# Atlas nonCompliantResources endpoint > Source-anchored research for Atlas nonCompliantResources endpoint. Run status: COMPLETED. Parent: [Atlas Resource Policies Cedar](https://llms-explorer.com/tree/atlas-resource-policies-cedar/) · 4 facets · 15 facts · page: https://llms-explorer.com/tree/atlas-noncompliantresources-endpoint/ ## Definitions - The documented success payload is an array containing orgId, resourceId, resourceName, resourceType, and resourcePoliciesCausingNonCompliance; nested entries identify resourcePolicyId, resourcePolicyName, and policiesCausingNonCompliance[].policyId. (medium confidence) (verified as of 2026-10-23) — [source](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-getorgnoncompliantresources) ## How it works - MongoDB recommends proactively monitoring this endpoint because resource policies do not enforce all intermediate or transitional states; downstream failures can leave a temporary non-compliant state. (low confidence) — [source](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md) ## Comparisons and alternatives - A practical monitoring pattern is to poll this endpoint, feed results into configuration-drift alerting, and track remediation or documented exceptions; this is operational guidance rather than a documented push-notification feature. (medium confidence) — [source](https://howtoharden.com/guides/mongodb-atlas/) ## Facts and statements - GET /api/atlas/v2/orgs/{orgId}/nonCompliantResources returns non-compliant resources for an organization; MongoDB’s Go SDK index exposes the same route as GetNonCompliantResources. (high confidence) — [source](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-getorgnoncompliantresources) - The API reference lists Organization Member as the role requirement. orgId is required and is a 24-hexadecimal string. (low confidence) (verified as of 2026-10-23) — [source](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-getorgnoncompliantresources) - The documented resourceType values are PROJECT, CLUSTER, DEPRECATED_PROJECT and DEPRECATED_CLUSTER; do not assume a separate NETWORK enum from informal descriptions of network violations. (low confidence) (verified as of 2026-10-23) — [source](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-getorgnoncompliantresources) - The endpoint documents envelope and pretty boolean query options, both defaulting to false. Its default response example is a JSON array. (low confidence) (verified as of 2026-10-23) — [source](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-getorgnoncompliantresources) - Applying a resource policy does not automatically remediate existing resources. Foojay’s August 13, 2025 walkthrough reports that an existing 0.0.0.0/0 entry remained and was flagged after a wildcard-blocking policy was applied. (medium confidence) — [source](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md) - Existing autoscaling limits can permit automatic scaling beyond a newly applied policy even though manual scaling beyond policy limits is blocked. MongoDB recommends identifying these resources with nonCompliantResources and updating them. (low confidence) (verified as of 2026-10-23) — [source](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md) - Integrate nonCompliantResources polling with configuration-drift monitoring and route returned resources to remediation; MongoDB recommends proactive monitoring, and How to Harden explicitly recommends wiring the query into drift alerting. (medium confidence) — [source](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md) - The Resource Policies endpoint set shares an ORGANIZATION-scoped token bucket: capacity 500 and refill 250 tokens per 60 seconds. nonCompliantResources shares that bucket with resource-policy CRUD and validation endpoints. (low confidence) (verified as of 2026-10-14) — [source](https://www.mongodb.com/docs/atlas/api/api-rate-limit.md) - The API reference includes the CLI command atlas api resourcePolicies getNonCompliantResources --help and examples for bearer-token and HTTP Digest authentication. (low confidence) (verified as of 2026-10-23) — [source](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-getorgnoncompliantresources) - The API reference lists Organization Member as its role requirement and documents service-account bearer authentication and API-key Digest authentication examples. (low confidence) (verified as of 2026-10-23) — [source](https://www.mongodb.com/docs/api/doc/atlas-admin-api-v2/operation/operation-getorgnoncompliantresources) - MongoDB recommends proactive monitoring: downstream failures can leave intermediate states non-compliant, and clusters with pre-existing autoscaling limits beyond a new policy can continue scaling automatically beyond those boundaries even though manual scaling is constrained. (low confidence) (verified as of 2026-10-23) — [source](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md) - After an Atlas Resource Policy is applied, Atlas only allows changes to an existing non-compliant cluster that bring it into compliance; if the policy blocks AWS, MongoDB's example says the cluster can only be switched to Azure or Google Cloud. (low confidence) (verified as of 2026-10-23) — [source](https://www.mongodb.com/docs/atlas/atlas-resource-policies.md)