---
title: "List controls"
method: GET
path: "/v1/projects/{project_id}/compliance/controls"
tags: ["compliance"]
---

# List controls

`GET /v1/projects/{project_id}/compliance/controls`

## Request

- Base URL: `https://api.connic.co`
- URL: `https://api.connic.co/v1/projects/{project_id}/compliance/controls`
- Auth: HTTP bearer

List compliance controls for the project or one AI system.

Required permission: `compliance.view`.

## Path parameters

- `project_id` string, uuid, required

## Query parameters

- `system_id` string, uuid, nullable: Only controls for this AI system.

## Response `200`

Successful Response

- ComplianceControlResponse[]
  - `id` string, uuid, required
  - `project_id` string, uuid, required: Project the control belongs to.
  - `system_id` string, uuid, required: AI system the control belongs to.
  - `assessment_id` string, uuid, nullable, required: Approved assessment that last generated or refreshed the control.
  - `obligation_key` string, required: Stable key of the obligation, such as `provider-logging`.
  - `catalog_version` string, required: Version of the obligation catalog the control was generated from.
  - `article` string, required: Article reference, such as `Article 12`.
  - `title` string, required: Short statement of the obligation.
  - `family` string, required: Obligation group, such as `classification`, `transparency` or `high-risk provider`.
  - `applicability_rationale` string, required: Why the obligation applies, based on the assessment answers.
  - `implementation_type` 'connic' | 'customer' | 'external' | 'shared', required: Who is accountable: `connic` when the platform provides the mechanism, `customer` for your organization, `shared` when platform features support an obligation you own, `external` when handled outside the platform.
  - `status` 'gap' | 'configured' | 'needs_evidence' | 'not_applicable', required: Implementation status.
  - `evidence_status` 'missing' | 'partial' | 'verified' | 'not_required', required: State of the supporting evidence.
  - `owner` string, nullable, required: Person or team responsible for the control.
  - `evidence_notes` string, nullable, required: Notes on the supporting evidence.
  - `exception_rationale` string, nullable, required: Why the control does not apply.
  - `residual_risk` string, nullable, required: Risk that remains with the control in place.
  - `next_review_at` string, date-time, nullable, required: When the control is next due for review.
  - `connic_links` object[], required: connic features that support the control, each with `feature`, `href`, `status` (`configured` or `available`) and `evidence_count`.
  - `last_refreshed_at` string, date-time, nullable, required: When the control was last generated or refreshed.
  - `created_at` string, date-time, required
  - `updated_at` string, date-time, required

## Other responses

- `401`: Missing or invalid API key.
- `403`: The API key lacks the required permission or access to the environment.
- `422`: Validation Error
- `429`: Rate limit exceeded.

---

[API](https://skmtc.dev/connic/apis/connic-api.md) · [All operations](https://skmtc.dev/connic/apis/connic-api/llms.txt) · [OpenAPI document](https://skmtc.dev/connic/apis/connic-api/revisions/482932da5fbe?raw)