---
title: "GET /v1/orchestrator/controls"
method: GET
path: "/v1/orchestrator/controls"
tags: ["Orchestrator"]
---

# GET /v1/orchestrator/controls

`GET /v1/orchestrator/controls`

If no additional parameters are specified, this lists all controls. If a
 catalog ID and a category name is specified, then only controls containing
 in this category are returned.

## Query parameters

- `catalogId` string
- `categoryName` string
- `filter.assuranceLevels` string[]
- `pageSize` integer
- `pageToken` string
- `orderBy` string
- `asc` boolean

## Response `200`

OK

- ListControlsResponse
  - `controls` Control[]
    - `id` string, required — A short name of the control, e.g. OPS-01, as used in OSCAL; it is not a unique ID!
    - `categoryName` string, required
    - `categoryCatalogId` string, required
    - `name` string, required — Human-readable name of the control
    - `description` string — Description of the control
    - `controls` Control[], required — List of sub - controls - this is in accordance with the OSCAL model.
    - `metrics` Metric[], required — metrics contains either a list of reference to metrics - in this case only the id field of the metric is populated - or a list of populated metric meta-data, most likely returned by the database.
      - `id` string, required — Required. The unique identifier of the metric.
      - `name` string, required — Required. The name of the metric.
      - `description` string, required — The description of the metric
      - `version` string, required — The version of this metric
      - `comments` string — Optional comments that describe the purpose of this metric. They may also describe a scenario in which the metric can be useful.
      - `category` string, required — Semantically, the reference to control catalog category or domain; it must conform to the directory structure of the security-metrics respository
      - `implementation` MetricImplementation — MetricImplementation defines the implementation of an individual metric.
        - `metricId` string, required — The metric which is implemented
        - `lang` 'LANGUAGE_UNSPECIFIED' | 'LANGUAGE_REGO', enum — The language this metric is implemented in
        - `code` string, required — The actual implementation
        - `updatedAt` string, date-time — The last time of update
      - `deprecatedSince` string, date-time — Optional, but required if the metric is removed. The metric is not deleted for backward compatibility and the timestamp is set to the time of removal.
    - `parentControlId` string — Reference to the parent category this control belongs to.
    - `parentControlCategoryName` string
    - `parentControlCategoryCatalogId` string
    - `assuranceLevel` string — An assurance level is not offered by every catalog, therefore it is optional.
  - `nextPageToken` string

## Other responses

- `default` — Default error response

## Changes

> 50 revisions in range; 1 could not be searched.

- **2026-03-04** `97c4541f02f0` — 1 info
  - added the required property `controls/items/metrics/items/name` to the response with the `200` status
- **2025-07-21** `48f235df8ac6` — 1 breaking, 3 warning, 4 info
  - removed the required property `controls/items/metrics/items/name` from the response with the `200` status
  - removed the optional property `controls/items/metrics/items/interval` from the response with the `200` status
  - removed the optional property `controls/items/metrics/items/range` from the response with the `200` status
  - removed the optional property `controls/items/metrics/items/scale` from the response with the `200` status
  - …4 more
- **2025-01-08** `2b79660c20a0` — 4 info
  - the response property `controls/items/metrics/items/id` became required for the status `200`
  - the response property `controls/items/metrics/items/implementation/allOf[#/components/schemas/MetricImplementation]/code` became required for the status `200`
  - the response property `controls/items/metrics/items/implementation/allOf[#/components/schemas/MetricImplementation]/metricId` became required for the status `200`
  - the response property `controls/items/metrics/items/name` became required for the status `200`
- …earlier changes not shown

[Full history](https://skmtc.dev/clouditor/apis/orchestrator-api/changes/v1/orchestrator/controls/get.md)

---

[API](https://skmtc.dev/clouditor/apis/orchestrator-api.md) · [All operations](https://skmtc.dev/clouditor/apis/orchestrator-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/clouditor/orchestrator-api/revisions/6f8ae69f4eb5/schema)