---
title: "POST /securityControls/batchGet"
method: POST
path: "/securityControls/batchGet"
---

# POST /securityControls/batchGet

`POST /securityControls/batchGet`

Provides details about a batch of security controls for the current Amazon Web Services account and Amazon Web Services Region.

## Request body

- object
  - `SecurityControlIds` NonEmptyString[], required — A list of security controls (identified with <code>SecurityControlId</code>, <code>SecurityControlArn</code>, or a mix of both parameters). The security control ID or Amazon Resource Name (ARN) is the same across standards.

## Response `200`

Success

- BatchGetSecurityControlsResponse
  - `SecurityControls` SecurityControl[], required — An array that returns the identifier, Amazon Resource Name (ARN), and other details about a security control. The same information is returned whether the request includes <code>SecurityControlId</code> or <code>SecurityControlArn</code>.
    - `SecurityControlId` string, required — The unique identifier of a security control across standards. Values for this field typically consist of an Amazon Web Service name and a number, such as APIGateway.3.
    - `SecurityControlArn` string, required — The Amazon Resource Name (ARN) for a security control across standards, such as <code>arn:aws:securityhub:eu-central-1:123456789012:security-control/S3.1</code>. This parameter doesn't mention a specific standard.
    - `Title` string, required — The title of a security control.
    - `Description` string, required — The description of a security control across standards. This typically summarizes how Security Hub evaluates the control and the conditions under which it produces a failed finding. This parameter doesn't reference a specific standard.
    - `RemediationUrl` string, required — A link to Security Hub documentation that explains how to remediate a failed finding for a security control.
    - `SeverityRating` 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL', required — The severity of a security control. For more information about how Security Hub determines control severity, see <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/controls-findings-create-update.html#control-findings-severity">Assigning severity to control findings</a> in the <i>Security Hub User Guide</i>.
    - `SecurityControlStatus` 'ENABLED' | 'DISABLED', required — The status of a security control based on the compliance status of its findings. For more information about how control status is determined, see <a href="https://docs.aws.amazon.com/securityhub/latest/userguide/controls-overall-status.html">Determining the overall status of a control from its findings</a> in the <i>Security Hub User Guide</i>.
  - `UnprocessedIds` UnprocessedSecurityControl[] — A security control (identified with <code>SecurityControlId</code>, <code>SecurityControlArn</code>, or a mix of both parameters) for which details cannot be returned.
    - `SecurityControlId` string, required — The control (identified with <code>SecurityControlId</code>, <code>SecurityControlArn</code>, or a mix of both parameters) for which a response couldn't be returned.
    - `ErrorCode` 'INVALID_INPUT' | 'ACCESS_DENIED' | 'NOT_FOUND' | 'LIMIT_EXCEEDED', required — The error code for the unprocessed security control.
    - `ErrorReason` string — The reason why the security control was unprocessed.

## Other responses

- `480` — InternalException
- `481` — LimitExceededException
- `482` — InvalidAccessException
- `483` — InvalidInputException

---

[API](https://skmtc.net/aws/apis/securityhub.md) · [All operations](https://skmtc.net/aws/apis/securityhub/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/aws/securityhub/versions/72336a39f336/schema)