Skip to main content

How does an agent export OSCAL and act for a client tenant?

An agent reads the OSCAL assessment plan at /oscal/assessment-plan-cra.json and a product's OSCAL results from the API. A consultancy agent acts for a client tenant by passing onBehalfOfCompanyId on a user-bound OAuth token, checked against a live membership.

Key takeaways​

  • The clause-to-evidence rules and their sources publish as an OSCAL assessment plan, a standards format a notified body already reads.
  • A product's verdicts export as an OSCAL assessment-results document, built on demand from the append-only store.
  • A consultancy agent acts for a client tenant only through a live CompanyMembership, and the client's own ADMIN can revoke it at any time.
  • A read needs any membership. A write needs an ADMIN membership. A plain API key can never act for another tenant.
  • The tenant that owns the data is always the verified credential or the resolved membership, never a value in the request body.

OSCAL export​

The assessment plan is static and public. It lists every active CRA Annex I clause as a control and cites each source in its back-matter with a CELEX or EN identifier.

GET https://cvdportal.com/oscal/assessment-plan-cra.json

A product's results are customer data, so they are served on demand, scoped to the caller's company.

GET /api/v1/compliance/assessments/oscal?productId=prod_042

The response is an OSCAL assessment-results document. Each finding carries the verdict as its target status, the per-rule results and evidence hashes as an observation, and a link to the mapping version used. Hand it to any OSCAL-aware assessment tool.

Acting for a client tenant​

A consultancy manages several client tenants through a partner seat, which is a CompanyMembership the client's ADMIN grants and can revoke. An agent uses that seat by adding onBehalfOfCompanyId.

GET /api/v1/compliance/gaps?productId=prod_042&onBehalfOfCompanyId=cmp_client

Rules the platform enforces on every call.

  • The credential must be a user-bound OAuth token. A plain API key stays single-tenant.
  • The membership is re-validated on every request, so a revoked seat stops working at once.
  • A read accepts any membership. A write, such as recording an assessment, requires an ADMIN membership in the client tenant.
  • Omit onBehalfOfCompanyId, or set it to your own company, to act for yourself.

The same parameter works on the MCP tools get_conformity_gaps, record_assessment_result, and assess_response, and on the assessment REST endpoints.