--- title: "Get List of Control Implementations by Entity" method: POST path: "/api/controls/v1/entities/{entityId}/control-implementations/pages" tags: ["Control Implementations"] --- # Get List of Control Implementations by Entity `POST /api/controls/v1/entities/{entityId}/control-implementations/pages` Use this API to retrieve a list of all control implementations by entity, such as by assets, processing activities, legal entities, risks, and vendors. ## Path parameters - `entityId` string, uuid, required ## Query parameters - `page` integer - `size` integer - `sort` 'number,asc' | 'number,desc' | 'entityName,asc' | 'entityName,desc' | 'entityType,asc' | 'entityType,desc' | 'controlIdentifier,asc' | 'controlIdentifier,desc' | 'controlName,asc' | 'controlName,desc' | 'frameworkName,asc' | 'frameworkName,desc' | 'categoryName,asc' | 'categoryName,desc' | 'effectiveness,asc' | 'effectiveness,desc' | 'maturityName,asc' | 'maturityName,desc' | 'status,asc' | 'status,desc' | 'primaryEntityName,asc' | 'primaryEntityName,desc' | 'primaryEntityType,asc' | 'primaryEntityType,desc' | 'createdDate,asc' | 'createdDate,desc' | 'lastModifiedDate,asc' | 'lastModifiedDate,desc' ## Request body - TechRiskComplianceITRiskManagementSearchCriteriaInformation — unresolved $ref ## Response `200` OK - TechRiskComplianceITRiskManagementPageControlImplementationEntityDto - `content` TechRiskComplianceITRiskManagementControlImplementationEntityDto[] — The list of items for the current page. - `id` string, uuid, required — GUID of Control Implementation Entity Link. - `implementationId` string, uuid, required — GUID of Control Implementation. - `number` integer, required — Numeric identifier for Control Implementation. - `organizationId` string, uuid, required — Organization GUID. - `control` TechRiskComplianceITRiskManagementControlExtInformation, required - `id` string, uuid, required — The identifier of the control. - `identifier` string, required — The identifier of the control. - `name` string, required — The name of the control. - `description` string — Description of the control. - `orgGroupId` string, uuid, required — The identifier of the organization the master control is linked to. In general, this is the top organization in the organization hierarchy. - `orgGroupName` string, required — Organization Group Name of Control. - `frameworkId` string, uuid — Identifier (GUID) of the framework on the control. - `categoryId` string, uuid — Identifier (GUID) of the category on the control. - `categoryName` string — Name of the category on the control. - `categoryNameKey` string — Identifier used for translation of Category Name. - `frameworkName` string — Name of the framework of the control. - `attributes` object — Custom attributes for the control. These attributes are custom to the tenant. - `implementationGuidance` string — Implementation guidance of the control requirement. - `status` 'Pending' | 'Implemented' | 'NotDoing' | 'Suggested' | 'Retired' | 'Archived', required — Implemented Control Status. - `statusInfo` TechRiskComplianceITRiskManagementBasicEntityReference - `id` string, uuid, required — Identifier of the entity (UUID). - `name` string, required — The name of the entity. - `nameKey` string — Name of the entity used for translation. - `effectiveness` 'Effective' | 'Ineffective' | 'Planned' — Implemented Control Effectiveness value. - `effectivenessInfo` TechRiskComplianceITRiskManagementBasicEntityReference - `id` string, uuid, required — Identifier of the entity (UUID). - `name` string, required — The name of the entity. - `nameKey` string — Name of the entity used for translation. - `note` string — Implemented Control Notes. - `deadline` string, date — Deadline - `maturity` TechRiskComplianceITRiskManagementBasicEntityReference - `id` string, uuid, required — Identifier of the entity (UUID). - `name` string, required — The name of the entity. - `nameKey` string — Name of the entity used for translation. - `owner` TechRiskComplianceITRiskManagementBasicEntityReference - `id` string, uuid, required — Identifier of the entity (UUID). - `name` string, required — The name of the entity. - `nameKey` string — Name of the entity used for translation. - `owners` TechRiskComplianceITRiskManagementBasicEntityReference[] — List of Implemented Control Owner. - `id` string, uuid, required — Identifier of the entity (UUID). - `name` string, required — The name of the entity. - `nameKey` string — Name of the entity used for translation. - `approvers` TechRiskComplianceITRiskManagementBasicEntityReference[] — List of Implemented Control Approver. - `id` string, uuid, required — Identifier of the entity (UUID). - `name` string, required — The name of the entity. - `nameKey` string — Name of the entity used for translation. - `createdBy` string, uuid — Created By. - `createDt` string, date — Created Date. - `lastModifiedBy` string, uuid — Last Modified By. - `lastModifiedDate` string, date — Last Modified on Date. - `suggestion` 'Suggested' | 