---
title: "This resource returns risk standard controls associated with a TOE id and a particular custom or industry standard."
method: GET
path: "/v1/compliance/controls/{toe_id}"
tags: ["Compliance"]
---

# This resource returns risk standard controls associated with a TOE id and a particular custom or industry standard.

`GET /v1/compliance/controls/{toe_id}`

This resource returns risk standard controls associated with a TOE id and a particular custom or industry standard.  The risk standard id can be obtained from the /v1/compliance/{toe_id} response. Some will be mapped to RiskRecon security domain and criteria so will include the ratings for these domain/criteria and the TOE being queried.

## Path parameters

- `toe_id` string, required

## Query parameters

- `risk_standard_id` integer, required

## Response `200`

OK

- RiskStandardControls
  - `data` object — Risk response data.
    - `id` integer — The unique identifier for the RiskStandard.
    - `type` string — The type of object returned.
    - `attributes` object
      - `id` integer — The unique identifier for the RiskStandard.
      - `risk_standard` string, nullable — The risk Standard name.
      - `risk_standard_controls` RiskStandardControl[] — An array of risk standard controls.
        - `id` integer — The unique identifier for the RiskStandardControl.
        - `risk_standard_control` string — The risk Standard Control name.
        - `description` string, nullable — A description of the risk standard control.
        - `security_domains` RiskStandardControlDomainCriteriaRatingCounts[]
          - `name` string — The Domain or Criteria name.
          - `rating` string — The Domain or Criteria rating.
          - `rated` boolean — Is this Domain or Criteria rated?
          - `rating_numeric` number — The Domain or Criteria rating Numeric.
          - `issue_count` integer, nullable — The issue count.
          - `total_count` integer, nullable — The total count.
          - `issue_rate` number, nullable — The issue rate.
        - `security_criteria` RiskStandardControlDomainCriteriaRatingCounts[]
          - `name` string — The Domain or Criteria name.
          - `rating` string — The Domain or Criteria rating.
          - `rated` boolean — Is this Domain or Criteria rated?
          - `rating_numeric` number — The Domain or Criteria rating Numeric.
          - `issue_count` integer, nullable — The issue count.
          - `total_count` integer, nullable — The total count.
          - `issue_rate` number, nullable — The issue rate.

## Other responses

- `400` — Something was wrong with the request
- `401` — Authentication information was missing or invalid or the user is not authorized to access resource or perform the associated action.
- `404` — The URI didn't match an existing resource.

---

[API](https://skmtc.dev/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.dev/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)