---
title: "Update Control Implementation"
method: PUT
path: "/api/controls/v1/control-implementations/{guid}"
tags: ["Control Implementations"]
---

# Update Control Implementation

`PUT /api/controls/v1/control-implementations/{guid}`

Use this API to update the attributes of a specific control implementation.

> 🗒 Things to Know
> 
> - The [Update Control](https://developer.onetrust.com/onetrust/reference/updatecontrolusingput_1) API can be used to update the attributes of a control in the Controls Library.

## Path parameters

- `guid` string, uuid, required

## Request body

- TechRiskComplianceITRiskManagementControlImplementationUpdateRequest
  - `status` 'Pending' | 'Implemented' | 'NotDoing' | 'Retired', required — New status of implemented control.
  - `effectiveness` 'Effective' | 'Ineffective' | 'Planned' — Effectiveness of implemented control.
  - `effectivenessId` string, uuid — Identifier of the effectiveness associated with control implementation.
  - `note` string — Notes on implemented control.
  - `deadline` string, date — Deadline associated with the control implementation. Format (yyyy-MM-dd).
  - `controlOwnerId` string, uuid — Identifier (UUID) of the owner of control implementation.
  - `maturityId` string, uuid — Identifier of the maturity associated with control implementation.
  - `statusId` string, uuid — Identifier of the control implementation Status.
  - `attributes` object — Custom Attributes of control implementation.
  - `controlOwnerIds` string[] — List of Identifier (UUID) of the owners of control implementation.
  - `controlApproverIds` string[] — List of Identifier (UUID) of the approver of control implementation.
  - `implementationCategoryId` string, uuid — The identifier of the category tied to the control Implementation. Optional if no category needed or if category name provided.
  - `implementationDescription` string — Description of the control implementation.
  - `implementationGuidance` string — Implementation Guidance of the control Implementation.
  - `implementationName` string — The name of the control Implementation.
  - `controlOwners` TechRiskComplianceITRiskManagementBasicDetail[] — List of owners of control implementation.
    - `id` string, uuid — Identifier (GUID)
    - `name` string — Name
  - `implementationCategoryName` string — The name of the category tied to the control Implementation.

