---
title: "Reports"
description: "Export a report on a project's compliance with an applied policy, and understand what its .zip and PDF contain."
source: "Guardian Platform"
---
## About reports

A Guardian report is a point-in-time record of a project's compliance status toward a specific policy.

Each report comes as a .zip and includes a complete record of the project's compliance process toward a given policy — every declaration, review, and any associated attachments.

Organization and Project Owners can generate this shareable, audit-ready document once the applied policy has a published version and a declaration on at least one control.

Key concepts and actions associated with reports include:

- [What to expect in a report](#what-to-expect-in-a-report)
- [Understanding the report .zip](#understanding-the-report-zip)
- [Understanding the report PDF](#understanding-the-report-pdf)
- [Exporting a report](#exporting-a-report)

## What to expect in a report

A report captures the actions your team has taken against a policy's controls, along with the cryptographic proofs that make those actions verifiable. This includes every declaration and review made against each control, the attachments submitted, and the identities of the contributors involved.

Not every action in Guardian carries this cryptographic integrity, and only actions that do are represented in a report. For a full breakdown of which actions have integrity associated with them, see [integrity actions](./integrity-actions.mdx).

## Understanding the report .zip

When you export a report, the Guardian Platform generates a .zip containing three things:

- **report.pdf** — a human-readable compliance report (described below).
- **manifest.json** — a machine-readable record of every signed action in the report, including the CIDs and DIDs that make its contents independently verifiable. See [Governance Manifest](./key-concepts.mdx#governance-manifest) in Key Concepts.
- **attachments/** — a folder containing every file submitted as attachments across the policy's declarations and reviews, plus any attachments submitted by indicator declarations.

Together, these let anyone confirm the report is authentic and unaltered — the PDF presents the compliance record, and the manifest and attachments allow that record to be cryptographically verified.

## Understanding the report PDF

The report PDF presents the project's compliance record towards a given policy in a readable, shareable format. The Guardian Platform signs the PDF through Auth Service as it is generated. It opens with a table of contents and is organized as follows:

- **Report Overview** — the project and policy the report covers, with their descriptions, the policy version, when the policy was applied, and when the report was generated.
- **Compliance Status** — a summary table showing how many of the policy's controls, and what percentage, fall into each status at the time of generation. Every status is listed, including those with no controls.
- **Controls** — the core of the report. An index lists each control with its page number. Each control then lists its code, title, description, citations, CID, and status — followed by every declaration and review made against it in chronological order — including the author, timestamp, statement, and the CID of each entry.
- **Citations** — the reference sources cited across the policy's controls.
- **Appendix** — the contributors involved (each with their DID), and a complete list of attachments, each identified by its CID.

## Exporting a report

Reports are exported one applied policy at a time, from the applied policy's **Overview**. Exporting needs the **Edit Project Settings** permission.

To export a report:

1. In the project sidebar, select the applied policy under **Applied Policies**
2. Select **Export PDF Report** in the page header
3. Choose a **Paper size** — **US Letter**, **US Legal**, or **A4**
4. Select **Export PDF Report**

![The Export PDF Report dialog with the Paper size options US Letter (8.5" × 11", selected), US Legal (8.5" × 14"), and A4 (210mm × 297mm), and the Export PDF Report button.](../../../assets/reports/export-report-dialog.png)

The report downloads as a .zip named after the policy, and the export is recorded in [Activity Logs](./activity-logs.mdx).

The dialog blocks the export, and says why, in two cases:

- The applied policy has no published version to export.
- No control has a declaration yet. Submit a declaration on at least one control first.

To export a report from a script, call the Governance Service at your platform host followed by `/governanceService`. The call needs the **Edit Project Settings** and **View Project Data** permissions on the project, and it accepts your sign-in token or an [API key](./api-keys.mdx) with both scopes. These examples read the key from `GUARDIAN_API_KEY`. First find the applied policy's `cid`:

```bash
curl "https://guardian.example.com/governanceService/api/v1/projects/<project UUID>/policies" \
  -H "Authorization: Bearer $GUARDIAN_API_KEY"
```

```json
[
  {
    "id": 42,
    "name": "AI Governance Baseline",
    "slug": "ai-governance-baseline",
    "cid": "bag…"
  }
]
```

Then pass it in `policyCids`:

```bash
curl -X POST "https://guardian.example.com/governanceService/api/v1/projects/<project UUID>/policies/report" \
  -H "Authorization: Bearer $GUARDIAN_API_KEY" \
  -H "Content-Type: application/json" \
  --data '{"policyCids": ["bag…"], "paper": "a4"}' \
  -o report.zip
```

`paper` is `us-letter` (the default), `us-legal`, or `a4`. The response is the report .zip, or the PDF alone when you add `"format": "pdf"`.

## Related

- [Integrity Actions](./integrity-actions.mdx) — which actions are signed and appear in a report
- [Key Concepts](./key-concepts.mdx#governance-manifest) — how the manifest makes a report independently verifiable
- [Declarations and Reviews](./declarations-and-reviews.mdx) — the statements and attachments a report collects
- [Credentials](./credentials.mdx) — issue a signed attestation that a project met the policy
- [Roles and Permissions](./roles-and-permissions.mdx) — who holds the Edit Project Settings permission
- [PDFGen Overview](../pdfgen/overview.mdx) — the service that renders and signs reports