Scheduled Reports

Scope

Scheduled reporting matters when posture needs to stay visible without forcing operators to rebuild the same package every week. The public guide keeps the cadence model and leaves private export mechanics out.

Audience: System operators, IT administrators, L1/L2 support staff Last Updated: 2026-07-09

Overview

Scheduled PDF artifacts use the same report-branding resolver as on-demand PDF downloads. Direct MSP white-label branding or an active white-label owner can add both the MSP company name and a valid PNG/JPEG logo to the PDF header. Delivery retries and manual resends reuse the stored artifact bytes from the last successful generation; they do not re-fetch the logo until the next scheduled generation run.

Getting Started

Prerequisites

• Meridian.manage permission to create, edit, or delete reports.
• Meridian.view permission to view the report list.
• Meridian.audit permission in addition to Meridian.manage when the schedule type is Audit Report.
• The scheduled_reports feature must be enabled on your license plan.
• At least one compliance program must exist to scope program-specific reports.

Managing Scheduled Reports

Creating a Scheduled Report

Steps:

1. Navigate to Reporting > Scheduled Reports. Settings > Scheduled Reports is a secondary shortcut to the same route when you start from account setup.

2. Click New Schedule.

3. In the modal, fill in: - Report Type: Select from Compliance Readiness, Executive Summary, Risk Report, or Audit Report. - Program: Select the target compliance program. Audit Report schedules require a program because the audit cycle is validated against that program. - Audit Cycle: Required for Audit Report. Meridian only accepts cycles that belong to the selected program. - Schedule: Choose a preset (Weekly Monday 9am, Monthly 1st 9am, Quarterly) or switch to Custom for a raw cron expression. - Recipients: Add recipients using the picker (max 50). Use Add an internal user to pick a Meridian user of your account; their email becomes a recipient chip. To add an external address, its domain must be on your tenant’s recipient allowlist (see §3.5) — type the address in the external field and click Add external. External recipients are flagged in the chip list. Leaving recipients empty generates the configured artifact for download only.
4. Click Create.

Result: The report appears in the list with status Active. It will generate the configured artifact on the defined schedule and email it when recipients are configured.

Pausing a Scheduled Report

When to use: You want to temporarily stop scheduled generation without deleting the schedule.

Steps:

1. In the report list, find the report row.
2. Click the Pause button (pause icon).

Result: Status changes to Paused. No scheduled artifacts are generated until you resume.

Resuming a Paused Report

Steps:

1. Find the paused report in the list.
2. Click the Resume button (play icon).

Result: Status returns to Active. Delivery resumes on the next cron trigger.

Deleting a Scheduled Report

Steps:

1. Find the report in the list.
2. Click the Delete button (trash icon).
3. Confirm the deletion in the dialog.

Result: The scheduled report is permanently deleted, along with its delivery history.

Re-enabling a Disabled Schedule

When to use: A schedule auto-disabled after repeated generation failures (you’ll see status Disabled with a last_error, and the platform alert that fired).

Steps:

1. Find the disabled report in the list.
2. Click the Re-enable button (rotate icon).

Result: The failure counter resets, the error clears, and the schedule returns to Active. It fires again on the next cron trigger. Investigate and fix the underlying cause (e.g. a deleted program or audit cycle) before re-enabling, or it will fail again.

Resending Failed Deliveries

Steps:

1. Find the report in the list (it must have a generated artifact).
2. Click the Resend button (send icon).

Report Types

Report Type	Description
Compliance Readiness	Program-scoped compliance posture summary
Executive Summary	High-level program status for leadership
Risk Report	Risk register summary with scores and treatment status
Audit Report	One audit-cycle report pinned to a specific program and cycle
MSP Client Report	Multi-tenant client status (requires MSP addon)

Schedule Reference

Schedules use 5-field cron syntax (UTC):

Presets available in the UI:

Preset	Cron Expression
Weekly (Monday 9am)	0 9 * * 1
Monthly (1st, 9am)	0 9 1 * *
Quarterly (Jan/Apr/Jul/Oct)	0 9 1 1,4,7,10 *

Switch to Custom to enter any valid 5-field cron expression.

