> ## Documentation Index > Fetch the complete documentation index at: https://docs.ankra.ai/llms.txt > Use this file to discover all available pages before exploring further. # Get one imported cluster's aggregated policy violations ## OpenAPI ````yaml https://platform.ankra.app/openapi.json get /api/v1/org/clusters/imported/{cluster_id}/security/policy-violations openapi: 3.1.0 info: title: FastAPI version: 0.1.0 servers: - url: https://platform.ankra.app security: [] tags: - name: Clusters description: Create, inspect and manage clusters, and the stacks deployed on them. - name: Managed Clusters description: Provider-managed control planes, driven through one common surface. - name: Imported Clusters description: Clusters that already existed and were connected to Ankra. - name: Cluster Access description: Kubeconfigs, service-account tokens and per-cluster access grants. - name: Kubernetes description: Read and act on the Kubernetes objects inside a cluster. - name: DigitalOcean Clusters description: Provision and manage DigitalOcean Kubernetes clusters. - name: Hetzner Clusters description: Provision and manage Hetzner Kubernetes clusters. - name: OVH Clusters description: Provision and manage OVH Kubernetes clusters. - name: Scaleway Clusters description: Provision and manage Scaleway Kapsule clusters. - name: UpCloud Clusters description: Provision and manage UpCloud Kubernetes clusters. - name: Applications description: Deploy, configure and observe applications across the fleet. - name: Stack Profiles description: Reusable stack definitions, their versions and sharing. - name: Charts description: Browse the chart catalogue behind stacks and addons. - name: Helm description: Helm registries, credentials and the charts they expose. - name: Executions description: Long-running platform executions and their jobs. - name: Operations description: Cancel in-flight cluster operations and their jobs. - name: Chat description: Conversational sessions, plans and confirmable actions. - name: AI Agent Runs description: Autonomous agent runs and their outcomes. - name: AI Tickets description: The AI ticket board, its sync connections and settings. - name: AI Playbooks description: Reusable playbooks the AI lanes execute. - name: AI Conditions description: Conditions that gate AI autonomy. - name: AI Engineering Handoffs description: Work the AI lanes escalate to a human engineer. - name: AI Environment description: The environment and base stacks AI demos deploy into. - name: Security description: Findings, advisories, SBOMs, compliance and posture. - name: Cost description: Cluster and fleet cost, rate cards and cost settings. - name: Billing description: Subscription and spend caps. - name: Organisation description: Members, invitations, audit logs and organisation settings. - name: Account Tokens description: Personal access tokens for the API and CLI. - name: Credentials description: The shared credential store. - name: Azure Credentials description: Azure credentials and SSH keys. - name: DigitalOcean Credentials description: DigitalOcean credentials and SSH keys. - name: Hetzner Credentials description: Hetzner credentials and SSH keys. - name: OVH Credentials description: OVH credentials and SSH keys. - name: Scaleway Credentials description: Scaleway credentials. - name: UpCloud Credentials description: UpCloud credentials and SSH keys. - name: Data Source Credentials description: Credentials for metrics and log sources. - name: DNS Credentials description: Credentials for DNS providers. - name: DNS description: DNS zones and records, including custom organisation zones. - name: Cloudflare description: Cloudflare domains and the credentials behind them. - name: Variables description: Organisation- and cluster-scoped variables. - name: SOPS description: Encrypt and decrypt values with the organisation SOPS config. - name: Alerts description: Alert integrations and ingest credentials. - name: Notifications description: Notification routes and their delivery targets. - name: Support description: Support tickets. paths: /api/v1/org/clusters/imported/{cluster_id}/security/policy-violations: get: tags: - Security summary: Get one imported cluster's aggregated policy violations operationId: get_imported_cluster_security_policy_violations_api_v1 parameters: - in: path name: cluster_id required: true schema: format: uuid type: string responses: '200': content: application/json: schema: $ref: '#/components/schemas/SecurityPolicyViolationsResponse' description: >- The cluster's aggregated Kyverno policy-report rollup (per-policy pass/warn/fail counts with top offending namespaces) plus the stored audit/enforce mode; not_available with a detail when Kyverno has published nothing. '401': content: application/json: schema: $ref: '#/components/schemas/SecurityDetailError' description: Missing, expired or revoked API token '403': content: application/json: schema: $ref: '#/components/schemas/SecurityPermissionDenied' description: Missing the security.read permission '404': content: application/json: schema: $ref: '#/components/schemas/SecurityDetailError' description: Organization-scoped resource not found '422': content: application/json: schema: $ref: '#/components/schemas/HTTPValidationError' description: Request validation error '500': content: application/json: schema: $ref: '#/components/schemas/SecurityDetailError' description: Internal server error '503': content: application/json: schema: $ref: '#/components/schemas/SecurityAgentDegradedError' description: >- Cluster offline, no agent, or agent timeout (frozen degraded envelope with a Retry-After header) components: schemas: