---
title: "This resource returns risk standard controls associated with a TOE id and a particular custom or industry standard."
method: GET
path: "/v1/compliance/controls/{toe_id}"
tags: ["Compliance"]
---

# This resource returns risk standard controls associated with a TOE id and a particular custom or industry standard.

`GET /v1/compliance/controls/{toe_id}`

## Request

- Base URL: `https://api.sandbox.riskrecon.com`
- URL: `https://api.sandbox.riskrecon.com/v1/compliance/controls/{toe_id}`
- Auth: HTTP bearer

This resource returns risk standard controls associated with a TOE id and a particular custom or industry standard.  The risk standard id can be obtained from the /v1/compliance/{toe_id} response. Some will be mapped to RiskRecon security domain and criteria so will include the ratings for these domain/criteria and the TOE being queried.

## Path parameters

- `toe_id` string, required

## Query parameters

- `risk_standard_id` integer, required

## Response `200`

OK

- RiskStandardControls
  - `data` object: Risk response data.
    - `id` integer: The unique identifier for the RiskStandard.
    - `type` string: The type of object returned.
    - `attributes` object
      - `id` integer: The unique identifier for the RiskStandard.
      - `risk_standard` string, nullable: The risk Standard name.
      - `risk_standard_controls` RiskStandardControl[]: An array of risk standard controls.
        - `id` integer: The unique identifier for the RiskStandardControl.
        - `risk_standard_control` string: The risk Standard Control name.
        - `description` string, nullable: A description of the risk standard control.
        - `security_domains` RiskStandardControlDomainCriteriaRatingCounts[]
          - `name` string: The Domain or Criteria name.
          - `rating` string: The Domain or Criteria rating.
          - `rated` boolean: Is this Domain or Criteria rated?
          - `rating_numeric` number: The Domain or Criteria rating Numeric.
          - `issue_count` integer, nullable: The issue count.
          - `total_count` integer, nullable: The total count.
          - `issue_rate` number, nullable: The issue rate.
        - `security_criteria` RiskStandardControlDomainCriteriaRatingCounts[]
          - `name` string: The Domain or Criteria name.
          - `rating` string: The Domain or Criteria rating.
          - `rated` boolean: Is this Domain or Criteria rated?
          - `rating_numeric` number: The Domain or Criteria rating Numeric.
          - `issue_count` integer, nullable: The issue count.
          - `total_count` integer, nullable: The total count.
          - `issue_rate` number, nullable: The issue rate.

## Other responses

- `400`: Something was wrong with the request
- `401`: Authentication information was missing or invalid or the user is not authorized to access resource or perform the associated action.
- `404`: The URI didn't match an existing resource.

---

[API](https://skmtc.dev/recordedfuture/apis/mastercard-riskrecon-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/mastercard-riskrecon-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/mastercard-riskrecon-api/revisions/212ef0eeee9b?raw)