Org-wide rollup: per-framework control counts + the tests / policies / documents / integrations evidence dimensions, plus overall totals. Can take 5–30s on large tenants. Two keys describe how the numbers were computed: percentageBasis: "audit-ready-controls" means every percentage is a ready-controls ratio (completed / applicable), not an evidence-weighted average; personnelSignalBasis: "not-evaluated" means this endpoint did not resolve the personnel background-check signal, so a control whose required background-check evidence would be credited from your People view reads unmet here while GET /controls, which does resolve it, may show it satisfied. Expect the two endpoints to differ by that amount if you have no background-check integration. When SOC 2 is active, observationPeriod is the SOC 2 Type II observation period the app shows: start, earliest close (necessary, not sufficient), day of the period, and windowAnchor (management = a date you set; signup or first-evidence = our proposal). Absent when SOC 2 is not active or the period could not be read.

Scope: compliance:read.