Deliverd Governance API
The Governance API from Deliverd — 10 operation(s) for governance.
Work with this as data
Every API here is available over the APIs.io API and to AI agents over MCP.
MCP server
One button, every client — Claude, Cursor, VS Code and the rest.
https://apis.io/mcp
Tools for apis
7 MCP tools reach this
find_apisBrowse and filter every API in the catalog.get_api_artifactsOne API's artifacts, grouped by type.get_openapiThe primary OpenAPI for this API.find_similar_apisAPIs that look like this one.apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.resolveTurn a domain, URL or GitHub org into the provider it belongs to.find_cohortsEvery scored population of providers in the catalog.
Call it yourself
curl for this page
This API
curl "https://apis.io/api/v1/apis/deliverd-dev:deliverd-dev-governance-api"
All apis
curl "https://apis.io/api/v1/apis?limit=25"Calls without X-API-Key need no key. Calls with it need a paid plan — get a key.
Get an API key
Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.
A second provider on the same verified email joins the account you already have.
OpenAPI Specification
openapi: 3.2.0
info:
title: Deliverd Dev Governance API
version: 1.0.0
x-refined-note:
- x-source differs across the merged source definitions and was not carried
description: 'Operations tagged Governance across 2 of this provider''s published API definitions: deliverd-dev-openapi.json, deliverd-dev-openapi.yml. Each path carries the servers of the definition it was published in.'
servers:
- url: https://deliverd.dev
description: 'Deliverd REST API (paths carry the /api/v1 prefix; https://deliverd.dev/llms.txt: "REST API: https://deliverd.dev/api/v1")'
tags:
- name: Governance
paths:
/api/v1/governance/ict-register:
get:
summary: The ICT third-party register
description: 'DORA''s register of information, for the providers behind the organisation''s AI systems: who keeps it (`entity`), the `providers`, the `arrangements` (contracts) with the AI systems that run under each, what each entry still lacks (`gaps`), the `concentration` on each provider, and the AI systems not yet in the register.'
security:
- bearerAuth: []
responses:
'200':
description: '{ entity, providers, arrangements, concentration, unregisteredSystems, rules }'
content:
application/json:
schema:
type: object
additionalProperties: {}
tags:
- Governance
operationId: getApiV1GovernanceIctRegister
x-operation-id-source: derived
/api/v1/governance/ict-register/export:
get:
summary: The register in the shape of the register-of-information templates
description: B_01.01, B_02.01, B_02.02, B_05.01, B_06.01 and B_07.01 of Implementing Regulation (EU) 2024/2956, with the regulation's column codes. JSON is every template (or `template`) with its columns and rows; `format=csv` is one template, headed by its column codes. Values nobody recorded are empty. For the organisation's own register to take in, not the submission itself.
security:
- bearerAuth: []
parameters:
- schema:
type: string
enum:
- json
- csv
required: false
name: format
in: query
- schema:
type: string
enum:
- B_01.01
- B_02.01
- B_02.02
- B_05.01
- B_06.01
- B_07.01
required: false
name: template
in: query
- schema:
type: string
format: date
description: The reporting date; today when omitted
required: false
description: The reporting date; today when omitted
name: asOf
in: query
responses:
'200':
description: '{ statement, templates }, or CSV'
content:
application/json:
schema:
type: object
additionalProperties: {}
'400':
description: CSV without a template, or an unknown template
tags:
- Governance
operationId: getApiV1GovernanceIctRegisterExport
x-operation-id-source: derived
/api/v1/governance/frameworks:
get:
summary: The frameworks this organisation can see
description: The built-in packs (NIST AI RMF, ISO/IEC 42001, EU AI Act, UK AI principles, DORA, SR 26-2, PRA SS1/23 and FCA AI good practice) with their requirements and versions, the organisation's own frameworks, and which are applied at which version. A pack maps requirements onto controls for review; it is not legal advice.
