GitLab Compliance policy settings API

openapi: 3.2.0
info:
  title: GitLab REST Compliance policy settings API
  description: GitLab REST API used to interact with a GitLab installation.
  termsOfService: https://handbook.gitlab.com/handbook/legal/api-terms/
  version: '19.6'
  license:
    name: CC BY-SA 4.0
    url: https://gitlab.com/gitlab-org/gitlab/-/blob/master/LICENSE
    x-gitlab-description: The license applies to the OpenAPI specification document itself. For terms governing use of the GitLab API, see the termsOfService field.
servers:
- url: https://{hostname}
  description: GitLab REST API
  variables:
    hostname:
      default: gitlab.com
      description: Your GitLab instance hostname
security:
- http: []
- oauth2: []
- apiKey: []
tags:
- name: Compliance policy settings
  description: 'Use this API to manage the security policy settings for an instance, and to set the status of

    compliance controls that are evaluated by an external service.


    Managing security policy settings requires administrator access to the instance, and security policies

    require the Ultimate tier.

    Setting the status of a compliance control requires HMAC, Timestamp, and Nonce authentication.


    External controls support periodic ping functionality. When ping is enabled, which is the default,

    GitLab resets the control status to `pending` every 12 hours. When ping is disabled, the control

    status changes only through API calls.'
  x-displayName: Compliance policy settings
  externalDocs:
    url: https://docs.gitlab.com/api/compliance_policy_settings/
paths:
  /api/v4/projects/{id}/compliance_external_controls/{control_id}/status:
    patch:
      operationId: patchApiV4ProjectsIdComplianceExternalControlsControlIdStatus
      summary: Set status of an external control
      description: Sets the status of a specified external control. Use this operation to inform GitLab that a control has passed or failed a check by an external service.
      tags:
      - Compliance policy settings
      responses:
        '200':
          description: OK
        '404':
          description: Not Found
        '400':
          description: Bad Request
      parameters:
      - name: id
        required: true
        description: ID or URL-encoded path of the project.
        schema:
          oneOf:
          - type: string
          - type: integer
        in: path
        example: 1
      - name: control_id
        required: true
        description: ID of the control.
        schema:
          type: integer
        in: path
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/patchApiV4ProjectsIdComplianceExternalControlsControlIdStatusRequest'
  /api/v4/admin/security/compliance_policy_settings:
    get:
      operationId: getApiV4AdminSecurityCompliancePolicySettings
      summary: Retrieve security policy settings
      description: Retrieves the current security policy settings for this GitLab instance.
      tags:
      - Compliance policy settings
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIEntitiesAdminSecurityPolicySetting'
        '401':
          description: 401 Unauthorized
        '403':
          description: 403 Forbidden
        '400':
          description: 400 Bad Request
      x-gitlab-tier: ultimate
    put:
      operationId: putApiV4AdminSecurityCompliancePolicySettings
      summary: Update security policy settings
      description: Updates the security policy settings for this GitLab instance.
      tags:
      - Compliance policy settings
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APIEntitiesAdminSecurityPolicySetting'
        '401':
          description: 401 Unauthorized
        '403':
          description: 403 Forbidden
        '400':
          description: 400 Bad Request
        '422':
          description: 422 Unprocessable Entity
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/putApiV4AdminSecurityCompliancePolicySettingsRequest'
      x-gitlab-tier: ultimate
components:
  schemas:
    patchApiV4ProjectsIdComplianceExternalControlsControlIdStatusRequest:
      type: object
      properties:
        status:
          type: string
          enum:
          - pass
          - fail
          - not_applicable
          description: Status of the control.
          minLength: 1
      required:
      - status
    APIEntitiesAdminSecurityPolicySetting:
      type: object
      properties:
        csp_namespace_id:
          type: integer
          format: int64
          example: 1
    putApiV4AdminSecurityCompliancePolicySettingsRequest:
      type: object
      properties:
        csp_namespace_id:
          type:
          - integer
          - 'null'
          description: ID of the group designated to centrally manage security policies and compliance frameworks. Must be a top-level group. Set to `null` to clear the setting.
      required:
      - csp_namespace_id
  securitySchemes:
    http:
      type: http
      scheme: bearer
    oauth2:
      type: oauth2
      flows:
        authorizationCode:
          authorizationUrl: https://gitlab.com/oauth/authorize
          tokenUrl: https://gitlab.com/oauth/token
          refreshUrl: https://gitlab.com/oauth/token
          scopes:
            api: Grants complete read/write access to the API, including all groups and projects, the container registry, the dependency proxy, and the package registry.
            read_api: Grants read access to the API, including all groups and projects, the container registry, and the package registry.
            read_user: Grants read-only access to your profile through the /user API endpoint, which includes username, public email, and full name. Also grants access to read-only API endpoints under /users.
            create_runner: Grants create access to the runners.
            manage_runner: Grants access to manage the runners.
            k8s_proxy: Grants permission to perform Kubernetes API calls using the agent for Kubernetes.
            self_rotate: Grants permission for token to rotate itself.
            mcp: Grants read-write access to remote Model Context Protocol (MCP) server for tools execution.
            mcp_orbit: Grants access to the Orbit Knowledge Graph MCP server for graph queries and schema retrieval.
    apiKey:
      type: apiKey
      name: PRIVATE-TOKEN
      in: header