Firm API

Get current firm details

curl -X GET "https://api.bedrockcompliance.co.uk/v1/firm/me" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

Update firm settings

Toggle firm-level controls. Currently supports the impact-assessment enforcement gate; more settings will be added here rather than scattered across new endpoints. Compliance-relevant changes emit a FIRM_SETTINGS_UPDATED ledger event carrying the field-level diff and the authenticated actor (user or API key). No-op writes (where the incoming value already matches the stored value) are ignored — nothing is written to the database and no ledger record is emitted.

curl -X PATCH "https://api.bedrockcompliance.co.uk/v1/firm/me/settings" \
  -H "X-Bedrock-Key: bk_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
  "enforceImpactAssessments": true
}'

List Consumer Duty impact assessments

Returns every impact assessment filed by the firm, newest first. Each entry carries the outcome responses, template version, model provider/version (if set), and the users who created and signed off the assessment.

curl -X GET "https://api.bedrockcompliance.co.uk/v1/firm/me/impact-assessments" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

File a draft impact assessment

Create a new DRAFT impact assessment for an AI use case. When outcomes are omitted, the draft is seeded with empty responses and a LOW risk rating for each of the four PRIN 2A outcome areas so the reviewer can fill them in progressively.

curl -X POST "https://api.bedrockcompliance.co.uk/v1/firm/me/impact-assessments" \
  -H "X-Bedrock-Key: bk_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
  "useCase": "<useCase>",
  "description": "<description>",
  "modelProvider": "<modelProvider>",
  "modelVersion": "<modelVersion>",
  "outcomes": {}
}'

Get an impact assessment

curl -X GET "https://api.bedrockcompliance.co.uk/v1/firm/me/impact-assessments/<id>" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

Update or transition an impact assessment

Edits the draft content and/or moves the assessment through its status graph: DRAFT → PENDING_SIGNOFF → APPROVED / REJECTED → SUPERSEDED. Approving requires an authenticated LEAD_REVIEWER or FIRM_ADMIN and produces an IMPACT_ASSESSMENT_APPROVED ledger event. APPROVED and SUPERSEDED assessments are immutable — further edits return 409 CONFLICT.

curl -X POST "https://api.bedrockcompliance.co.uk/v1/firm/me/impact-assessments/<id>" \
  -H "X-Bedrock-Key: bk_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
  "useCase": "<useCase>",
  "description": "<description>",
  "modelProvider": "<modelProvider>",
  "modelVersion": "<modelVersion>",
  "outcomes": {},
  "status": {}
}'

Mark an assessment as superseded

Retires an assessment in favour of a newer one covering the same use case. Superseded assessments are kept for audit trail but no longer count toward the impact-assessment enforcement gate.

curl -X POST "https://api.bedrockcompliance.co.uk/v1/firm/me/impact-assessments/<id>/supersede" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

Get current firm statistics

curl -X GET "https://api.bedrockcompliance.co.uk/v1/firm/me/stats" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

Get immutable backup status for the firm

curl -X GET "https://api.bedrockcompliance.co.uk/v1/firm/me/backup-status" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

List API keys for the authenticated firm

curl -X GET "https://api.bedrockcompliance.co.uk/v1/firm/me/api-keys" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

Generate a new API key

curl -X POST "https://api.bedrockcompliance.co.uk/v1/firm/me/api-keys" \
  -H "X-Bedrock-Key: bk_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "<name>"
}'

Revoke an API key

curl -X DELETE "https://api.bedrockcompliance.co.uk/v1/firm/me/api-keys/<keyId>" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

List webhook endpoints for the authenticated firm

curl -X GET "https://api.bedrockcompliance.co.uk/v1/firm/me/webhooks" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

Register a webhook endpoint

curl -X POST "https://api.bedrockcompliance.co.uk/v1/firm/me/webhooks" \
  -H "X-Bedrock-Key: bk_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
  "url": "https://example.com",
  "events": []
}'

Deactivate a webhook endpoint

curl -X DELETE "https://api.bedrockcompliance.co.uk/v1/firm/me/webhooks/<id>" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

List AI models tracked for the firm

Returns every distinct (provider, version) pair that has appeared on a review job, with usage counts and outcome rates. The registry is the entry point for AI accountability evidence — every advice record is tagged with the model that produced it.

curl -X GET "https://api.bedrockcompliance.co.uk/v1/firm/me/models" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

Detect drift across all AI models

Compares the trailing window against the prior baseline window for every (provider, version) the firm uses. Surfaces statistically significant changes in rejection rate, modification rate, and reviewer annotation frequency. Each model needs at least 5 completed jobs in both windows for a signal to fire.

curl -X GET "https://api.bedrockcompliance.co.uk/v1/firm/me/models/drift" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

Weekly quality timeline for a model version

Returns weekly buckets of approval / modification / rejection rates and reviewer annotation counts for a specific model version. Use this to drill into a drift signal and see exactly when the regression started.

curl -X GET "https://api.bedrockcompliance.co.uk/v1/firm/me/models/<provider>/<version>/timeline" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

