<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Building Compliance Training Programs

## Learning Management Systems

### SCORM Cloud API

| Endpoint | Method | Description |
|----------|--------|-------------|
| `/api/v2/courses` | POST | Import SCORM/xAPI course |
| `/api/v2/registrations` | POST | Create learner registration |
| `/api/v2/registrations/{id}/launch` | GET | Generate launch link |
| `/api/v2/registrations/{id}` | GET | Get completion status |
| `/api/v2/reporting/accountInfo` | GET | Account usage statistics |

### xAPI (Tin Can) Statements

| Verb | Description | Example |
|------|-------------|---------|
| `completed` | Learner finished activity | Course module completed |
| `passed` | Learner met passing criteria | Assessment score ≥ 85% |
| `failed` | Learner below threshold | Assessment score < 85% |
| `attempted` | Learner started activity | Module launched |
| `experienced` | Learner interacted with content | Video watched, page viewed |

### Common LMS Platforms

| Platform | API Type | SCORM Support | xAPI Support |
|----------|----------|---------------|-------------|
| Cornerstone | REST API | 1.2, 2004 | Yes |
| SAP SuccessFactors | OData | 1.2, 2004 | Yes |
| Docebo | REST API | 1.2, 2004 | Yes |
| Moodle | REST API | 1.2, 2004 | Via plugin |
| Canvas | REST API | 1.2 | Via LTI |

## Compliance Evidence Standards

| Standard | Evidence Requirement |
|----------|---------------------|
| SOC 2 (CC1.4) | Training completion records with dates |
| PCI DSS (12.6.2) | Annual acknowledgment of security policy |
| ISO 27001 (A.7.2.2) | Documented awareness program and records |
| HIPAA (§164.530) | Training documentation retained 6 years |
| FedRAMP (AT-2) | Role-based training with assessment records |

## Assessment Frameworks

| Type | Use Case | Passing Threshold |
|------|----------|------------------|
| Pre-Assessment | Baseline knowledge measurement | N/A (diagnostic) |
| Post-Assessment | Knowledge verification | ≥ 85% |
| Practical Exercise | Skill demonstration | Pass/Fail rubric |
| Tabletop Exercise | Decision-making evaluation | Facilitator-assessed |
| Phishing Simulation | Applied awareness testing | < 5% click rate |