'Accepted' | 'Rejected' — Suggestion - `attributes` object — Implemented Custom Attributes. - `entity` TechRiskComplianceITRiskManagementControlEntityInformation - `id` string, uuid, required — The identifier (GUID) of the related entity. - `name` string, required — The name of the entity. - `type` 'Risks' | 'Assets' | 'ProcessingActivities' | 'Vendors' | 'Entities', required — The type of the related entity. - `controlEntityType` TechRiskComplianceITRiskManagementControlEntityTypeInformation, required - `id` string, required — ID of the entity type. This can be Assets, Entities, Custom Object GUID in the form of String. - `label` string — Name of the EntityType. - `translationKey` string — Translation Key of EntityType ID. - `moduleName` string — Module Name of EntityType. - `seeded` boolean — The parameter is true for Base Entity Type and false for Custom Object/Entity Types by default. - `organizationId` string, uuid — The identifier (GUID) of the organization which contains the entity. - `softInherited` boolean — Indicates if this control is soft-inherited or not. - `relationshipLabel` 'IMPLEMENTED_ON' | 'MITIGATES' | 'LEVERAGED_BY' | 'INCLUDED_IN' | 'RELATED_TO' — The RelationshipType to the control entity. - `isPrimary` boolean — Indicates if entity is primary. - `inventoryRelationshipType` string — Inventory hierarchy relationship. - `deleteType` 'SOFT' — Soft delete status. - `controlImplementationName` string — Control Implementation Name of the implemented control. - `controlImplementationDescription` string — Control Implementation Description of the implemented control. - `controlImplementationGuidance` string — Control Implementation Guidance of the implemented control. - `controlImplementationCategoryId` string, uuid — Control Implementation Category of the implemented control. - `controlImplementationCategoryName` string — Control Implementation Category Name of the implemented control. - `controlImplementationCategoryNameKey` string — Control Implementation Name of the implemented control. - `controlImplementationOrigin` string — Control Implementation Origin of the implemented control. - `externalImplementationURL` string — External ImplementationURL of the implemented control. - `externalControlImplementation` boolean — is this an external control implementation. - `relatedEntities` TechRiskComplianceITRiskManagementImplementationEntityLinkDto[] — EntityLinks associated with control implementation. - `id` string, uuid — GUID of control implementation entity link. - `sourceId` string, uuid — GUID of control implementation. - `sourceName` string — Control implementation name. - `sourceType` string — Control implementation. - `targetId` string, uuid — GUID of target entity. - `targetName` string — Target entity name. - `targetType` string — Target entity type. - `organizationId` string, uuid — GUID of organization. - `label` 'IMPLEMENTED_ON' | 'MITIGATES' | 'LEVERAGED_BY' | 'INCLUDED_IN' | 'RELATED_TO' — Relationship label. - `primary` boolean - `inventoriesCount` integer — Related inventories count. - `risksCount` integer — Related risks count. - `empty` boolean — The flag to check if the entity is empty or not. - `first` boolean — The flag to check if the entity is first entity or not. - `last` boolean — The flag to check if the entity is last entity or not. - `number` integer — The number associated with the result. - `numberOfElements` integer — Total number of elements in the result. - `pageable` TechRiskComplianceITRiskManagementPageable - `offset` integer — The page offset. - `pageNumber` integer — Page number of the results list (0….N). - `pageSize` integer — Number of records per page (0…N). - `paged` boolean — The flag to check if the result is paged or not. - `sort` TechRiskComplianceITRiskManagementSort - `empty` boolean — The flag to check if the result is empty or not. - `sorted` boolean — The flag to check if the result is sorted or not. - `unsorted` boolean — The flag to check if the result is unsorted or not. - `unpaged` boolean — The flag to check if the result is unpaged or not. - `sort` TechRiskComplianceITRiskManagementSort - `empty` boolean — The flag to check if the result is empty or not. - `sorted` boolean — The flag to check if the result is sorted or not. - `unsorted` boolean — The flag to check if the result is unsorted or not. - `totalPages` integer — Total number of pages in the result list. - `totalElements` integer — Total number of elements in the result. - `size` integer — Size of the result list. ## Other responses - `400` — Bad Request - `401` — Unauthorized - `403` — Forbidden - `429` — Too Many Requests. For more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview). - `500` — Internal Server Error --- [API](https://skmtc.dev/onetrust/apis/platform-access-management.md) · [All operations](https://skmtc.dev/onetrust/apis/platform-access-management/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/onetrust/platform-access-management/revisions/21de3aa0b170/schema)