---
title: "Update a control's metadata"
method: PATCH
path: "/controls/{controlId}"
tags: ["Controls"]
---

# Update a control's metadata

`PATCH /controls/{controlId}`

Update a control's metadata.

## Path parameters

- `controlId` string, required

## Request body

- EditControlMetadataInput
  - `name` string — A new name for the control.
  - `externalId` string — The new external ID for the control.
  - `description` string — The new description for the control.
  - `domain` 'ARTIFICIAL_&_AUTONOMOUS_TECHNOLOGY' | 'ASSET_MANAGEMENT' | 'BUSINESS_CONTINUITY_&_DISASTER_RECOVERY' | 'CAPACITY_&_PERFORMANCE_PLANNING' | 'CHANGE_MANAGEMENT' | 'CLOUD_SECURITY' | 'COMPLIANCE' | 'CONFIGURATION_MANAGEMENT' | 'CONTINUOUS_MONITORING' | 'CRYPTOGRAPHIC_PROTECTIONS' | 'DATA_CLASSIFICATION_&_HANDLING' | 'EMBEDDED_TECHNOLOGY' | 'ENDPOINT_SECURITY' | 'HUMAN_RESOURCES_SECURITY' | 'IDENTIFICATION_&_AUTHENTICATION' | 'INCIDENT_RESPONSE' | 'INFORMATION_ASSURANCE' | 'MAINTENANCE' | 'MOBILE_DEVICE_MANAGEMENT' | 'NETWORK SECURITY' | 'PHYSICAL_&_ENVIRONMENTAL_SECURITY' | 'PRIVACY' | 'PROJECT_&_RESOURCE MANAGEMENT' | 'RISK_MANAGEMENT' | 'SECURE_ENGINEERING_&_ARCHITECTURE' | 'SECURITY_AWARENESS_&_TRAINING' | 'SECURITY_OPERATIONS' | 'SECURITY_&_PRIVACY_GOVERNANCE' | 'TECHNOLOGY_DEVELOPMENT_&_ACQUISITION' | 'THIRD-PARTY_MANAGEMENT' | 'THREAT_MANAGEMENT' | 'VULNERABILITY_&_PATCH_MANAGEMENT' | 'WEB_SECURITY' | 'ADMINISTRATIVE' | 'PHYSICAL' | 'TECHNICAL' | 'BASIC' | 'DERIVED'
  - `note` string — The new note for the control.
  - `customFields` CustomField[] — The control's new values for custom fields.
    - `label` string, required
    - `value` union, required
      - string
      - string[]

## Response `200`

Ok

- ControlDetail
  - `id` string, required — The control's unique ID.
  - `externalId` string, nullable, required — The control's external ID.
  - `name` string, required — The control's name.
  - `description` string, required — The control's description.
  - `source` 'Vanta' | 'Custom', required
  - `domains` string[], required — The security domains that the control belongs to.
  - `owner` Owner, required
    - `id` string, required — Unique identifier for the person.
    - `displayName` string, required — Name of the person that is shown in product.
    - `emailAddress` string, required — Email address of the person.
  - `role` string, nullable — The control's GDPR role, if the control is a GDPR control.
  - `customFields` CustomField[], required — The control's custom field values, if control custom fields is included in your Vanta instance.
    - `label` string, required
    - `value` union, required
      - string
      - string[]
  - `creationDate` string, date-time, nullable, required — When the control was created. Returns null for Vanta library controls.
  - `modificationDate` string, date-time, nullable, required — When the control was last modified. Returns null for Vanta library controls.
  - `numDocumentsPassing` number, double, required — The number of passing documents that are linked to the control.
  - `numDocumentsTotal` number, double, required — The total number of documents that are linked to the control.
  - `numTestsPassing` number, double, required — The number of passing tests that are linked to the control.
  - `numTestsTotal` number, double, required — The total number of tests that are linked to the control.
  - `status` 'NO_EVIDENCE_MAPPED' | 'NOT_STARTED' | 'IN_PROGRESS' | 'COMPLETED', required
  - `note` string, nullable, required — A user created note for the control.

---

[API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/revisions/6c1f7590538b/schema)