---
title: "Add control to document mapping"
method: POST
path: "/controls/{controlId}/add-document-to-control"
tags: ["Controls"]
---

# Add control to document mapping

`POST /controls/{controlId}/add-document-to-control`

Add a document to a control.

## Path parameters

- `controlId` string, required

## Request body

- AddControlDocumentMappingInput
  - `documentId` string, required — The ID of the document to add to the control.

## Response `200`

Ok

- object
  - `document` Document, required
    - `id` string, required — The document's unique ID.
    - `ownerId` string, nullable, required — The user ID of the document's owner.
    - `category` 'Accounts access' | 'Account security' | 'Account setup' | 'Computers' | 'Custom' | 'Data storage' | 'Employees' | 'Infrastructure' | 'IT' | 'Logging' | 'Monitoring alerts' | 'People' | 'Policies' | 'Risk analysis' | 'Software development' | 'CSPM alert management' | 'Vendors' | 'Vulnerability management', required
    - `description` string, required — The document's description.
    - `isSensitive` boolean, required — Determines whether or not the document is sensitive.
    - `title` string, required — The document's title.
    - `uploadStatus` 'Needs document' | 'Needs update' | 'Not relevant' | 'OK', required
    - `uploadStatusDate` string, date-time, nullable, required — The date the document's uploadStatus changed.
    - `url` string, nullable, required — The URL to view the document within Vanta.
  - `control` Control, required
    - `id` string, required — The control's unique ID.
    - `externalId` string, nullable, required — The control's external ID.
    - `name` string, required — The control's name.
    - `description` string, required — The control's description.
    - `source` 'Vanta' | 'Custom', required
    - `domains` string[], required — The security domains that the control belongs to.
    - `owner` Owner, required
      - `id` string, required — Unique identifier for the person.
      - `displayName` string, required — Name of the person that is shown in product.
      - `emailAddress` string, required — Email address of the person.
    - `role` string, nullable — The control's GDPR role, if the control is a GDPR control.
    - `customFields` CustomField[], required — The control's custom field values, if control custom fields is included in your Vanta instance.
      - `label` string, required
      - `value` union, required
        - string
        - string[]
    - `creationDate` string, date-time, nullable, required — When the control was created. Returns null for Vanta library controls.
    - `modificationDate` string, date-time, nullable, required — When the control was last modified. Returns null for Vanta library controls.

---

[API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/revisions/6c1f7590538b/schema)