Overview

AdminUI includes a built-in compliance validation tool that checks your clients against configurable compliance rule sets.

Overview

Compliance validation helps you identify clients that do not meet your organization's security and configuration standards. AdminUI ships with two built-in rule sets:

• OAuth 2.1 (draft) — recommended OAuth 2.1 (draft) / OpenID Connect security settings (default).
• FAPI 2.0 — Financial-grade API 2.0 security profile requirements.

You can also add custom rule sets by registering additional IComplianceRuleSetProvider instances at startup.

Configure Rule Set Selection

An authorized user with the All permission can:

• Set a server default rule set under Settings → Compliance.
• Override the rule set per-client on the client edit page.

Users without the All permission see the effective rule set selection in read-only mode.

Validate All Clients and View a Report

From the client list, authorized users can trigger a Validate All action to run compliance validation across all eligible clients. The resulting report groups clients into four buckets:

1. Non-Compliant — At least one non-compliant setting.
2. Recommendation Only — Only recommendation-level findings.
3. Compliant — Fully compliant.
4. Not Evaluated — Validation disabled for this client.

Hidden and reserved clients are excluded from all groups.