> ## Documentation Index > Fetch the complete documentation index at: https://developers.conveyour.com/llms.txt > Use this file to discover all available pages before exploring further. # Create a compliance run > Runs a compliance check against one or more contacts. Returns per-contact results inline (sync) or delivers them to a webhook URL (async). Run a compliance check (sync or async) **Permission:** Org **admin** only. Denials read `Manage Compliance`. **Not callable with an API key.** Requires an org **admin**. Service accounts cannot be assigned the admin role and their role cannot be changed, so every API key gets `403`. Only a signed-in admin can call it. **`content_query.released_only` is forced to `true`.** The handler overwrites whatever you send before building the query, so a compliance run always considers released content only. ## OpenAPI ````yaml /api-reference/specs/compliance.json post /api/compliance openapi: 3.1.0 info: title: ConveYour API — Compliance description: >- Run real-time compliance checks on contacts to confirm completed lessons and form submissions. version: 1.0.0 servers: - url: https://{subdomain}.conveyour.com description: Your organization's ConveYour instance variables: subdomain: default: acme description: >- Your organization's slug — the subdomain you sign in on. Replace `acme` with yours: if you sign in at `bigco.conveyour.com`, enter `bigco`. security: - conveyourToken: [] tags: - name: Compliance description: >- Run real-time compliance checks on contacts to confirm completed lessons and form submissions. paths: /api/compliance: post: tags: - Compliance summary: Create a compliance run description: >- Runs a compliance check against one or more contacts. Returns per-contact results inline (sync) or delivers them to a webhook URL (async). Run a compliance check (sync or async) **Permission:** Org **admin** only. Denials read `Manage Compliance`. **Not callable with an API key.** Requires an org **admin**. Service accounts cannot be assigned the admin role and their role cannot be changed, so every API key gets `403`. Only a signed-in admin can call it. **`content_query.released_only` is forced to `true`.** The handler overwrites whatever you send before building the query, so a compliance run always considers released content only. operationId: runAComplianceCheckSyncOrAsync parameters: - $ref: '#/components/parameters/teams' requestBody: required: false content: application/json: schema: type: object properties: group_id: description: ID of a group whose filters define the contact audience. type: string contact_query: description: >- A filter object matching contacts by field values. An empty object `{}` matches all contacts — use with care. type: object additionalProperties: true content_query.lesson_tags.all: description: Lesson must have **every** tag in this list to be in scope. type: array items: type: string content_query.lesson_tags.any: description: >- Lesson must have **at least one** tag in this list to be in scope. type: array items: type: string content_query.completed_after: description: >- Relative time string — only completions after this window count (e.g. `"-1 year"`). type: string content_query.released_only: description: >- When `true`, only lessons released to the contact via campaigns or triggers count. type: boolean content_query.released_after: description: Optional. Only lessons released after this time count. type: string submission_query.enabled: description: Include form submissions in the compliance run. type: boolean submission_query.completed_statuses: description: >- Submission status values that count as done. Default `["completed"]`. type: array items: type: string submission_query.submission_collection_ids: description: >- Limit scoring to specific collection IDs. Empty array includes all collections. type: array items: type: string callback_url: description: >- Set to an HTTPS URL for **async** mode — results are POSTed to your webhook. Omit or send `""` for **sync** mode. type: string include_lessons: description: Include per-lesson detail rows in each contact result. type: boolean include_submissions: description: Include per-submission detail rows in each contact result. type: boolean responses: '200': description: Success. content: application/json: schema: allOf: - $ref: '#/components/schemas/Envelope' - type: object properties: data: $ref: '#/components/schemas/ComplianceRunResult' example: contact_query: badge_number: 1234 content_query: lesson_tags: all: - required-training completed_after: '-1 year' released_only: true submission_query: enabled: true completed_statuses: - completed submission_collection_ids: [] callback_url: '' include_lessons: true include_submissions: true '403': $ref: '#/components/responses/Forbidden' components: parameters: teams: name: teams[] in: query description: >- Team scope for the request, as one or more team ObjectIds. The brackets are required: PHP keeps only the last value for a repeated plain key, so `teams=A&teams=B` silently resolves to B alone. On requests with a JSON body you may send `teams` (no brackets) in the body instead. **Values that are not valid ObjectIds are silently ignored** — a mistyped team ID behaves as if no team was sent. See the [teams section of the API conventions guide](/guides/api-conventions#team-scoping). style: form explode: true schema: type: array items: type: string example: - 64a1b2c3d4e5f6a7b8c9d0ff schemas: Envelope: type: object description: The common response envelope shared by all ConveYour endpoints. properties: status: type: string enum: - ok - failed description: '`ok` on success, `failed` on error.' message: type: string description: Human-readable description of the result. data: description: >- The response payload — an object or an array depending on the endpoint. ComplianceRunResult: type: object description: >- Result of a compliance run. Its keys depend on whether callback_url was supplied (queued vs inline run) and have not been verified field by field. responses: Forbidden: description: >- The token is missing or invalid, or the service account behind it lacks the permission this endpoint requires. content: application/json: example: status: failed message: Lacking necessary permission add_contacts data: permission: add_contacts securitySchemes: conveyourToken: type: apiKey in: header name: x-conveyour-token description: >- Your API key token. Contacts endpoints require a **Server-only — Full API** key — see [Authentication](/quickstart). ```` This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.