Skip to content
Vendorica Developer Docs

List controls

GET
/controls
curl --request GET \
  --url 'https://api.vendorica.com/v1/controls?page=1&limit=100&sortBy=name&sortOrder=asc&hasOwner=true' \
  --header 'Authorization: Bearer <token>'

The organization’s control register, offset-paginated. Filter by status, domain, frameworkCode (repeatable — ?frameworkCode=dora,nis2 and the repeated form both work) and ownerUserId, or pass hasOwner=false for the accountability-gap query: controls with nobody assigned. frameworkCode values are DATA (reg_frameworks.code), so an unknown code matches no mapping and honestly returns nothing rather than erroring.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Query Parameters

Section titled “Query Parameters”
page
integer
default: 1 >= 1 <= 10000
limit
integer
default: 100 >= 1 <= 500
sortBy
string
Allowed values: name displayId status effectiveDate createdAt updatedAt
sortOrder
string
default: desc
Allowed values: asc desc
search
string
>= 1 characters <= 255 characters
frameworkCode
Array<string> | null
<= 100 items
ownerUserId
string format: uuid
hasOwner
string | null
Allowed values: true false all
status
Array<string> | null
<= 100 items
Allowed values: ok needs_evidence expiring_soon expired deactivated
domain
Array<string> | null
<= 100 items
businessUnitId
string format: uuid

Responses

Section titled “Responses”

200

Section titled “200”

Success

Media typeapplication/json
object
success
required
boolean
data
required
Array<object>
object
id
required
string format: uuid
organizationId
required
string format: uuid
displayId
required
string | null
name
required
string
description
required
string | null
status
required
string | null
domain
required
string | null
ownerUserId
required
string | null format: uuid
effectiveDate
required
string | null
createdAt
required
string | null format: date-time
updatedAt
required
string | null format: date-time
key
additional properties
timestamp
required
string format: date-time
requestId
string
message
string
pagination
object
page
required
integer
limit
required
integer
total
required
integer
totalPages
required
integer
Example
{
  "success": true,
  "data": [
    {
      "id": "6a29a939-5a95-47e1-8b32-88c6b28d4966",
      "organizationId": "70377764-0d50-4592-8772-9343805dd8c5",
      "displayId": "string",
      "name": "string",
      "description": "string",
      "status": "string",
      "domain": "string",
      "ownerUserId": "b390946b-1599-414b-88d8-e458096f7cd4",
      "effectiveDate": "string",
      "createdAt": "2026-08-19T09:41:12.004Z",
      "updatedAt": "2026-08-19T09:41:12.004Z"
    }
  ],
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H",
  "message": "string",
  "pagination": {
    "page": 1,
    "limit": 1,
    "total": 1,
    "totalPages": 1
  }
}

400

Section titled “400”

Validation error

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Bad request",
  "code": "BAD_REQUEST",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

401

Section titled “401”

Unauthorized

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Unauthorized",
  "code": "UNAUTHORIZED",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

403

Section titled “403”

Forbidden — missing scope

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Forbidden",
  "code": "FORBIDDEN",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

404

Section titled “404”

Not found

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Resource not found",
  "code": "NOT_FOUND",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

429

Section titled “429”

Rate limit exceeded

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Too many requests",
  "code": "TOO_MANY_REQUESTS",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}