ComplianceControl
/api/v1/compliance-controlsA control statement against a framework (SOC 2, ISO 27001, etc.).
listgetcreateupdateSchema
| Field | Type | Notes |
|---|---|---|
| id* | uuid | Server-assigned ULID with type prefix (e.g. per_…). |
| tenant_id* | string | Tenant scope — auto-stamped from the caller's JWT. |
| app_id | string | App scope. Stamped ONLY when the caller's JWT was minted for a specific Application (integration API keys). Absent for human-user sessions. Filters reads when present. |
| created_at* | date-time | Server stamp. |
| updated_at* | date-time | Server stamp; updated on every patch. |
| created_by | uuid | Person id from the caller's JWT (sub). |
| updated_by | uuid | Person id from the last writer's JWT (sub). |
| source | string | Provenance tag — defaults to 'edm'. |
| source_type | enum | frontend | backend | server | system | apiWhere the write originated. Defaults to 'api'. |
| is_deleted | boolean | Soft-delete flag. Excluded from default list queries. |
| deleted_at | date-time | Stamped when soft-deleted; null otherwise. |
| deleted_by | uuid | Person id who soft-deleted; null otherwise. |
| schema_version | number | Document schema version. Bumped on incompatible writes. |
| framework | string | The compliance or regulatory framework this control belongs to. 'custom' is for organization-specific internal controls not mapped to a standard framework. |
| control_id | string | Framework-native control identifier (e.g. 'CC6.1' for SOC2, 'A.9.2.1' for ISO 27001, 'PR.AC-1' for NIST CSF, 'Req 8.3' for PCI DSS). |
| title | string | Short title of the control as defined in the framework or customized for internal use. |
| description | string | Detailed description of what this control requires and how the organization has implemented or plans to implement it. |
| category | string | Control category or domain within the framework (e.g. 'Access Control', 'Encryption', 'Incident Response', 'Change Management'). |
| owner | uuid | UUID of the Person responsible for implementing and maintaining this control. The control owner provides evidence and attests to control effectiveness. |
| status | string | Current implementation status. 'partial' means the control is partially implemented and remediation work is ongoing. 'not_applicable' requires documented justif |
| evidence | json | Evidence artifacts collected to demonstrate this control is implemented and operating effectively. |
| last_assessed_at | date-time | ISO 8601 timestamp of the most recent control assessment or evidence review. |
| next_review_at | date-time | ISO 8601 timestamp when this control is next scheduled for review or re-assessment. |
| linked_asset_ids | json | UUIDs of TechnologyAssets to which this control applies. Used to scope the control to specific systems and generate per-asset compliance dashboards. |
| framework_id | uuid | ID of the Framework this control belongs to. |
| control_ref | string | Framework-specific control reference number. |
| name | string | Short name of the control. |
| objective | string | Control objective statement. |
| implementation_guidance | string | Recommended steps for implementing this control. |
| implementation_maturity | enum | not_implemented | partial | implemented | optimizedCurrent maturity level of this control's implementation. |
| effectiveness | number | Effectiveness score between 0 and 1. |
| owner_id | uuid | ID of the Person who owns this control. |
| next_review_date | date-time | Date when this control is next due for review. |
| evidence_ids | json | IDs of Evidence records that support this control. |
| mapped_control_ids | json | IDs of controls in other frameworks that this control maps to. |
| mitigated_risk_ids | json | IDs of Risk records that this control mitigates. |
| related_document_ids | json | IDs of related documents. |
| knowledge_entity_id | uuid | Bridge to the Knowledge Graph entity for this control. |
| custom_fields | json | Tenant-defined additional fields. |
| tags | json | Free-form tags for filtering. |
API
client.complianceControls.*Loading manifest…