---
title: "Framework rollup"
method: GET
path: "/api/v1/companies/{companyId}/controls/summary"
tags: ["Controls"]
---

# Framework rollup

`GET /api/v1/companies/{companyId}/controls/summary`

## Request

- Base URL: `https://comply.strac.io`
- URL: `https://comply.strac.io/api/v1/companies/{companyId}/controls/summary`
- Auth: HTTP bearer

Org-wide rollup: per-framework control counts + the tests / policies / documents / integrations evidence dimensions, plus overall totals. Can take 5–30s on large tenants. Two keys describe how the numbers were computed: `percentageBasis: "audit-ready-controls"` means every `percentage` is a ready-controls ratio (completed / applicable), not an evidence-weighted average; `personnelSignalBasis: "not-evaluated"` means this endpoint did not resolve the personnel background-check signal, so a control whose required background-check evidence would be credited from your People view reads unmet here while `GET /controls`, which does resolve it, may show it satisfied. Expect the two endpoints to differ by that amount if you have no background-check integration. When SOC 2 is active, `observationPeriod` is the SOC 2 Type II observation period the app shows: start, earliest close (necessary, not sufficient), day of the period, and `windowAnchor` (`management` = a date you set; `signup` or `first-evidence` = our proposal). Absent when SOC 2 is not active or the period could not be read.

Scope: `compliance:read`.

## Path parameters

- `companyId` string, required

## Response `200`

Framework rollup

---

[API](https://skmtc.dev/strac/apis/strac-comply-api.md) - [All operations](https://skmtc.dev/strac/apis/strac-comply-api/llms.txt) - [OpenAPI document](https://skmtc.dev/strac/apis/strac-comply-api/revisions/d5558b64eeeb?raw)