Developer Compliance Records1.0.0-beta.1

Create a Compliance control

Creates a saved control at the supplied workspace revision and returns a change receipt. Requires an active Compliance entitlement. A successful create advances the revision and records a Space audit event.

POST/api/v1/compliance/controls

Workspace automation for approved Dashio products. Each token is scoped to one Space and independently granted operations. Requests spend shared minute credits, and selected operation groups also share hourly quotas.

Required token scope is compliance:controls:write. Scopes are independent.

This operation uses 3 credits from a shared budget of 60 credits per token and 300 per Space each UTC minute.

Run these examples on a trusted server with DASHIO_API_TOKEN configured. Use a private terminal when inspecting response data. Examples send one request with a bounded timeout and do not retry automatically.

Authentication

Dashio developer token (HTTP Bearer) API authentication guide

Path parameters

None documented.

Query parameters

None documented.

Header parameters

None documented.

Request body

application/json · Required

revisionintegerRequired: Minimum: 0. Maximum: 9007199254740991.
recordIdstringRequired: Minimum length: 2. Maximum length: 30. Pattern: ^[A-Z][A-Z0-9-]{1,29}$.
titlestringRequired: Minimum length: 1. Maximum length: 512.
descriptionstringRequired: Minimum length: 1. Maximum length: 8000.
ownerContactIdstringRequired: Minimum length: 1. Maximum length: 180.
frameworksarray of stringRequired: Minimum items: 1. Maximum items: 4.
statusstringRequired: Allowed values: "On track", "In review", "Needs attention".
dueDatestring (date)Required: No field description supplied.

Request & response examples

Copy an example in your preferred language.

request.sh

: "${DASHIO_API_TOKEN:?Set DASHIO_API_TOKEN before running this example}"

curl --fail-with-body --include --silent --show-error --connect-timeout 10 --max-time 30 \
  --request POST 'https://app.dashio.net/api/v1/compliance/controls' \
  --header "Authorization: Bearer $DASHIO_API_TOKEN" \
  --header 'Content-Type: application/json' \
  --data '{
  "revision": 4,
  "recordId": "AC-42",
  "title": "Quarterly access review",
  "description": "Review privileged access each quarter.",
  "ownerContactId": "contact-audit-owner",
  "frameworks": [
    "ISO 27001"
  ],
  "status": "On track",
  "dueDate": "2027-03-31"
}'

Replace URL parameters, credentials, and schema placeholders before running. No request is sent by this page.

Schema-generated example; not a captured response.

{
  "recordId": "<recordId>",
  "revision": 0,
  "changed": false
}

Run examples on a trusted server. Configure the environment variables and replace URL or schema placeholders. For a write, reuse its saved idempotency key only when retrying the identical request.

Responses

Headers on every response

X-Request-Idstring (uuid)Optional: Server-generated ID to include in a support request.

201

Record change receipt and resulting workspace revision.

Response headers

RateLimit-LimitintegerOptional: Per-token capacity in the reported gateway window, expressed in requests of this operation. A shared Space budget also applies. Present when the request reaches the authenticated gateway. Minimum: 1.
RateLimit-RemainingintegerOptional: Requests of this operation remaining under the current token, Space and applicable operation-group quotas. Present when the request reaches the authenticated gateway. Minimum: 0.
RateLimit-ResetintegerOptional: Unix timestamp in seconds when the reported gateway quota resets. Present when the request reaches the authenticated gateway. Minimum: 0.

application/json

recordIdstringRequired: Stable ID of the affected record.
revisionintegerRequired: Minimum: 0. Maximum: 9007199254740991.
changedbooleanRequired: Whether the workspace changed.

400

The record ID, revision, fields, or references are invalid.

application/json

statusCodeintegerRequired: Minimum: 400. Maximum: 599.
statusMessagestringOptional: A safe explanation suitable for display.
dataobjectRequired: No field description supplied.

401

A valid developer token is required.