security:
- bearerAuth: []
responses:
'200':
description: '{ frameworks, custom, customControls, canAdopt, canWriteCustom, statement }'
content:
application/json:
schema:
type: object
additionalProperties: {}
tags:
- Governance
operationId: getApiV1GovernanceFrameworks
x-operation-id-source: derived
post:
summary: Draft the organisation's own framework
description: Enterprise. Saved as a draft; it applies only once a person publishes and adopts it. A published version is never edited — a change is a new version.
security:
- bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
properties:
key:
type: string
pattern: ^custom_[a-z0-9_]{1,52}$
description: custom_ followed by lower case letters, digits and underscores
version:
type: string
pattern: ^[0-9A-Za-z][0-9A-Za-z._-]{0,31}$
description: e.g. 1.0 or 2026.10. A change to a published framework is a new version
name:
type: string
minLength: 1
maxLength: 200
summary:
type: string
maxLength: 2000
jurisdictions:
type: array
items:
type: string
minLength: 1
maxLength: 60
maxItems: 30
description: 'Where it applies, e.g. EU, UK. Empty: wherever it is adopted'
effectiveFrom:
type: string
format: date
requirements:
type: array
items:
type: object
properties:
ref:
type: string
minLength: 1
maxLength: 60
description: The framework's own reference, e.g. 4.2 or UW-1
title:
type: string
minLength: 1
maxLength: 300
description: What it asks, in a sentence
controls:
type: array
items:
type: string
pattern: ^[a-z][a-z0-9_]{1,59}$
minItems: 1
maxItems: 20
description: 'Controls that evidence it: common ones or your own custom_ controls'
appliesWhen:
type: object
properties:
minRisk:
type: string
enum:
- low
- medium
- high
- critical
personalData:
type: boolean
customerFacing:
type: boolean
productionUse:
type: boolean
decisionImpact:
type: array
items:
type: string
enum:
- none
- informs
- supports_decision
- automated_decision
additionalProperties: false
description: Conditions on the governance profile; every one given must hold
required:
- ref
- title
- controls
minItems: 1
maxItems: 200
required:
- key
- version
- name
- requirements
responses:
'201':
description: The draft
content:
application/json:
schema:
type: object
additionalProperties: {}
'400':
description: The framework is not sound, or that version exists
'402':
description: 'The plan does not include this capability (feature_unavailable): Compliance Mode, or the Enterprise governance capability named in the message'
tags:
- Governance
operationId: postApiV1GovernanceFrameworks
x-operation-id-source: derived
/api/v1/governance/frameworks/mapping:
get:
summary: How framework requirements map onto controls
description: With `taskId`, how far that governed task's completed controls cover each requirement. A mapping, never a compliance verdict.
security:
- bearerAuth: []
parameters:
- schema:
type: string
format: uuid
required: false
name: taskId
in: query
- schema:
type: string
required: false
name: framework
in: query
responses:
'200':
description: '{ taskId, frameworks, statement }'
content:
application/json:
schema:
type: object
additionalProperties: {}
tags:
- Governance
operationId: getApiV1GovernanceFrameworksMapping
x-operation-id-source: derived
/api/v1/governance/incidents:
get:
summary: AI incidents, newest first
description: Paged with `limit` and `cursor`; `nextCursor` is null at the end. Incidents against a task you cannot read are left out.
