Skip to main content
GET
Compliance Report
string
Filter by Kubernetes namespace. Omit it to cover every namespace.
string
Start of the window, RFC 3339.
string
End of the window, RFC 3339. from and to are an absolute period: with both, the report covers exactly [from, to]; with only from, it runs to now; with only to, it is the 7 days ending at to; with neither, the last 7 days.

Report Contents

Minimum role: viewer. Resources created inside the window are aggregated:
  • IncidentMetrics: total Issues, by severity and state, MTTD (detectedAt − creationTimestamp), MTTR (resolvedAt − detectedAt), mean remediation attempts
  • RemediationMetrics: total plans, SuccessRate (percent, 0 to 100, over plans that ended Completed vs Failed/RolledBack), per action type, AutoRemediatedCount (plans Completed), AgenticCount (agentic plans)
  • SLAMetrics: ResponseSLAViolations and ResolutionSLAViolations, CompliancePercentage (share of Issues with no violation; 100 when there are none), average response and resolution times. With IncidentSLAs in scope, a violation is what the IncidentSLA controller recorded on the Issue (platform.chatcli.io/sla-violated, response and/or resolution). Without any IncidentSLA, an Issue in state Escalated counts as a resolution violation and response violations stay 0.
  • IncidentSLAs: one entry per IncidentSLA in scope (Name, Namespace, Severity, ResponseTime, ResolutionTime, CompliancePercentage, ActiveViolations, TotalViolations, TotalIssuesTracked); omitted when there is none
  • ApprovalMetrics: requests, auto/manual approved, rejected, expired, average decision time
  • AuditSummary: total AuditEvents, by severity and by event type
The report’s keys are PascalCase (pinned by explicit JSON tags) and every duration (MTTD, MTTR, Average*Time) is an integer number of nanoseconds. MTTR here is measured from detection, while /analytics/mttr measures from Issue creation.

Authorizations

X-API-Key
string
header
required

API key sent in the X-API-Key header. Keys are read from the Secret chatcli-operator-secrets, key api-keys (fallback: ConfigMap chatcli-operator-config, key api-keys) in the operator namespace, as a YAML list of {key, role, name, description} (name is the identity recorded on approval decisions); the operator chart creates it only with apiKeys.create: true. Roles: viewer < operator < admin — any other role string is denied everywhere. Changes are picked up within about 30 seconds; deleting both the Secret and the ConfigMap revokes every key. With no keys configured every /api/ call returns 401, unless CHATCLI_OPERATOR_DEV_MODE=true, which grants admin without a key (development only).

Query Parameters

namespace
string

Kubernetes namespace. Empty means all namespaces.

from
string<date-time>

Start of the time range (RFC3339). Unparseable values are ignored.

Example:

"2026-03-01T00:00:00Z"

to
string<date-time>

End of the time range (RFC3339). Unparseable values are ignored.

Example:

"2026-03-19T23:59:59Z"

Response

Compliance report

apiVersion
string
Example:

"v1"

kind
string
Example:

"ComplianceReport"

spec
object

Go struct without JSON tags: PascalCase keys; durations are integers in nanoseconds.