--- title: "Update Control Implementation" method: PUT path: "/api/controls/v1/control-implementations/{guid}" tags: ["Control Implementations"] --- # Update Control Implementation `PUT /api/controls/v1/control-implementations/{guid}` ## Request - Base URL: `https://hostname` - URL: `https://hostname/api/controls/v1/control-implementations/{guid}` - Auth: OAuth 2 - Client credentials - Token URL: `https://{hostname}/api/access/v1/oauth/token` scopes: `CONTROL` Use this API to update the attributes of a specific control implementation. > 🗒 Things to Know > > - The [Update Control](https://developer.onetrust.com/onetrust/reference/updatecontrolusingput_1) API can be used to update the attributes of a control in the Controls Library. ## Path parameters - `guid` string, uuid, required ## Request body - TechRiskComplianceITRiskManagementControlImplementationUpdateRequest - `status` 'Pending' | 'Implemented' | 'NotDoing' | 'Retired', required: New status of implemented control. - `effectiveness` 'Effective' | 'Ineffective' | 'Planned': Effectiveness of implemented control. - `effectivenessId` string, uuid: Identifier of the effectiveness associated with control implementation. - `note` string: Notes on implemented control. - `deadline` string, date: Deadline associated with the control implementation. Format (yyyy-MM-dd). - `controlOwnerId` string, uuid: Identifier (UUID) of the owner of control implementation. - `maturityId` string, uuid: Identifier of the maturity associated with control implementation. - `statusId` string, uuid: Identifier of the control implementation Status. - `attributes` object: Custom Attributes of control implementation. - `controlOwnerIds` string[]: List of Identifier (UUID) of the owners of control implementation. - `controlApproverIds` string[]: List of Identifier (UUID) of the approver of control implementation. - `implementationCategoryId` string, uuid: The identifier of the category tied to the control Implementation. Optional if no category needed or if category name provided. - `implementationDescription` string: Description of the control implementation. - `implementationGuidance` string: Implementation Guidance of the control Implementation. - `implementationName` string: The name of the control Implementation. - `controlOwners` TechRiskComplianceITRiskManagementBasicDetail[]: List of owners of control implementation. - `id` string, uuid: Identifier (GUID) - `name` string: Name - `implementationCategoryName` string: The name of the category tied to the control Implementation. ## Response `200` OK - TechRiskComplianceITRiskManagementControlImplementationDto - `id` string, uuid, required: GUID of Control Implementation. - `number` integer, required: Numeric identifier for Control Implementation. - `organizationId` string, uuid, required: The identifier (GUID) of the organization implementation. - `orgGroupName` string, required: Organization name with which control implementation is created. - `primaryEntity` TechRiskComplianceITRiskManagementControlEntityInformation, required - `id` string, uuid, required: The identifier (GUID) of the related entity. - `name` string, required: The name of the entity. - `type` 'Risks' | 'Assets' | 'ProcessingActivities' | 'Vendors' | 'Entities', required: The type of the related entity. - `controlEntityType` TechRiskComplianceITRiskManagementControlEntityTypeInformation, required - `id` string, required: ID of the entity type. This can be Assets, Entities, Custom Object GUID in the form of String. - `label` string: Name of the EntityType. - `translationKey` string: Translation Key of EntityType ID. - `moduleName` string: Module Name of EntityType. - `seeded` boolean: The parameter is true for Base Entity Type and false for Custom Object/Entity Types by default. - `organizationId` string, uuid: The identifier (GUID) of the organization which contains the entity. - `softInherited` boolean: Indicates if this control is soft-inherited or not. - `relationshipLabel` 'IMPLEMENTED_ON' | 'MITIGATES' | 'LEVERAGED_BY' | 'INCLUDED_IN' | 'RELATED_TO': The RelationshipType to the control entity. - `isPrimary` boolean: Indicates if entity is primary. - `control` TechRiskComplianceITRiskManagementControlExtInformation, required - `id` string, uuid, required: The identifier of the control. - `identifier` string, required: The identifier of the control. - `name` string, required: The name of the control. - `description` string: Description of the control. - `orgGroupId` string, uuid, required: The identifier of the organization the master control is linked to. In general, this is the top organization in the organization hierarchy. - `orgGroupName` string, required: Organization Group Name of Control. - `frameworkId` string, uuid: Identifier (GUID) of the framework on the control. - `categoryId` string, uuid: Identifier (GUID) of the category on the control. - `categoryName` string: Name of the category on the control. - `categoryNameKey` string: Identifier used for translation of Category Name. - `frameworkName` string: Name of the framework of the control. - `attributes` object: Custom attributes for the control. These attributes are custom to the tenant. - `implementationGuidance` string: Implementation guidance of the control requirement. - `status` 'Pending' | 'Implemented' | 'NotDoing' | 'Suggested', required: The status of the control. - `suggestion` 'Suggested' | 'Accepted' | 'Rejected': The suggestion status of the control. Used by Athena. - `effectiveness` 'Effective' | 'Ineffective' | 'Planned': The effectiveness of the control. - `effectivenessInfo` TechRiskComplianceITRiskManagementBasicEntityReference - `id` string, uuid, required: Identifier of the entity (UUID). - `name` string, required: The