Reads YOUR organization's whole trust centre, including the addresses of your…
Reads YOUR organization's whole trust centre, including the addresses of your own gated documents.
GET /v1/trust
| Address | https://api.hanzo.ai/v1/trust |
| Method | GET |
| Operation | get_trust |
| Auth | Authorization: Bearer $HANZO_API_KEY |
Reads YOUR organization's whole trust centre, including the addresses of your own gated documents. Same shape as the published door; the difference is that this one is resolved from your validated bearer and shows you your own artifacts.
Request
GET /v1/trust takes no parameters and no body — the credential is the whole request.
Response
| Status | Body | Meaning |
|---|---|---|
200 | centre | ok |
200 body — 49 fields.
| Field | In | Type | Always | Description |
|---|---|---|---|---|
controls | body | any[] | — | Controls is the control inventory, each entry naming what it asserts, the mechanism, where it is enforced, how it is verified and the clauses it maps to. |
coverage | body | coverRow[] | — | Coverage is the per-framework counts, computed from Controls against each framework's whole published clause list. |
coverage[].automated | body | integer | — | Automated is how many clauses have an automated control behind them that something can fail on behalf of. |
coverage[].edition | body | string | — | Edition is which edition the clause list is taken from. |
coverage[].framework | body | string | — | Framework is the framework id — "soc2", "iso27001", "nist80053". |
coverage[].name | body | string | — | Name is the published standard's name. |
coverage[].none | body | integer | — | None is how many have nothing behind them. |
coverage[].note | body | string | — | Note is what the clause list itself is scoped to, when the framework's catalog says something a count alone would misrepresent. |
coverage[].partial | body | integer | — | Partial is how many are answered in part. |
coverage[].publisher | body | string | — | Publisher is who publishes it — AICPA, ISO/IEC, NIST. |
coverage[].statement | body | string | — | Statement is the counts as one sentence, carrying the unit. |
coverage[].total | body | integer | — | Total is the framework's WHOLE published clause list — the denominator. |
coverage[].unit | body | string | — | Unit is what ONE clause is — "criterion", "control", "family". |
coverage[].units | body | string | — | Units is the plural of Unit, for rendering a sentence. |
documents | body | docRow[] | — | Documents are the artifacts, each saying whether this reader may read it. |
documents[].attested | body | boolean | — | Attested reports whether somebody OUTSIDE this organization put their name to it. |
documents[].href | body | string | — | Href is where to read it, present only when this reader may. |
documents[].id | body | string | — | ID is the document's id within this organization's centre. |
documents[].kind | body | string | — | Kind is the artifact type — soc2, iso, pentest, letter, caiq, sig, vsa, questionnaire, policy or other. |
documents[].label | body | string | — | Label is the artifact type in words, for rendering. |
documents[].note | body | string | — | Note is anything the organization says about this artifact. |
documents[].released | body | boolean | — | Released reports whether THIS reader may read it. |
documents[].tier | body | string | — | Tier is "public" or "gated". |
documents[].title | body | string | — | Title is what the document is called. |
documents[].updated | body | integer | — | Updated is when the record last changed, unix milliseconds. |
faq | body | any[] | — | Faq is the knowledge base — the questions a reviewer asks, answered. |
frameworks | body | frameworkRow[] | — | Frameworks are the clause universes the coverage is computed against. |
frameworks[].edition | body | string | — | Edition is which edition this clause list is taken from. |
frameworks[].framework | body | string | — | Framework is the framework id. |
frameworks[].name | body | string | — | Name is the published standard's name. |
frameworks[].publisher | body | string | — | Publisher is who publishes it. |
frameworks[].total | body | integer | — | Total is how many clauses the standard publishes. |
frameworks[].unit | body | string | — | Unit is what one clause is; Units is its plural. |
frameworks[].units | body | string | — | Units is the plural of Unit. |
generated | body | integer | — | Generated is when this answer was computed, unix milliseconds. |
inventory | body | trustTally | — | |
inventory.absent | body | integer | — | Absent is how many the organization does not have. |
inventory.automated | body | integer | — | Automated is how many run with nobody in the loop. |
inventory.partial | body | integer | — | Partial is how many run but do not cover their whole claim. |
inventory.statement | body | string | — | Statement is the counts as one sentence, safe to quote. |
inventory.total | body | integer | — | Total is how many controls this organization publishes. |
inventory.unverified | body | integer | — | Unverified is how many rest on somebody having READ the source rather than on a test or an audit row. |
org | body | string | — | Org is whose centre this is. |
policies | body | any[] | — | Policies are the published policies. |
profile | body | any | — | Profile is the organization's own description of itself. |
risk | body | any | — | Risk is the risk profile — label and value pairs describing what this organization handles and how. |
subprocessors | body | any[] | — | Subprocessors are the third parties this organization sends data to. |
updates | body | any[] | — | Updates is the changelog, newest as the organization ordered it. |
version | body | string | — | Version is the embedded inventory's version. |
Failure carries the platform error shape — see Errors.
Examples
hanzo has no subcommand for this operation — the CLI serves only what cloud's live route table confirms. Use HTTP or an SDK.
import { Configuration, TrustApi } from 'hanzoai';
const api = new TrustApi(new Configuration({ accessToken: process.env.HANZO_API_KEY }));
const { data } = await api.getTrust();from hanzoai.cloud import ApiClient, Configuration
from hanzoai.cloud.api import TrustApi
client = ApiClient(Configuration(access_token=os.environ["HANZO_API_KEY"]))
result = TrustApi(client).get_trust()cfg := cloud.NewConfiguration()
cfg.AddDefaultHeader("Authorization", "Bearer "+os.Getenv("HANZO_API_KEY"))
client := cloud.NewAPIClient(cfg)
resp, _, err := client.TrustAPI.GetTrust(context.Background()).Execute()
if err != nil {
return err
}use hanzo_cloud::apis::{configuration::Configuration, trust_api};
let mut cfg = Configuration::new();
cfg.bearer_access_token = std::env::var("HANZO_API_KEY").ok();
let result = trust_api::get_trust(&cfg, Default::default()).await?;import ai.hanzo.cloud.ApiClient;
import ai.hanzo.cloud.api.TrustApi;
ApiClient client = new ApiClient();
client.setRequestInterceptor(b -> b.header("Authorization", "Bearer " + System.getenv("HANZO_API_KEY")));
var result = new TrustApi(client).getTrust();The method above is the one at the current release of the document. [email protected] (npm) and [email protected] (PyPI) were generated from an earlier release, where this operation carried a different id, so it spells the method differently — regenerating the clients is what makes the two agree. SDKs →
curl https://api.hanzo.ai/v1/trust \
-H "Authorization: Bearer $HANZO_API_KEY"The door declares no tool for trust — tools/list on https://api.hanzo.ai/v1/mcp names the products it does reach. Use HTTP or an SDK.
How is this guide?