Sign in

v1

latestOpenAPI 3.0.0Proprietary - Commercial Use Only2026-08-06172139621.6 KB
Compliance

List all the compliance control findings of a given standard found for a company.

Technical findings of a company is mapped to several compliance standards. This endpoint returns each mapped compliance control findings for a specific standard.

get/api/v2/companies/{id}/compliance/{standard}/findings

Path parameters

idinteger required

The id of the target company.

standardstring required
Example:CSF

The code for specific compliance standard.

Query parameters

areastring
Example:Access Control

The specific area of compliance finding.

no_of_stars_equal_or_less_thaninteger nullable

The star threshold level. This threshold is meaningful for compliance standards that support star way of defining finding results, like CIS or NIST 800-53 R5. For other standards, like GDPR, this value will not taken into account. For your reference number of stars has certain string values; Unknown=0, Failing=1, Below Average=2, Average=3, Very Good=4 and Excellent=5.

confidence_equal_or_less_thaninteger nullable

The confidence threshold level. If the parameter is excluded from the query, confidence threshold will not be taken into account.

result'Unknown' | 'Yes' | 'No' | 'N/A' nullable

A filter value for standards supporting non-star way of defining finding results (such as GDPR). For other standards, like NIST, this value will not be taken into account.

page_numberinteger
Example:1

The number of the page requested.

page_size10 | 20 | 30
Example:10

The number of result items in a single response.

Response

Success

ControlIdnumber

The unique identifier of the individual compliance control item.

Areastring

Area name of the control item's group.

ItemIdstring

The code value of the control item.

Descriptionstring

The detailed description of the control item. Includes , strings as line breaks.

Commentstring

Any automated or manual comment attached to the control item. This field also contains mapping (evidence items) values.

Confidencenumber float

The level of confidence of the corresponding estimation.

Resultstring

For standards where different levels of compliancy exists, this field contains one of; Unknown, Failing, Below Average, Average, Very Good and Excellent. However, for standards such as GDPR and SA, where there are no levels of compliancy, this field contains one of; Unknown, Yes, No and N/A.

Percentagenumber

This is a mapped percentage value of the field Result. Here are the mappings; <br/> When the Result is Yes that means compliance level is above 50% for binary answer frameworks like GDPR and SA <br/> On the other hand, No means compliance level is less 50% for binary answer frameworks like GDPR and SA <br/> Moreover, Failing means compliance level is below 20% for 5-star answer frameworks like NIST, CMMC, ISO etc. <br/> Below Average means compliance level is above 20% and below 40% for 5-star answer frameworks like NIST, CMMC, ISO etc. <br/> Average means compliance level is above 40% and below 60% for 5-star answer frameworks like NIST, CMMC, ISO etc. <br/> Very Good means compliance level is above 60% and below 80% for 5-star answer frameworks like NIST, CMMC, ISO etc. <br/> Excellent means compliance level is above 80% and below or equal 100% for 5-star answer frameworks like NIST, CMMC, ISO etc.

Recommendationstring

Mitigation suggestions for the related control are currently supported only for Standard and Industry frameworks. Support for Enterprise frameworks will be added in the future.

BusinessRiskstring

The possible risk if compliance is not correctly implemented or followed.

Example response

[
  {
    "ControlId": 72515434,
    "Area": "Access Control",
    "ItemId": "AC-1",
    "Description": "Is there a documented privacy policy or procedures maintained for the protection of information collected, transmitted, processed, or maintained on behalf of the client?",
    "Comment": "No previously saved data points found to estimate GDPR > P.1.4.4. Please update this item manually. #A3",
    "Confidence": 75.97,
    "Result": "Average",
    "Percentage": 80,
    "Recommendation": "Establish a dedicated security operations center (SOC) with 24/7 staffing. Implement automated alert routing and escalation procedures.  Conduct regular drills to validate response effectiveness.",
    "BusinessRisk": "Failure to effectively manage communications during and after an incident can severely damage reputation, erode stakeholder trust, and lead to significant financial losses."
  }
]