Compliance — MDDB API

Report the live state of the ISO 27001 / SOC 2 production guard #

GET /v1/compliance-status

Returns the current compliance posture of the running server, for operator-facing probes and monitoring that must detect a drifted configuration. With authentication enabled it needs an authenticated caller (any user or API key); no collection permission is required. When MDDB_PRODUCTION=true is set and any guardrail is missing, the server refuses to boot, so a reachable endpoint with production=true implies compliant=true. When MDDB_PRODUCTION is unset the server runs with the existing defaults and this endpoint enumerates every missing control.

Authorization: BearerAuth or APIKeyAuth or none

Responses #

Status	Description	Body
200	Compliance posture	object (application/json)
401	Auth is on (MDDB_AUTH_ENABLED=true) and the request carries no credentials, an invalid or expired JWT, or an unknown API key.	ErrorResponse (application/json)
429	The client is over the API rate limit (MDDB_RATE_LIMIT_ENABLED=true, MDDB_RATE_LIMIT_REQUESTS per MDDB_RATE_LIMIT_WINDOW seconds). A call that embeds can also be refused by the collection's daily embedding budget, with a QuotaExceeded body.	RateLimitError (application/json)

401 example (application/json)

{
  "error": "missing authentication"
}