Controls API

Access the unified control taxonomy and cross-framework control mappings.

List Unified Controls

GET /api/v1/controls

Returns unified controls with optional filtering.

Query Parameters

Parameter	Type	Default	Description
limit	integer	50	Maximum results (1-200)
offset	integer	0	Pagination offset
category	string	-	Filter by category

Example Request

curl "https://api.clawgrc.com/api/v1/controls?category=Access+Control&limit=10" \
  -H "Authorization: Bearer YOUR_TOKEN"

Example Response

{
  "controls": [
    {
      "id": "uc-uuid",
      "category": "Access Control",
      "code": "AC-001",
      "title": "Logical Access Security",
      "description": "The organization restricts logical access to systems and data based on the principle of least privilege.",
      "created_at": "2025-01-01T00:00:00Z"
    }
  ],
  "total": 45,
  "limit": 10,
  "offset": 0
}

---

Get Unified Control

GET /api/v1/controls/:id

Returns a single unified control with its framework mappings.

Path Parameters

Parameter	Type	Description
id	UUID	Unified control ID

Example Response

{
  "id": "uc-uuid",
  "category": "Access Control",
  "code": "AC-001",
  "title": "Logical Access Security",
  "description": "The organization restricts logical access...",
  "mappings": [
    {
      "framework": "SOC 2 Type II",
      "control_id_code": "CC6.1",
      "title": "Logical and Physical Access Controls",
      "confidence": 0.95
    },
    {
      "framework": "ISO 27001:2022",
      "control_id_code": "A.9.1.1",
      "title": "Access Control Policy",
      "confidence": 0.90
    },
    {
      "framework": "NIST 800-53 Rev 5",
      "control_id_code": "AC-2",
      "title": "Account Management",
      "confidence": 0.92
    }
  ],
  "evidence_requirements": [
    {
      "id": "req-uuid",
      "evidence_type": "screenshot",
      "description": "Screenshot of IAM policy configuration showing least-privilege access",
      "automation_level": "semi_automated",
      "freshness_days": 90
    }
  ]
}

---

List Control Mappings

GET /api/v1/controls/:id/mappings

Returns all framework control mappings for a unified control.

Example Response

{
  "unified_control_id": "uc-uuid",
  "mappings": [
    {
      "id": "mapping-uuid",
      "framework_control_id": "fc-uuid",
      "framework_name": "SOC 2 Type II",
      "control_id_code": "CC6.1",
      "title": "Logical and Physical Access Controls",
      "confidence": 0.95
    }
  ],
  "total": 5
}

The confidence field (0.0-1.0) indicates how closely the framework control aligns with the unified control. A confidence of 1.0 indicates a direct one-to-one mapping.