Sovereignty finder

Given a set of data-residency and regulatory constraints, returns the set of Azure regions that satisfy them, with provenance for each constraint (cloud type, geography, certification, paired region). Optionally returns a starter Bicep snippet that enforces region restriction.

https://api.farshorelabs.com/sovereignty-finder/v1

Service ID for API key scoping: sovereignty-finder.

POST /v1/find-regions
Authorization: Bearer fsl_live_...
Content-Type: application/json

{
  "residency": {
    "allowedGeographies": ["europe"],
    "disallowedCountries": ["RU", "BY"]
  },
  "compliance": {
    "required": ["iso-27001", "iso-27018", "c5"],
    "preferred": ["tisax"]
  },
  "topology": {
    "pairedRegionRequired": true,
    "availabilityZones": "required"
  },
  "cloud": "azure-public"
}

Response (200):

{
  "matched": [
    {
      "region": "westeurope",
      "geography": "europe",
      "country": "NL",
      "pairedRegion": "northeurope",
      "availabilityZones": 3,
      "certifications": ["iso-27001", "iso-27018", "c5", "tisax"],
      "score": 1.0
    },
    {
      "region": "northeurope",
      "geography": "europe",
      "country": "IE",
      "pairedRegion": "westeurope",
      "availabilityZones": 3,
      "certifications": ["iso-27001", "iso-27018", "c5"],
      "score": 0.92
    }
  ],
  "rejected": [
    {
      "region": "germanywestcentral",
      "reason": "missing-certification",
      "missing": ["tisax"]
    }
  ],
  "asOf": "2026-05-22T03:00:00Z"
}

Generates a Bicep parameter file and policy assignment that restricts deployments to a given allow-list of regions. Useful to lock down a subscription or management group to the regions returned by /find-regions.

Lists the compliance frameworks the service recognises along with their canonical slugs (used in request payloads).