## Response `200`

OK

- TechRiskComplianceITRiskManagementControlImplementationDto
  - `id` string, uuid, required — GUID of Control Implementation.
  - `number` integer, required — Numeric identifier for Control Implementation.
  - `organizationId` string, uuid, required — The identifier (GUID) of the organization implementation.
  - `orgGroupName` string, required — Organization name with which control implementation is created.
  - `primaryEntity` TechRiskComplianceITRiskManagementControlEntityInformation, required
    - `id` string, uuid, required — The identifier (GUID) of the related entity.
    - `name` string, required — The name of the entity.
    - `type` 'Risks' | 'Assets' | 'ProcessingActivities' | 'Vendors' | 'Entities', required — The type of the related entity.
    - `controlEntityType` TechRiskComplianceITRiskManagementControlEntityTypeInformation, required
      - `id` string, required — ID of the entity type. This can be Assets, Entities, Custom Object GUID in the form of String.
      - `label` string — Name of the EntityType.
      - `translationKey` string — Translation Key of EntityType ID.
      - `moduleName` string — Module Name of EntityType.
      - `seeded` boolean — The parameter is true for Base Entity Type and false for Custom Object/Entity Types by default.
    - `organizationId` string, uuid — The identifier (GUID) of the organization which contains the entity.
    - `softInherited` boolean — Indicates if this control is soft-inherited or not.
    - `relationshipLabel` 'IMPLEMENTED_ON' | 'MITIGATES' | 'LEVERAGED_BY' | 'INCLUDED_IN' | 'RELATED_TO' — The RelationshipType to the control entity.
    - `isPrimary` boolean — Indicates if entity is primary.
  - `control` TechRiskComplianceITRiskManagementControlExtInformation, required
    - `id` string, uuid, required — The identifier of the control.
    - `identifier` string, required — The identifier of the control.
    - `name` string, required — The name of the control.
    - `description` string — Description of the control.
    - `orgGroupId` string, uuid, required — The identifier of the organization the master control is linked to. In general, this is the top organization in the organization hierarchy.
    - `orgGroupName` string, required — Organization Group Name of Control.
    - `frameworkId` string, uuid — Identifier (GUID) of the framework on the control.
    - `categoryId` string, uuid — Identifier (GUID) of the category on the control.
    - `categoryName` string — Name of the category on the control.
    - `categoryNameKey` string — Identifier used for translation of Category Name.
    - `frameworkName` string — Name of the framework of the control.
    - `attributes` object — Custom attributes for the control. These attributes are custom to the tenant.
    - `implementationGuidance` string — Implementation guidance of the control requirement.
  - `status` 'Pending' | 'Implemented' | 'NotDoing' | 'Suggested', required — The status of the control.
  - `suggestion` 'Suggested' | 'Accepted' | 'Rejected' — The suggestion status of the control. Used by Athena.
  - `effectiveness` 'Effective' | 'Ineffective' | 'Planned' — The effectiveness of the control.
  - `effectivenessInfo` TechRiskComplianceITRiskManagementBasicEntityReference
    - `id` string, uuid, required — Identifier of the entity (UUID).
    - `name` string, required — The name of the entity.
    - `nameKey` string — Name of the entity used for translation.
  - `note` string — Notes used for the control. This is free text to contain any additional details which may be needed.
  - `deadline` string, date — The deadline for the control.
  - `maturity` TechRiskComplianceITRiskManagementBasicEntityReference
    - `id` string, uuid, required — Identifier of the entity (UUID).
    - `name` string, required — The name of the entity.
    - `nameKey` string — Name of the entity used for translation.
  - `statusInfo` TechRiskComplianceITRiskManagementBasicEntityReference
    - `id` string, uuid, required — Identifier of the entity (UUID).
    - `name` string, required — The name of the entity.
    - `nameKey` string — Name of the entity used for translation.
  - `owner` TechRiskComplianceITRiskManagementBasicEntityReference
    - `id` string, uuid, required — Identifier of the entity (UUID).
    - `name` string, required — The name of the entity.
    - `nameKey` string — Name of the entity used for translation.
  - `owners` TechRiskComplianceITRiskManagementBasicEntityReference[] — List of Implemented Control Owners.
    - `id` string, uuid, required — Identifier of the entity (UUID).
    - `name` string, required — The name of the entity.
    - `nameKey` string — Name of the entity used for translation.
  - `approvers` TechRiskComplianceITRiskManagementBasicEntityReference[] — List of Implemented Control approvers.
    - `id` string, uuid, required — Identifier of the entity (UUID).
    - `name` string, required — The name of the entity.
    - `nameKey` string — Name of the entity used for translation.
  - `createdBy` string, uuid — The user or operation the control was created by.
  - `createDt` string, date-time — The date on which the control implementation was created.
  - `lastModifiedBy` string, uuid — The user or process the control was last modified by (GUID).
  - `lastModifiedDate` string, date-time — The date the control was last modified.
  - `controlObjectivesCount` integer — count of total control objectives linked.
  - `attributes` object — Implemented Custom Attributes.
  - `entityLinks` TechRiskComplianceITRiskManagementControlEntityInformation[] — Entity Details of the implementation links.
    - `id` string, uuid, required — The identifier (GUID) of the related entity.
    - `name` string, required — The name of the entity.
    - `type` 'Risks' | 'Assets' | 'ProcessingActivities' | 'Vendors' | 'Entities', required — The type of the related entity.
    - `controlEntityType` TechRiskComplianceITRiskManagementControlEntityTypeInformation, required
      - `id` string, required — ID of the entity type. This can be Assets, Entities, Custom Object GUID in the form of String.
      - `label` string — Name of the EntityType.
      - `translationKey` string — Translation Key of EntityType ID.
      - `moduleName` string — Module Name of EntityType.
      - `seeded` boolean — The parameter is true for Base Entity Type and false for Custom Object/Entity Types by default.
    - `organizationId` string, uuid — The identifier (GUID) of the organization which contains the entity.
    - `softInherited` boolean — Indicates if this control is soft-inherited or not.
    - `relationshipLabel` 'IMPLEMENTED_ON' | 'MITIGATES' | 'LEVERAGED_BY' | 'INCLUDED_IN' | 'RELATED_TO' — The RelationshipType to the control entity.
    - `isPrimary` boolean — Indicates if entity is primary.
  - `workflow` TechRiskComplianceITRiskManagementBasicDetails
    - `id` string, uuid — Identifier (GUID) of the entity.
    - `name` string — Name of the entity.
    - `nameKey` string — Name Key of the entity.
  - `workflowStage` TechRiskComplianceITRiskManagementWorkflowStageBasicDetails
    - `id` string, uuid — Identifier (GUID) of the entity.
    - `name` string — Name of the entity.
    - `nameKey` string — Name Key of the entity.
    - `currentStageApprovers` TechRiskComplianceITRiskManagementStageApproverBasicDetails[]
      - `id` string, uuid — stage approver id.
      - `firstName` string — stage approver first name.
      - `lastName` string — stage approver last name.
      - `approvedTimeStamp` string, date-time — approved time.
      - `status` string — stage approved status.
  - `deleteType` 'SOFT' — Control implementation delete type.
  - `controlImplementationName` string — Control Implementation Name of the implemented control.
  - `controlImplementationDescription` string — Control Implementation Description of the implemented control.
  - `controlImplementationGuidance` string — Control Implementation Guidance of the implemented control.
  - `controlImplementationCategoryId` string, uuid — Control Implementation Category of the implemented control.
  - `controlImplementationCategoryName` string — Control Implementation Category Name of the implemented control.
  - `controlImplementationCategoryNameKey` string — Control Implementation Name of the implemented control.
  - `controlImplementationOrigin` string — Control Implementation Origin of the implemented control.
  - `externalImplementationURL` string — External ImplementationURL of the implemented control.
  - `externalControlImplementation` boolean — is this an external control implementation.
  - `duplicateEvidenceTaskImplPresent` boolean — Duplicate evidence task implementation present.
  - `hasMoreThanOneInvLinks` boolean — Implementation has more than one inventory links.
  - `inventoriesCount` integer — Related inventories count.
  - `risksCount` integer — Related risks count.

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `429` — Too Many Requests. For more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview).
- `500` — Internal Server Error

---

[API](https://skmtc.net/onetrust/apis/platform-access-management.md) · [All operations](https://skmtc.net/onetrust/apis/platform-access-management/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/onetrust/platform-access-management/revisions/21de3aa0b170/schema)