SecurityPolicyViolationsResponse: properties: cluster_id: format: uuid type: string cluster_name: type: string detail: type: string nullable: true policies: items: $ref: '#/components/schemas/SecurityPolicyViolationEntry' type: array policy_mode: enum: - audit - enforce nullable: true type: string report_count: type: integer status: enum: - available - not_available type: string totals: $ref: '#/components/schemas/SecurityPolicyViolationTotals' platform_posture: $ref: '#/components/schemas/SecurityPlatformPostureReport' required: - cluster_id - cluster_name - status - detail - policy_mode - report_count - totals - policies - platform_posture type: object SecurityDetailError: properties: detail: type: string required: - detail type: object SecurityPermissionDenied: properties: detail: enum: - permission_denied type: string permission: type: string scope_type: type: string required: - detail - permission - scope_type type: object HTTPValidationError: properties: detail: items: $ref: '#/components/schemas/ValidationError' title: Detail type: array title: HTTPValidationError type: object SecurityAgentDegradedError: properties: detail: type: string error_code: enum: - CLUSTER_OFFLINE - NO_AGENT - AGENT_TIMEOUT type: string retry_after: type: integer required: - error_code - detail - retry_after type: object SecurityPolicyViolationEntry: properties: category: type: string fail_count: type: integer pass_count: type: integer policy: type: string severity: type: string top_namespaces: items: $ref: '#/components/schemas/SecurityPolicyViolationNamespaceCount' type: array warn_count: type: integer required: - policy - severity - category - pass_count - fail_count - warn_count - top_namespaces type: object SecurityPolicyViolationTotals: properties: error: type: integer fail: type: integer pass: type: integer skip: type: integer warn: type: integer required: - pass - fail - warn - error - skip type: object SecurityPlatformPostureReport: type: object properties: status: enum: - available - not_available type: string detail: type: string nullable: true evaluated_workloads: type: integer exempt_namespaces: items: type: string type: array cache_as_of: type: string format: date-time nullable: true description: >- The newest last_seen_at among the evaluated cache rows: how fresh the inventory the report was computed from is. The evaluation itself runs at request time. totals: $ref: '#/components/schemas/SecurityPolicyViolationTotals' policies: items: $ref: '#/components/schemas/SecurityPolicyViolationEntry' type: array pod_security: $ref: '#/components/schemas/SecurityPlatformPosturePodSecurity' required: - status - detail - evaluated_workloads - exempt_namespaces - cache_as_of - totals - policies - pod_security description: >- The platform's own evaluation of the cluster's workloads (Pod Security Standards and configuration-audit checks) from the resource cache. policies lists the whole check catalogue: pass_count counts workloads the check applied to and did not fail, fail_count the ones it failed, so a check nothing failed shows as passing and a check that applied to nothing shows 0/0. not_available with a detail means the cache is not fully synced or could not be read, never that nothing was found. pod_security is the enforcement half of the block: what the cluster's stored pod-security manifest declares and how many namespaces carry the Pod Security Admission labels. ValidationError: properties: loc: items: anyOf: - type: string - type: integer title: Location type: array msg: title: Message type: string type: title: Error Type type: string required: - loc - msg - type title: ValidationError type: object SecurityPolicyViolationNamespaceCount: properties: fail_count: type: integer namespace: type: string required: - namespace - fail_count type: object SecurityPlatformPosturePodSecurity: type: object properties: status: type: string enum: - available - not_available - not_installed detail: type: string nullable: true mode: type: string enum: - audit - enforce nullable: true description: >- The policy mode the stored pod-security manifest declares; null when the cluster carries no such manifest. standard: type: string enum: - baseline - restricted nullable: true description: >- The Pod Security Standard the manifest declares; null when the cluster carries no manifest or the stored value is not one the profile offers. exempt_namespaces: type: array items: type: string description: >- The namespaces the manifest exempts from the standard, as stored on the cluster (the profile's pod_security_exempt_namespaces). namespaces_total: type: integer description: Namespaces in the cache that are not exempt and not being deleted. namespaces_labelled: type: integer description: >- Of namespaces_total, the ones whose pod-security.kubernetes.io/audit and /warn labels are at the standard or stricter. namespaces_enforced: type: integer description: >- Of namespaces_total, the ones whose pod-security.kubernetes.io/enforce label is at the standard or stricter. required: - status - detail - mode - standard - exempt_namespaces - namespaces_total - namespaces_labelled - namespaces_enforced description: >- Pod Security Admission coverage computed from the resource cache. not_installed means the cluster stores no pod-security manifest (no security baseline, or one from before v5), so there is nothing to measure against; not_available means the namespace cache is not fully synced or could not be read - the counts are then 0 and mean nothing, while mode and standard are still what the platform stores. Labels are counted at the standard or stricter, so a namespace an operator holds at restricted counts as labelled for a baseline cluster. ````