name of the entity. - `nameKey` string: Name of the entity used for translation. - `note` string: Notes used for the control. This is free text to contain any additional details which may be needed. - `deadline` string, date: The deadline for the control. - `maturity` TechRiskComplianceITRiskManagementBasicEntityReference - `id` string, uuid, required: Identifier of the entity (UUID). - `name` string, required: The name of the entity. - `nameKey` string: Name of the entity used for translation. - `statusInfo` TechRiskComplianceITRiskManagementBasicEntityReference - `id` string, uuid, required: Identifier of the entity (UUID). - `name` string, required: The name of the entity. - `nameKey` string: Name of the entity used for translation. - `owner` TechRiskComplianceITRiskManagementBasicEntityReference - `id` string, uuid, required: Identifier of the entity (UUID). - `name` string, required: The name of the entity. - `nameKey` string: Name of the entity used for translation. - `owners` TechRiskComplianceITRiskManagementBasicEntityReference[]: List of Implemented Control Owners. - `id` string, uuid, required: Identifier of the entity (UUID). - `name` string, required: The name of the entity. - `nameKey` string: Name of the entity used for translation. - `approvers` TechRiskComplianceITRiskManagementBasicEntityReference[]: List of Implemented Control approvers. - `id` string, uuid, required: Identifier of the entity (UUID). - `name` string, required: The name of the entity. - `nameKey` string: Name of the entity used for translation. - `createdBy` string, uuid: The user or operation the control was created by. - `createDt` string, date-time: The date on which the control implementation was created. - `lastModifiedBy` string, uuid: The user or process the control was last modified by (GUID). - `lastModifiedDate` string, date-time: The date the control was last modified. - `controlObjectivesCount` integer: count of total control objectives linked. - `attributes` object: Implemented Custom Attributes. - `entityLinks` TechRiskComplianceITRiskManagementControlEntityInformation[]: Entity Details of the implementation links. - `id` string, uuid, required: The identifier (GUID) of the related entity. - `name` string, required: The name of the entity. - `type` 'Risks' | 'Assets' | 'ProcessingActivities' | 'Vendors' | 'Entities', required: The type of the related entity. - `controlEntityType` TechRiskComplianceITRiskManagementControlEntityTypeInformation, required - `id` string, required: ID of the entity type. This can be Assets, Entities, Custom Object GUID in the form of String. - `label` string: Name of the EntityType. - `translationKey` string: Translation Key of EntityType ID. - `moduleName` string: Module Name of EntityType. - `seeded` boolean: The parameter is true for Base Entity Type and false for Custom Object/Entity Types by default. - `organizationId` string, uuid: The identifier (GUID) of the organization which contains the entity. - `softInherited` boolean: Indicates if this control is soft-inherited or not. - `relationshipLabel` 'IMPLEMENTED_ON' | 'MITIGATES' | 'LEVERAGED_BY' | 'INCLUDED_IN' | 'RELATED_TO': The RelationshipType to the control entity. - `isPrimary` boolean: Indicates if entity is primary. - `workflow` TechRiskComplianceITRiskManagementBasicDetails - `id` string, uuid: Identifier (GUID) of the entity. - `name` string: Name of the entity. - `nameKey` string: Name Key of the entity. - `workflowStage` TechRiskComplianceITRiskManagementWorkflowStageBasicDetails - `id` string, uuid: Identifier (GUID) of the entity. - `name` string: Name of the entity. - `nameKey` string: Name Key of the entity. - `currentStageApprovers` TechRiskComplianceITRiskManagementStageApproverBasicDetails[] - `id` string, uuid: stage approver id. - `firstName` string: stage approver first name. - `lastName` string: stage approver last name. - `approvedTimeStamp` string, date-time: approved time. - `status` string: stage approved status. - `deleteType` 'SOFT': Control implementation delete type. - `controlImplementationName` string: Control Implementation Name of the implemented control. - `controlImplementationDescription` string: Control Implementation Description of the implemented control. - `controlImplementationGuidance` string: Control Implementation Guidance of the implemented control. - `controlImplementationCategoryId` string, uuid: Control Implementation Category of the implemented control. - `controlImplementationCategoryName` string: Control Implementation Category Name of the implemented control. - `controlImplementationCategoryNameKey` string: Control Implementation Name of the implemented control. - `controlImplementationOrigin` string: Control Implementation Origin of the implemented control. - `externalImplementationURL` string: External ImplementationURL of the implemented control. - `externalControlImplementation` boolean: is this an external control implementation. - `duplicateEvidenceTaskImplPresent` boolean: Duplicate evidence task implementation present. - `hasMoreThanOneInvLinks` boolean: Implementation has more than one inventory links. - `inventoriesCount` integer: Related inventories count. - `risksCount` integer: Related risks count. ## Other responses - `400`: Bad Request - `401`: Unauthorized - `403`: Forbidden - `429`: Too Many Requests. For more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview). - `500`: Internal Server Error --- [API](https://skmtc.dev/onetrust/apis/tech-risk-compliance-it-risk-management.md) - [All operations](https://skmtc.dev/onetrust/apis/tech-risk-compliance-it-risk-management/llms.txt) - [OpenAPI document](https://skmtc.dev/onetrust/apis/tech-risk-compliance-it-risk-management/revisions/d0bfd2a3c53e?raw)