List users for the firm

curl -X GET "https://api.bedrockcompliance.co.uk/v1/firm/me/users" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

Invite a user to the firm

curl -X POST "https://api.bedrockcompliance.co.uk/v1/firm/me/users" \
  -H "X-Bedrock-Key: bk_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
  "name": "<name>",
  "email": "<email>",
  "fcaRef": "<fcaRef>",
  "qualifications": [],
  "role": "<role>"
}'

Deactivate a user

curl -X DELETE "https://api.bedrockcompliance.co.uk/v1/firm/me/users/<id>" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

List incidents for the firm

Returns the 200 most recent incidents for the authenticated firm, newest first. Each incident includes any remediation actions attached to it and the user who reported it.

curl -X GET "https://api.bedrockcompliance.co.uk/v1/firm/me/incidents" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

Log a new incident

Creates a new incident and enqueues an INCIDENT_LOGGED record to the immutable ledger. The incident snapshot (id, title, severity, category, affected jobs/records, reportedAt) is hashed and anchored to the ledger chain.

curl -X POST "https://api.bedrockcompliance.co.uk/v1/firm/me/incidents" \
  -H "X-Bedrock-Key: bk_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
  "title": "<title>",
  "description": "<description>",
  "severity": {},
  "category": {},
  "affectedReviewJobIds": [],
  "affectedLedgerRecordIds": []
}'

Incident statistics and trends

Aggregate counts (total, open, resolved, critical), a breakdown by category, and a 12-month trend of incident volume. Open counts include OPEN, INVESTIGATING, and REMEDIATING states.

curl -X GET "https://api.bedrockcompliance.co.uk/v1/firm/me/incidents/stats" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

Get an incident with remediations

Returns a single incident scoped to the authenticated firm, with all attached remediation actions and the user who reported it.

curl -X GET "https://api.bedrockcompliance.co.uk/v1/firm/me/incidents/<id>" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

Update incident status or root cause

Updates an incident's status and/or root cause. Uses POST rather than PATCH for consistency with the rest of this namespace. When the status transitions to RESOLVED or CLOSED the server stamps resolvedAt and enqueues an INCIDENT_RESOLVED record to the immutable ledger.

curl -X POST "https://api.bedrockcompliance.co.uk/v1/firm/me/incidents/<id>" \
  -H "X-Bedrock-Key: bk_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
  "status": {},
  "rootCause": "<rootCause>"
}'

Add a remediation action to an incident

Attach a new remediation action (with optional owner and due date) to an existing incident.

curl -X POST "https://api.bedrockcompliance.co.uk/v1/firm/me/incidents/<id>/remediations" \
  -H "X-Bedrock-Key: bk_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
  "description": "<description>",
  "ownerName": "<ownerName>",
  "dueAt": "<dueAt>"
}'

Update a remediation action

Update the status of an existing remediation. completedAt is server-controlled: it is set when the status becomes COMPLETED and cleared otherwise.

curl -X POST "https://api.bedrockcompliance.co.uk/v1/firm/me/incidents/<id>/remediations/<remediationId>" \
  -H "X-Bedrock-Key: bk_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
  "status": {}
}'

Vulnerability handling report (FG21/1)

Aggregated handling of FCA FG21/1 vulnerability drivers (health, life event, capability, financial resilience) across review jobs. Includes per-flag outcome breakdowns, counts of specialist reviewers and reviews awaiting senior sign-off, and a sample of recent flagged jobs.

curl -X GET "https://api.bedrockcompliance.co.uk/v1/firm/me/vulnerability" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

Bias / fairness report across client segments

Splits completed review outcomes by client segment dimensions (age band, risk profile, product type, etc.) and flags segments whose rejection or modification rates diverge materially from the baseline or exceed an absolute rejection threshold. Flags come in two kinds: 'divergence' (rate differs from the dimension baseline) and 'absolute' (rate exceeds the configured threshold).

curl -X GET "https://api.bedrockcompliance.co.uk/v1/firm/me/bias" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

Consumer Duty outcome metrics

Returns Consumer Duty outcome and control-evidence metrics for a reporting period: outcome breakdown, SLA compliance, reviewer workload, document-type breakdown, monthly outcome buckets, and a ledger crypto anchor covering the window. Includes the previous period's outcomes and SLA for comparison.

curl -X GET "https://api.bedrockcompliance.co.uk/v1/firm/me/reports/consumer-duty" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

List generated reports

Returns the audit log of previously-generated reports. Optionally filter by report type.

curl -X GET "https://api.bedrockcompliance.co.uk/v1/firm/me/reports" \
  -H "X-Bedrock-Key: bk_live_your_api_key"

Log a generated report

Record that a report was generated, for audit purposes. The server parses and normalises periodFrom/periodTo before persisting, and tags the entry with the authenticated user as the generator.

curl -X POST "https://api.bedrockcompliance.co.uk/v1/firm/me/reports" \
  -H "X-Bedrock-Key: bk_live_your_api_key" \
  -H "Content-Type: application/json" \
  -d '{
  "type": {},
  "periodFrom": "<periodFrom>",
  "periodTo": "<periodTo>",
  "metadata": {}
}'