Report List Columns

The table displays:

Column	Description
Report	Report type and format
Program	Scoped program name
Schedule	Cron expression
Recipients	Recipient count or single address
Last Generated / Last Delivered	last_generated_at is the most recent generated run. last_delivered_at is the most recent run where every recipient was delivered. A “Last delivered” line shows under the row when set.
Status	Active (green), Paused (yellow), or Disabled (red)

Status Meanings

Status	Meaning	Action Required
Active	Report is scheduled and will generate + deliver on the next cron trigger.	None.
Paused	Generation is suspended. No scheduled artifacts are generated or delivered.	Resume when ready.
Disabled	Generation failed 3 consecutive times. The system stopped trying and emitted an alert.	Investigate last_error, fix the issue, then click Re-enable (§3.6).

Permissions Reference

Permission	Grants
Meridian.view	View the scheduled reports list, delivery ledger, and recipient policy
Meridian.manage	Create, pause, resume, delete, re-enable, resend; update the recipient policy
Meridian.audit	Required to view, download, create, edit, pause, resume, re-enable, resend, or delete audit_report schedules
MSP.view_clients	Required to view, download, create, edit, pause, resume, re-enable, resend, or delete msp_client_report schedules

Generation and Delivery Behavior

The scheduled report job runs every 60 seconds. When a report’s cron schedule fires:

1. Meridian generates the report artifact in the schedule’s configured format using current program or audit data.
2. Meridian stores the generated artifact as its own retained run, labelled with the reporting period it covers, and writes a scheduled_report.generated audit row with the generated format, run id, and period label. Earlier runs are kept — see §8.1.
3. Meridian re-checks each recipient against the recipient policy, emails the generated artifact as an attachment to permitted recipients using the correct filename extension and MIME type, and records a per-recipient delivery row (status, attempts, error). Recipients no longer permitted are recorded as suppressed and not emailed.

Downloading the Latest Generated Artifact

After a scheduled report runs, the most recently generated artifact can be downloaded from Settings -> Scheduled Reports by clicking the row’s Download action. The action is disabled until a generated artifact exists. The same artifact can also be downloaded via the API:

Permission required: Meridian.view plus the report type’s extra permission when present (Meridian.audit for Audit Report, MSP.view_clients for MSP Client Report).

Response: the latest generated artifact in the schedule’s configured format:

• application/pdf for pdf
• application/csv for csv
• application/vnd.openxmlformats-officedocument.spreadsheetml.sheet for xlsx

Every successful download writes scheduled_report.download with the report type, target IDs, artifact size, and safe request metadata before Meridian returns the artifact.

Retrieving an Earlier Period’s Artifact

Each run keeps its own artifact, so you can still get last quarter’s board packet after this quarter’s has been generated.

In the UI: open Settings -> Scheduled Reports and click the row’s Artifact history action. The modal lists every retained run with:

• Generated — when the numbers were read.
• Trigger — Scheduled for a normal run, Catch-up for a missed-run recovery.
• Size, and a Download button for that period.

Via the API:

The list endpoint is paginated (page, page_size) and returns metadata only. Downloading a run returns the same MIME types as the latest-artifact download, with the period label in the filename.

Retention: the 24 most recent runs per schedule are kept. Once a schedule has produced more than that, the oldest artifact is removed when a new one is generated. If you need an artifact beyond that window, download and archive it — a monthly schedule keeps two years, a daily one keeps about three weeks.

The API response confirms delivery is active:

• delivery_mode: email
• delivery_supported: true
• delivery_note: describes recipient restrictions, per-recipient tracking, and automatic retry.

Failure Handling

Generation failures (e.g. the target program was deleted, a report generation or rendering error):

• After 3 consecutive failures, the report transitions to Disabled and a scheduled_report.disabled platform alert is emitted (routed through your notification channels via the event bridge).
• A successful run resets the failure counter to 0. Recover a disabled schedule with Re-enable (§3.6).
• One report’s failure never aborts the rest of the tick — other tenants’ reports still generate and deliver.

Cron Expression Validation

Invalid cron expressions are rejected at create/update time with a 422 error. Only valid 5-field cron expressions (minute hour day-of-month month day-of-week) are accepted.

Recipient Validation

Recipients are validated at create/update time: malformed addresses are rejected (422), and any recipient that is neither an internal Meridian user nor on the external-domain allowlist is rejected with a 422 naming the address. See §3.5 for the allowlist.

Related Documentation