diff --git a/compliance-monitor/README.md b/compliance-monitor/README.md
index 3a487ad7b..12e5f97db 100644
--- a/compliance-monitor/README.md
+++ b/compliance-monitor/README.md
@@ -183,23 +183,14 @@ The final field is the desired state; the other fields are used to determine the
 (within one report, version and check uniquely determine a result; the scope is given here as well
 in case reports at some point contain multiple scopes).
 
-### GET /status/{subject}
+### GET /status
 
-Returns the current status of the subject. Use the `Accept` header to select desired content type:
-
-- `text/html` (default): a snippet of HTML suitable for the end user;
-- `image/png`: a PNG image of a badge;
-- `application/json`: a short summary in JSON format.
+Returns the current status of all subjects in JSON format.
 
 Query parameters:
 
+- `subject` (optional): restrict subject
 - `scopeuuid` (optional): restrict scope
-- `version` (optional): restrict version
-- `privileged_view` (optional `0` or `1`, default `0`): request privileged view (see below)
-
-If the privileged view is requested, then this request needs to be authenticated (via basic auth),
-either for the same subject or for some account with role `read_any`. This view will immediately
-show any non-pass result, whereas otherwise, such a result needs to be verified manually.
 
 ### GET /metrics/{subject}
 
diff --git a/compliance-monitor/monitor.py b/compliance-monitor/monitor.py
index 9d759d2b0..dbe26b78d 100755
--- a/compliance-monitor/monitor.py
+++ b/compliance-monitor/monitor.py
@@ -548,18 +548,15 @@ def convert_result_rows_to_dict2(
 @app.get("/status")
 async def get_status(
     request: Request,
-    account: Annotated[Optional[tuple[str, str]], Depends(auth)],
     conn: Annotated[connection, Depends(get_conn)],
-    subject: str = None, scopeuuid: str = None, version: str = None,
+    subject: str = None, scopeuuid: str = None,
 ):
-    check_role(account, subject, ROLES['read_any'])
-    # note: text/html will be the default, but let's start with json to get the logic right
     accept = request.headers['accept']
     if 'application/json' not in accept and '*/*' not in accept:
         # see https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/406
         raise HTTPException(status_code=406, detail="client needs to accept application/json")
     with conn.cursor() as cur:
-        rows2 = db_get_relevant_results2(cur, subject, scopeuuid, version, approved_only=False)
+        rows2 = db_get_relevant_results2(cur, subject, scopeuuid, approved_only=False)
     return convert_result_rows_to_dict2(rows2, get_scopes(), include_report=True)