compliance

Update control

Update a compliance control's status, evidence, and review details.

A not_applicable status requires an exception_rationale.

Required permission: compliance.manage.

patch/v1/projects/{project_id}/compliance/controls/{control_id}

Request

  • Base URL: https://api.connic.co
  • URL: https://api.connic.co/v1/projects/{project_id}/compliance/controls/{control_id}
  • Auth: HTTP bearer

Path parameters

project_idstring uuid required

ID of the project the API key belongs to.

control_idstring uuid required

Control ID from GET /compliance/controls.

Request body

status'gap' | 'configured' | 'needs_evidence' | 'not_applicable' nullable

Implementation status. not_applicable requires exception_rationale. Cannot be null.

evidence_status'missing' | 'partial' | 'verified' | 'not_required' nullable

State of the supporting evidence. Cannot be null.

ownerstring nullable

Person or team responsible for the control.

evidence_notesstring nullable

Notes on the supporting evidence.

exception_rationalestring nullable

Why the control does not apply. Required when status is not_applicable.

residual_riskstring nullable

Risk that remains with the control in place.

next_review_atstring date-time nullable

When the control is next due for review.

Response

Successful Response

idstring uuid required
project_idstring uuid required

Project the control belongs to.

system_idstring uuid required

AI system the control belongs to.

assessment_idstring uuid nullable required

Approved assessment that last generated or refreshed the control.

obligation_keystring required

Stable key of the obligation, such as provider-logging.

catalog_versionstring required

Version of the obligation catalog the control was generated from.

articlestring required

Article reference, such as Article 12.

titlestring required

Short statement of the obligation.

familystring required

Obligation group, such as classification, transparency or high-risk provider.

applicability_rationalestring required

Why the obligation applies, based on the assessment answers.

implementation_type'connic' | 'customer' | 'external' | 'shared' required

Who is accountable: connic when the platform provides the mechanism, customer for your organization, shared when platform features support an obligation you own, external when handled outside the platform.

status'gap' | 'configured' | 'needs_evidence' | 'not_applicable' required

Implementation status.

evidence_status'missing' | 'partial' | 'verified' | 'not_required' required

State of the supporting evidence.

ownerstring nullable required

Person or team responsible for the control.

evidence_notesstring nullable required

Notes on the supporting evidence.

exception_rationalestring nullable required

Why the control does not apply.

residual_riskstring nullable required

Risk that remains with the control in place.

next_review_atstring date-time nullable required

When the control is next due for review.

connic_linksobject[] required

Connic features that support the control, each with feature, href, status (configured or available) and evidence_count.

last_refreshed_atstring date-time nullable required

When the control was last generated or refreshed.

created_atstring date-time required
updated_atstring date-time required

Changes

No recorded changes to this operation across all 1 revision of this API.