Evidence API

Overview

The Evidence API gives read-only access to your scan results — violations, pre-consent timelines, fingerprinting evidence, geographic data flows, cookie inventories and jurisdiction mappings. It's built for legal teams, internal audit and enterprise integrations.

Base URL

Authentication

All requests must include your API key in the X-Api-Key header.

curl -H "X-Api-Key: cmk_YOUR_API_KEY" \
  https://compliancemonitor.io/api/v1/scans/{scan_id}/evidence

Endpoints

All endpoints follow the pattern /scans/{id}/{resource}. Replace {id} with the scan UUID from your dashboard.

List Violations

Returns all compliance violations found during the scan, including severity, vendor attribution, legal explanation, and remediation guidance.

Example request

curl -H "X-Api-Key: cmk_YOUR_KEY" \
  https://compliancemonitor.io/api/v1/scans/SCAN_ID/violations

Example response

{
  "scan_id": "a1b2c3d4-...",
  "count": 3,
  "violations": [
    {
      "id": "...",
      "type": "cookie",
      "severity": "high",
      "name": "_ga",
      "domain": ".google-analytics.com",
      "description": "Google Analytics tracking cookie set before consent",
      "category": "analytics",
      "vendor": "Google",
      "country": "US",
      "why_illegal": "Analytics cookies require explicit opt-in before processing under GDPR Art. 6(1)(a)",
      "how_to_fix": "Block Google Analytics scripts until user provides consent via your CMP",
      "created_at": "2026-02-13T10:00:00Z"
    }
  ]
}

Fingerprinting Data

Returns browser fingerprinting detection results: canvas, WebGL, audio, font, and navigator API usage counts with timestamps.

curl -H "X-Api-Key: cmk_YOUR_KEY" \
  https://compliancemonitor.io/api/v1/scans/SCAN_ID/fingerprinting

Pre-Consent Timeline

Chronological sequence of all events from page load: network requests, fingerprinting events, and CMP detection. Each event is marked as pre- or post-consent.

curl -H "X-Api-Key: cmk_YOUR_KEY" \
  https://compliancemonitor.io/api/v1/scans/SCAN_ID/timeline

Data Leak Map

Geographic breakdown of all outbound data flows, grouped by destination country. Each request includes vendor attribution, category, and pre-consent status.

curl -H "X-Api-Key: cmk_YOUR_KEY" \
  https://compliancemonitor.io/api/v1/scans/SCAN_ID/leak-map

Jurisdiction Summary

Violations mapped to their legal context based on the scan's primary market (EU / UK / US_CA). Includes applicable law references, legal labels, and section titles.

curl -H "X-Api-Key: cmk_YOUR_KEY" \
  https://compliancemonitor.io/api/v1/scans/SCAN_ID/jurisdiction-summary

Cookie Inventory

Full inventory of cookies detected during the scan, including their attributes and whether they were set before user consent.

curl -H "X-Api-Key: cmk_YOUR_KEY" \
  https://compliancemonitor.io/api/v1/scans/SCAN_ID/cookies

Full Evidence Bundle

Complete evidence package for a scan in a single request. Includes scan metadata, all violations, cookies, fingerprinting data, leak requests, and jurisdiction mappings. Ideal for legal teams and internal audit.

curl -H "X-Api-Key: cmk_YOUR_KEY" \
  https://compliancemonitor.io/api/v1/scans/SCAN_ID/evidence

Error Codes

All errors return a JSON object with an error field.

Error response format

{
  "error": "Scan not found or access denied"
}

Rate Limits

The Evidence API is subject to fair-use rate limits.

If you exceed these limits, you will receive a 429 response. Wait and retry with exponential backoff.