Generate an Agent Conformity Dossier

One endpoint stitches the compliance and security evidence your account already produces — disclosure settings, eval runs, tool-approval records, decision audit logs — into a single export for one agent. Request it as JSON for machine processing, or as a download-ready HTML pack to attach to a regulatory filing or an enterprise security review. The endpoint paths below are relative. Send them against https://api.orbit.devotel.io/api/v1.

Prerequisites

An agent with a saved, versioned configuration — the dossier reports the agent’s current row, including its version counter.
An API key whose user holds the owner, admin, or developer role (read). Every export is written to the account’s audit log.
Evidence to report on. Sections read the records you have already produced: disclosure settings, eval runs, tool-approval gates, and audit events generate their sections. A section with no backing records still renders — it is marked unavailable instead of failing the export.

Choose a profile

The same endpoint compiles two profiles; profile= selects which one. Both share the model card and the human-oversight evidence; everything else is profile-specific.

Profile	Cited framework	Sections
`eu_ai_act` (default)	EU AI Act articles	Model card, AI-disclosure configuration (Art. 50), evaluation results (Art. 15), fairness and bias cohorts (Art. 10), built-in red-team coverage (Art. 15), human oversight (Art. 14), decision audit aggregates (Art. 12 / Art. 22 §3)
`aiuc1`	CSA AIUC-1 control families	Model card, agent identity (signing keys, discovery mode), access control (tool allowlist, approval gates), transport security, message integrity, runtime containment — plus a crosswalk mapping its families to OWASP Agentic ASI03, CSA AI Controls Matrix, CSA MAESTRO, and NIST AI RMF

Pick eu_ai_act when the export feeds a European regulatory or Annex IV conformity review. Pick aiuc1 when a security team is evaluating the agent against agentic-AI control frameworks — the crosswalk answers the framework-to-control mapping such reviews cite without a second pass.

Call the endpoint

The endpoint defaults to format=json and profile=eu_ai_act; both query parameters are optional. JSON returns the structured dossier object:

curl -s "https://api.orbit.devotel.io/api/v1/agents/agent_abc123/conformity-dossier?profile=eu_ai_act" \
  -H "X-API-Key: dv_live_sk_..."

HTML returns a styled, self-contained attachment. Save it under the filename the server also suggests:

curl -s "https://api.orbit.devotel.io/api/v1/agents/agent_abc123/conformity-dossier?profile=eu_ai_act&format=html" \
  -H "X-API-Key: dv_live_sk_..." \
  -o eu-ai-act-conformity-dossier-2026-09-29.html

For the AIUC-1 profile, pass profile=aiuc1; the suggested filename changes to aiuc1-agent-security-posture-<agent>-<date>.html. A unknown agent id returns 404, and the endpoint is rate-limited to 30 requests per minute — treat it as a serve-on-demand export, not a polling feed. The JSON response carries a readiness block alongside the sections:

{
  "dossier": {
    "dossier_version": "1",
    "generated_at": "2026-09-29T07:00:00.000Z",
    "readiness": { "sections_present": 7, "sections_total": 7 },
    "sections": [ ... ]
  }
}

readiness compares the number of fully gathered sections against the profile’s total, so a downstream check can confirm the pack is complete before it goes into a filing.

Read the report

Three rendering rules hold for every section, in both formats:

No secrets, no keys. Sections render configuration and counts — the prompt length in characters, tool and knowledge-base counts, eval pass/fail tallies, approval-status totals — but never prompt bodies, API keys, or signing-key material. The export is safe to hand to an external reviewer as-is.
Failures degrade per section, not per export. A read that fails — or whose backing table is not provisioned on a legacy account — marks that one section unavailable. The remaining sections still gather, and the export succeeds; check readiness.sections_present for the count.
Assert evidence, not compliance. The report documents what the platform can evidence for your configured posture; it makes no legal determination about your deployment.

The HTML pack is deterministic — the same state renders the same document — so attach it with the generated date in its name and keep one export per review cycle in your records.

Dashboard equivalent

No curl required: open the agent in the dashboard, choose the Conformity dossier tab, and pick the profile from the toggle at the top of the tab. The tab renders the same dossier inline — per-section status, the fairness cohort breakdown where present, the AIUC-1 framework crosswalk where present — and offers a download button that exports the same JSON the endpoint serves. The disclaimer the API includes is also shown in the tab, keeping the tenant-owned posture framing next to the evidence.

Troubleshooting

Symptom	Fix
`404 NOT_FOUND`	The agent id does not exist in your tenant, or was deleted. Confirm the id from `GET /agents`.
`403`	The endpoint requires the owner, admin, or developer role. Mint the key for a user in one of those roles.
Section shows `unavailable`	The section’s backing records were never provisioned or have no data yet — run an eval, enable disclosure, or route tool calls through the approval gate, then re-export. The rest of the dossier still exported; it never fails as a whole.
`readiness.sections_present` < `sections_total`	One or more sections degraded. Re-run after covering the missing evidence, or accept the partial pack consciously before filing it.
HTML downloaded with no styling	The HTML pack is self-contained. If your pipeline rewrites attachments, make sure it does not strip the inline `<style>` block.

Tenant-owned posture

Per the compliance guide: the dossier documents what the platform can evidence about the posture you configured — your disclosure texts, your eval results, your approval-gate records, your audit aggregates. Orbit compiles the evidence; the judgment that your deployment satisfies a regulation stays with you, and the disclaimer in every export says so in writing. That boundary is deliberate: a vendor asserting compliance on your behalf would be a liability, not a feature.

WhatsApp

Guides

Messaging Controls

Audience & Support Tools

Generate an Agent Conformity Dossier

Generate an Agent Conformity Dossier

Prerequisites

Choose a profile

Call the endpoint

Read the report

Dashboard equivalent

Troubleshooting

Tenant-owned posture

See also

​Generate an Agent Conformity Dossier

​Prerequisites

​Choose a profile

​Call the endpoint

​Read the report

​Dashboard equivalent

​Troubleshooting

​Tenant-owned posture

​See also

Generate an Agent Conformity Dossier

Prerequisites

Choose a profile

Call the endpoint

Read the report

Dashboard equivalent

Troubleshooting

Tenant-owned posture

See also