security:
- bearerAuth: []
parameters:
- schema:
type: string
enum:
- open
- resolved
required: false
name: status
in: query
- schema:
type: string
format: uuid
required: false
name: aiSystemId
in: query
- schema:
type: integer
required: false
name: limit
in: query
- schema:
type: string
required: false
name: cursor
in: query
responses:
'200':
description: A page of incidents
content:
application/json:
schema:
type: object
properties:
items:
type: array
items:
type: object
properties:
id:
type: string
format: uuid
taskId:
type:
- string
- 'null'
format: uuid
aiSystemId:
type:
- string
- 'null'
format: uuid
title:
type: string
description:
type: string
severity:
type: string
enum:
- low
- medium
- high
- critical
status:
type: string
enum:
- open
- resolved
reportedByLabel:
type: string
reportedAt:
type: string
format: date-time
resolution:
type:
- string
- 'null'
resolvedByLabel:
type:
- string
- 'null'
resolvedAt:
type:
- string
- 'null'
format: date-time
required:
- id
- taskId
- aiSystemId
- title
- description
- severity
- status
- reportedByLabel
- reportedAt
- resolution
- resolvedByLabel
- resolvedAt
nextCursor:
type:
- string
- 'null'
required:
- items
- nextCursor
tags:
- Governance
operationId: getApiV1GovernanceIncidents
x-operation-id-source: derived
post:
summary: Report an AI incident
description: 'Against a governed task, an AI system, or both. High or critical closes the task''s governance gate until a person resolves it. Permanent: it cannot be edited or withdrawn.'
security:
- bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
properties:
taskId:
type: string
format: uuid
description: The governed task it concerns
aiSystemId:
type: string
format: uuid
description: The AI system it concerns; the task's own system when only taskId is given
title:
type: string
minLength: 1
maxLength: 200
description:
type: string
maxLength: 4000
severity:
type: string
enum:
- low
- medium
- high
- critical
description: high or critical closes the governance gate until a person resolves it
detectedAt:
type: string
format: date-time
description: When the organisation became aware of it, if earlier than now. DORA's reporting clocks start here
category:
type: string
enum:
- data_disclosure
- sensitive_data
- prompt_injection
- fairness
- wrong_output
- outage
- unauthorised_action
- other
description: 'What kind of incident it was, which the AI risk scorecard counts: data_disclosure, sensitive_data, prompt_injection, fairness, wrong_output, outage, unauthorised_action or other'
required:
- title
- severity
responses:
'201':
description: The incident
content:
application/json:
schema:
type: object
additionalProperties: {}
'402':
description: The plan does not include Compliance Mode (feature_unavailable). Reads are not refused.
tags:
- Governance
operationId: postApiV1GovernanceIncidents
x-operation-id-source: derived
/api/v1/governance/incidents/{id}:
get:
summary: One AI incident, with its DORA reporting
description: 'The incident, its DORA classification (`dora`: the facts, `major`, each criterion and the reason), its reports with their sign-off status, and `schedule`: which report is due next and by when. Nothing is due unless it is classified major.'
security:
- bearerAuth: []
parameters:
- schema:
type: string
format: uuid
required: true
name: id
in: path
responses:
'200':
description: The incident
content:
application/json:
schema:
type: object
additionalProperties: {}
'404':
description: No such incident, or one against a task you cannot read
tags:
- Governance
operationId: getApiV1GovernanceIncidentsById
x-operation-id-source: derived
/api/v1/governance/incidents/{id}/reports:
post:
summary: Draft a DORA report and put it to sign-off
description: initial, intermediate or final on a major incident, in that order; or reclassification, for one notified as major and now not. Creates an approval for a person to sign it off. Needs approvals:write as well as tasks:write.
security:
- bearerAuth: []
parameters:
- schema:
type: string
format: uuid
required: true
name: id
in: path
requestBody:
content:
application/json:
schema:
type: object
properties:
kind:
type: string
enum:
- initial
- intermediate
- final
- reclassification
description: initial, intermediate, final, or reclassification (as non-major)
content:
type: string
minLength: 1
maxLength: 20000
description: What the report says, written for the person who signs it off and for the authority
fields:
type: object
additionalProperties: {}
description: 'The report''s structured fields. initial: discoveredBy, memberStates, originatedAtThirdParty, businessContinuityActivated; intermediate: incidentType, occurredAt, recoveredAt, authorityReference, clientsAffected, figuresAreEstimates, temporaryMeasures; final: rootCause, rootCauseAddressedAt, resolvedAt, grossCostsEur, financialRecoveriesEur; reclassification: reason'
approvers:
type: array
items:
type: string
minLength: 1
maxLength: 320
maxItems: 20
description: Who signs it off; the organisation's administrators when omitted
required:
- kind
- content
responses:
'201':
description: '{ incident, reportId, approvalId, approvalUrl }'
content:
application/json:
schema:
type: object
additionalProperties: {}
'402':
description: The plan does not include Compliance Mode (feature_unavailable). Reads are not refused.
