Background(), "GET", "https://evalguard.ai/api/v1/soc2-readiness", nil)
req.Header.Set("Authorization", "Bearer "+os.Getenv("EVALGUARD_API_KEY"))
resp, err := http.DefaultClient.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
fmt.Println(resp.Status)
}