---
title: "Mark a control Not Applicable"
method: POST
path: "/api/v1/companies/{companyId}/controls/{controlId}/mark-na"
tags: ["Controls"]
---

# Mark a control Not Applicable

`POST /api/v1/companies/{companyId}/controls/{controlId}/mark-na`

## Request

- Base URL: `https://comply.strac.io`
- URL: `https://comply.strac.io/api/v1/companies/{companyId}/controls/{controlId}/mark-na`
- Auth: HTTP bearer

Marks a control N/A with a reason. Writes an append-only audit-log row (`v1_mark_control_na`).

Role gate: owner / admin.

Scope: `evidence:write`.

## Path parameters

- `companyId` string, required
- `controlId` string, required

## Request body

- object
  - `reason` string, required: Why the control does not apply. Your auditor sees it word for word. ISO 27001 clauses 4 to 10 cannot be marked not applicable.

## Response `200`

Mark a control Not Applicable

---

[API](https://skmtc.dev/strac/apis/strac-comply-api.md) - [All operations](https://skmtc.dev/strac/apis/strac-comply-api/llms.txt) - [OpenAPI document](https://skmtc.dev/strac/apis/strac-comply-api/revisions/d5558b64eeeb?raw)