Get a control

Returns one control including description, mapped frameworks, requirements, and authorship metadata. Optional expansions via fields: complianceOverview, mappedArtifacts, mappedRisks. mappedArtifacts includes policy, evidence, and automated tests only. File download URLs are never returned. Requires scope control:read or control:write.

curl -X GET "https://api.scrut.io/v1/controls/2aa1b21e-4705-47cd-b1a7-e74ed4808bc9?fields=complianceOverview%2CmappedArtifacts%2CmappedRisks" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer YOUR_API_TOKEN (JWT)"

import requests
import json

url = "https://api.scrut.io/v1/controls/2aa1b21e-4705-47cd-b1a7-e74ed4808bc9?fields=complianceOverview%2CmappedArtifacts%2CmappedRisks"
headers = {
  "Content-Type": "application/json",
  "Authorization": "Bearer YOUR_API_TOKEN (JWT)"
}

response = requests.get(url, headers=headers)
print(response.json())

const response = await fetch("https://api.scrut.io/v1/controls/2aa1b21e-4705-47cd-b1a7-e74ed4808bc9?fields=complianceOverview%2CmappedArtifacts%2CmappedRisks", {
  method: "GET",
  headers: {
  "Content-Type": "application/json",
  "Authorization": "Bearer YOUR_API_TOKEN (JWT)"
}
});

const data = await response.json();
console.log(data);

package main

import (
    "fmt"
    "net/http"
)

func main() {

    req, err := http.NewRequest("GET", "https://api.scrut.io/v1/controls/2aa1b21e-4705-47cd-b1a7-e74ed4808bc9?fields=complianceOverview%2CmappedArtifacts%2CmappedRisks", nil)
    if err != nil {
        panic(err)
    }

    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN (JWT)")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        panic(err)
    }
    defer resp.Body.Close()

    fmt.Println("Response Status:", resp.Status)
}

require 'net/http'
require 'json'

uri = URI('https://api.scrut.io/v1/controls/2aa1b21e-4705-47cd-b1a7-e74ed4808bc9?fields=complianceOverview%2CmappedArtifacts%2CmappedRisks')
http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true

request = Net::HTTP::Get.new(uri)
request['Content-Type'] = 'application/json'
request['Authorization'] = 'Bearer YOUR_API_TOKEN (JWT)'

response = http.request(request)
puts response.body

{
  "data": {
    "controlId": "2aa1b21e-4705-47cd-b1a7-e74ed4808bc9",
    "controlCode": "DCH-14.2",
    "controlName": "Transfer Authorizations",
    "controlDescription": "Authorize and record transfers of sensitive data before they leave the environment.",
    "controlDomain": "Data Classification and Handling",
    "functionGrouping": "govern",
    "controlScope": "out_of_scope",
    "controlCompliancePercentage": 40,
    "status": "non_compliant",
    "assignees": [
      {
        "name": "Alex Rivera",
        "email": "alex@example.com",
        "isPrimary": true
      }
    ],
    "entities": [
      {
        "entityId": "8fa88e7b-eb16-4999-854a-2f407958740a",
        "entityName": "Organization Wide"
      }
    ],
    "mappedFrameworks": [
      {
        "frameworkId": "14c4c45d-6c31-4097-a02a-ad9cfd04850e",
        "frameworkName": "SOC 2"
      }
    ],
    "controlQuestions": "Are transfer authorizations reviewed before data leaves the environment?",
    "outOfScopeReason": "This control does not apply to the selected entity.",
    "addedBy": {
      "name": "Alex Rivera",
      "email": "alex@example.com"
    },
    "addedOn": 1704067200000,
    "lastModifiedBy": {
      "name": "Alex Rivera",
      "email": "alex@example.com"
    },
    "modifiedOn": 1704067200000,
    "mappedRequirements": [
      {
        "frameworkName": "SOC 2",
        "requirementCode": "CC6.1",
        "requirementName": "Logical Access Security"
      }
    ],
    "complianceOverview": [
      {
        "frameworkName": "SOC 2",
        "entities": [
          {
            "entityId": "8fa88e7b-eb16-4999-854a-2f407958740a",
            "entityName": "Organization Wide"
          }
        ],
        "controlStatus": "non_compliant",
        "artifactCompliancePercentage": 40
      }
    ],
    "mappedArtifacts": [
      {
        "name": "Information Security Policy",
        "artifactType": "policy",
        "artifactStatus": "not_uploaded",
        "entities": [
          {
            "entityId": "8fa88e7b-eb16-4999-854a-2f407958740a",
            "entityName": "Organization Wide"
          }
        ],
        "frameworks": [
          "SOC 2"
        ],
        "isRelevant": true,
        "justification": "This control does not apply to the selected entity."
      }
    ],
    "mappedRisks": [
      {
        "riskId": "c3d4e5f6-a7b8-4901-8c2d-3e4f5a6b7c8d",
        "riskName": "Unauthorized access to production systems"
      }
    ]
  },
  "meta": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

{
  "error": {
    "code": "validation_failed",
    "message": "Request validation failed.",
    "details": [
      {
        "field": "status",
        "message": "status contains unknown value(s): unknown"
      }
    ]
  },
  "meta": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

{
  "error": {
    "code": "unauthorized",
    "message": "Missing, malformed, or invalid Bearer token.",
    "details": []
  },
  "meta": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

{
  "error": {
    "code": "token_stale",
    "message": "The access token is stale; obtain a new token.",
    "details": []
  },
  "meta": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

{
  "error": {
    "code": "rate_limit_exceeded",
    "message": "Rate limit exceeded.",
    "details": [
      {
        "retryAfterSec": 12
      }
    ]
  },
  "meta": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

{
  "error": {
    "code": "upstream_unavailable",
    "message": "Upstream service is unavailable.",
    "details": [
      {
        "dependency": "frameworks",
        "issue": "Failed to process frameworks."
      }
    ]
  },
  "meta": {
    "requestId": "550e8400-e29b-41d4-a716-446655440000"
  }
}

GET

/v1/controls/{controlId}

GET

Base URLstring

Target server for requests. Edit to use your own host.

Bearer Token (JWT)

Bearer Tokenstring

Required

Machine access token from POST /oauth/token. Send Authorization: Bearer $SCRUT_ACCESS_TOKEN on every /v1 request.

path

controlIdstring

Required

Control identifier returned by list and get endpoints.

query

fieldsstring

Optional expansions. Default get response already includes core metadata; use this to add complianceOverview, mappedArtifacts, or mappedRisks. Pass a comma-separated list (no spaces required). Allowed values: complianceOverview, mappedArtifacts, mappedRisks.