---
title: "List Compliance Controls"
method: GET
path: "/api/v1/orgs/{org_id}/compliance/controls"
tags: ["compliance"]
---

# List Compliance Controls

`GET /api/v1/orgs/{org_id}/compliance/controls`

## Request

- Base URL: `https://cp.xenovia.io` (the document declares no server; this is the origin it was published from)
- URL: `https://cp.xenovia.io/api/v1/orgs/{org_id}/compliance/controls`
- Auth: none declared

Where each of the framework's controls stood at the last evaluation,
with its uptime.

## Path parameters

- `org_id` string, required

## Query parameters

- `framework` string, required

## Headers

- `Authorization` string, nullable

## Response `200`

Successful Response

- ComplianceControlRead[]
  - `framework` string, required
  - `control_id` string, required
  - `title` string, required
  - `status` 'failing' | 'unknown' | 'monitoring' | 'verified' | 'configured' | 'not_covered', required
  - `coverage` number, nullable, required
  - `evidence` ControlEvidenceRead, required: The mapped policies' enforcement, summed, over the evidence window, and the agents Neon covers the control on.
    - `window_hours` integer, required
    - `eligible_turns` integer, required
    - `applied_turns` integer, required
    - `error_turns` integer, required
    - `decisions` DecisionsRead, required: Turns decided each way, distinct by turn.
      - `allow` integer
      - `block` integer
      - `redact` integer
      - `escalate` integer
    - `agents_with_traffic` integer, required
    - `neon` NeonCoverageRead[]
      - `agent_id` string, uuid, required
      - `agent_name` string, required
      - `action` 'enforce' | 'escalate' | 'monitor', required
      - `questions` string[], required
      - `queued` string[]
      - `turns` integer, nullable, required
      - `judged_turns` integer, nullable
  - `uptime` number, nullable, required
  - `checks` ComplianceCheckRead[], required
    - `key` string, required
    - `title` string, required
    - `description` string, required
    - `status` 'pass' | 'fail' | 'unknown' | 'not_run', required
    - `summary` string, required
    - `evaluated_at` string, date-time, nullable, required
    - `failing` FailingSubject[], required
      - `subject` string, required
      - `label` string, required
      - `detail` string, required
    - `controls` ControlRef[], required
      - `framework` string, required
      - `control_id` string, required
  - `policies` MappedPolicyRead[], required
    - `id` string, uuid, required
    - `name` string, required
    - `agent_id` string, uuid, nullable, required
    - `agent_name` string, required
    - `enforcement_mode` string, required
    - `stage` string, required
    - `baseline_target` BaselineTarget: Which agents a baseline applies to: all of them, or those of the given risk tiers or handling the given data classes.
      - `all` boolean
      - `risk_tiers` string[]
      - `data_classes` string[]
    - `targeted_agents` integer
    - `enforcement` PolicyEnforcementRead: What the runtimes did with a mapped policy over the evidence window.
      - `eligible_turns` integer, required
      - `applied_turns` integer, required
      - `error_turns` integer, required
      - `coverage` number, nullable, required
      - `decisions` DecisionsRead, required: Turns decided each way, distinct by turn.
        - `allow` integer
        - `block` integer
        - `redact` integer
        - `escalate` integer
      - `last_seen_at` string, date-time, nullable, required
      - `modes_seen` string[], required
      - `agents_with_traffic` integer, required
    - `conformance` ConformanceSummaryRead
      - `ran_at` string, date-time, required
      - `source` 'template' | 'policy', required
      - `passed` integer, required
      - `failed` integer, required

## Other responses

- `422`: Validation Error

## Changes

- **2026-10-26** `3e25bef24f8f`: 1 info
  - added the optional property `items/evidence/neon` to the response with the `200` status
- **2026-10-04** `2f4b4b338b8f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/xenovia/apis/controlplane/changes/api/v1/orgs/:org_id/compliance/controls/get.md)

---

[API](https://skmtc.dev/xenovia/apis/controlplane.md) - [All operations](https://skmtc.dev/xenovia/apis/controlplane/llms.txt) - [OpenAPI document](https://skmtc.dev/xenovia/apis/controlplane/revisions/3e25bef24f8f?raw)