---
title: "List all the compliance control findings of a given standard found for a company."
method: GET
path: "/api/v2/companies/{id}/compliance/{standard}/findings"
tags: ["Compliance"]
---

# List all the compliance control findings of a given standard found for a company.

`GET /api/v2/companies/{id}/compliance/{standard}/findings`

Technical findings of a company is mapped to several compliance standards. This endpoint returns each mapped compliance control findings for a specific standard.

## Path parameters

- `id` integer, required
- `standard` string, required

## Query parameters

- `area` string
- `no_of_stars_equal_or_less_than` integer, nullable
- `confidence_equal_or_less_than` integer, nullable
- `result` 'Unknown' | 'Yes' | 'No' | 'N/A', nullable
- `page_number` integer
- `page_size` 10 | 20 | 30

## Response `200`

Success

- ComplianceControlFinding[]
  - `ControlId` number — The unique identifier of the individual compliance control item.
  - `Area` string — Area name of the control item's group.
  - `ItemId` string — The code value of the control item.
  - `Description` string — The detailed description of the control item. Includes , strings as line breaks.
  - `Comment` string — Any automated or manual comment attached to the control item. This field also contains mapping (evidence items) values.
  - `Confidence` number, float — The level of confidence of the corresponding estimation.
  - `Result` string — For standards where different levels of compliancy exists, this field contains one of; Unknown, Failing, Below Average, Average, Very Good and Excellent. However, for standards such as GDPR and SA, where there are no levels of compliancy, this field contains one of; Unknown, Yes, No and N/A.
  - `Percentage` number — This is a mapped percentage value of the field Result. Here are the mappings; <br/> When the Result is Yes that means compliance level is above 50% for binary answer frameworks like GDPR and SA <br/> On the other hand, No means compliance level is less 50% for binary answer frameworks like GDPR and SA <br/> Moreover, Failing means compliance level is below 20% for 5-star answer frameworks like NIST, CMMC, ISO etc. <br/> Below Average means compliance level is above 20% and below 40% for 5-star answer frameworks like NIST, CMMC, ISO etc. <br/> Average means compliance level is above 40% and below 60% for 5-star answer frameworks like NIST, CMMC, ISO etc. <br/> Very Good means compliance level is above 60% and below 80% for 5-star answer frameworks like NIST, CMMC, ISO etc. <br/> Excellent means compliance level is above 80% and below or equal 100% for 5-star answer frameworks like NIST, CMMC, ISO etc.
  - `Recommendation` string — Mitigation suggestions for the related control are currently supported only for Standard and Industry frameworks. Support for Enterprise frameworks will be added in the future.
  - `BusinessRisk` string — The possible risk if compliance is not correctly implemented or followed.

## Other responses

- `400` — BadRequest
- `401` — Unauthorized
- `403` — Forbidden
- `404` — Not Found
- `default` — Failure

---

[API](https://skmtc.net/blackkitetech/apis/black-kite-api.md) · [All operations](https://skmtc.net/blackkitetech/apis/black-kite-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/blackkitetech/black-kite-api/revisions/616dfa9b3b1f/schema)