'409':
description: 'Not this report yet: the incident is not major, or the report before it has not been submitted'
tags:
- Governance
operationId: postApiV1GovernanceIncidentsByIdReports
x-operation-id-source: derived
/api/v1/governance/authority/evaluate:
post:
summary: May this agent take this kind of action?
description: Enterprise. By the organisation's authority policy and the agent's own, which can only be stricter. `mode` is allowed, approval or denied. Records nothing.
security:
- bearerAuth: []
requestBody:
content:
application/json:
schema:
type: object
properties:
action:
type: string
enum:
- read
- analyse
- recommend
- draft
- modify
- execute
- publish
- deploy
- send
- delete
- financial_action
- customer_decision
agentId:
type: string
format: uuid
description: An agent of this organisation; the requesting agent when omitted
required:
- action
responses:
'200':
description: '{ action, mode, source, reason, agentId, agentName }'
content:
application/json:
schema:
type: object
additionalProperties: {}
'402':
description: 'The plan does not include this capability (feature_unavailable): Compliance Mode, or the Enterprise governance capability named in the message'
tags:
- Governance
operationId: postApiV1GovernanceAuthorityEvaluate
x-operation-id-source: derived
/api/v1/governance/summary:
get:
summary: The organisation's AI governance in counts
description: Systems, governed tasks, outstanding controls, pending approvals, expired exceptions, open incidents and what needs review. `jurisdiction` and `framework` filters are Enterprise. Never a compliance percentage.
security:
- bearerAuth: []
parameters:
- schema:
type: string
format: uuid
required: false
name: aiSystemId
in: query
- schema:
type: string
enum:
- low
- medium
- high
- critical
required: false
name: risk
in: query
- schema:
type: string
required: false
name: owner
in: query
- schema:
type: string
required: false
name: provider
in: query
- schema:
type: string
required: false
name: dataClassification
in: query
- schema:
type: string
required: false
name: jurisdiction
in: query
- schema:
type: string
required: false
name: framework
in: query
responses:
'200':
description: The summary
content:
application/json:
schema:
type: object
additionalProperties: {}
'402':
description: 'The plan does not include this capability (feature_unavailable): Compliance Mode, or the Enterprise governance capability named in the message'
tags:
- Governance
operationId: getApiV1GovernanceSummary
x-operation-id-source: derived
/api/v1/governance/policies:
get:
summary: The organisation's internal AI policies, every version
description: Governed tasks record the version they were evaluated against. Publishing a version is done by a person in Deliverd.
security:
- bearerAuth: []
responses:
'200':
description: '{ policies }'
content:
application/json:
schema:
type: object
additionalProperties: {}
tags:
- Governance
operationId: getApiV1GovernancePolicies
x-operation-id-source: derived
components:
securitySchemes:
bearerAuth:
type: http
scheme: bearer
description: 'API key (dlv_…) created in Settings → API tokens, or an OAuth access token (dlvo_…). Every route below can answer `401 auth_error` — the credential was not accepted — or `403 insufficient_scope`, which is a different thing: the credential is fine and was not issued with the scope this route needs. Reissue it with that scope rather than replacing it with another of the same ones. Older clients may still branch on `auth_error` for both.'
x-refined-from:
- deliverd-dev-openapi.json
- deliverd-dev-openapi.yml