compliance-ownerauditor

Known limitations

Was this page helpful?

No SRP API. The CRA Single Reporting Platform is a web form with no API today. Every filing is a manual copy from Declara's generated packet into that form.
A filed stage cannot be edited in Declara. What was filed stays exactly as it was filed, because it is evidence. Corrections happen on the reporting platform, where a notification stays editable until the final report is submitted, and you record them in Declara: see Track a filing.
Platform status is recorded by hand. Valid, invalid and closed are what you tell Declara the platform shows; without an API it cannot see them itself.
No binary or firmware SBOM generation. Declara reads the SBOMs you produce; it does not analyse binaries to create one.
Only Jira Cloud. Jira Data Center and Server are not supported. See Connect Jira.
No per-event filter for integrations in the interface. Every connected channel receives every event.
A component's supplier is read only from newer SBOMs. Suppliers are kept from SBOMs uploaded after the component review feature was released. Earlier uploads show none until the SBOM is uploaded again.
The upstream duplicate check sees only Declara's advisories. It cannot see a maintainer's private tracker, so no match is not proof nobody has reported it.
No Transparency Exchange API (TEA) endpoints yet. Declara does not serve a TEA API. Each published Trust Center product has a manifest.json with stable ids for its versions, so one can be offered from it when TEA reaches 1.0.
Supplier SBOMs are stored and scored, not merged. An SBOM a supplier uploads is not added to your product's component inventory or matched against advisories. See Request SBOMs from your suppliers.
Dependency-Track import is pull-only. Declara reads BOMs from Dependency-Track once a day and never sends anything to it, and the server must be reachable over HTTPS from the internet. For an on-premises server, use the push script in Connect Dependency-Track.
No gate acknowledgement over the API. The release gate can be read from a pipeline, but releasing over a blocked result is recorded in the app only. The API returns the newest decision as lastDecision. See Gate a release in CI.
No packaged GitHub Action. The release gate and the SBOM upload are calls to the REST API; the docs give a workflow step and a shell script to copy.
User information is drafted in English only. There is no machine translation. Export the structured fields as JSON or CSV for a translator. See Draft the user information.
No signing PKI. Evidence packs, market-surveillance packs and supplier attestations are verifiable by their hash and code on /verify; Declara does not sign them with a certificate. The declaration of conformity is signed by you, not by Declara.
No data from deps.dev or package repositories. A component's maintenance status, last release and maintainers are entered by you in its review; Declara does not fetch them.
Customer notices are never sent from Declara. Declara plans, drafts and reminds; you send each contractual notice from your own address and record it. See Notify business customers.
The MCP server is read-only. An assistant can read a workspace but has no tool to create, change or file anything. See Connect an AI assistant.
Custom domains are unverified without a live domain. The code path for custom domains exists, gated behind the NEXT_PUBLIC_VDP_HOST flag, but hasn't been exercised against a real domain on Vercel's nameservers.