---
title: "List audit controls"
method: GET
path: "/audits/{auditId}/controls"
tags: ["Audits"]
---

# List audit controls

`GET /audits/{auditId}/controls`

Returns a paginated list of controls for an audit.

Rate limit: 250 requests / minute.

## Path parameters

- `auditId` string, required

## Query parameters

- `pageSize` integer — Controls the maximum number of items returned in one response from the API.
- `pageCursor` string — A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor.
- `externalIdMatchesAny` string[]

## Response `200`

Ok

- PaginatedResponseAuditorControl
  - `results` object, required
    - `data` AuditorControl[], required
      - `id` string, required — The control's unique ID.
      - `externalId` string, nullable, required — The control's external ID.
      - `name` string, required — The control's name.
      - `description` string, required — The control's description.
      - `source` 'Vanta' | 'Custom', required
      - `domains` string[], required — The security domains that the control belongs to.
      - `owner` Owner, required
        - `id` string, required — Unique identifier for the person.
        - `displayName` string, required — Name of the person that is shown in product.
        - `emailAddress` string, required — Email address of the person.
      - `role` string, nullable — The control's GDPR role, if the control is a GDPR control.
      - `customFields` CustomField[], required — The control's custom field values, if control custom fields is included in your Vanta instance.
        - `label` string, required
        - `value` union, required
          - string
          - string[]
      - `creationDate` string, date-time, nullable, required — When the control was created. Returns null for Vanta library controls.
      - `modificationDate` string, date-time, nullable, required — When the control was last modified. Returns null for Vanta library controls.
      - `framework` string, required — The report standard framework fulfilled by the control.
      - `sections` Section[], required — Sections of a framework that this control satisfies
        - `name` string, required — The section name
        - `framework` string, required — The section framework
        - `principle` SectionPrinciple, required
          - `id` string, required — The principle's unique ID.
          - `name` string, required — The principle's name.
      - `assessments` AuditControlAssessment[], required — The auditor's assessments of this control, one per audit segment the control is in scope for. Populated only for IRL audits when the assessment feature is enabled; empty otherwise. A segment with no recorded assessment still contributes an entry, coerced to `NOT_ASSESSED`.
        - `assessmentState` 'IN_PLACE' | 'NOT_IN_PLACE' | 'PARTIAL' | 'NOT_ASSESSED' | 'CONFORMING' | 'MINOR_NON_CONFORMITY' | 'MAJOR_NON_CONFORMITY' | 'SATISFIED' | 'NOT_SATISFIED' | 'OTHER_THAN_SATISFIED' | 'TRUE' | 'FALSE', required — An auditor's assessment of a control within an audit. This is the full flat union of every framework's assessment states (the superset); a given audit's framework only uses its own subset. `NOT_ASSESSED` is shared by all frameworks and is the default for a control that has not yet been assessed. Which states apply to which framework: - Most frameworks (e.g. SOC 2): `IN_PLACE`, `NOT_IN_PLACE`, `PARTIAL`, `NOT_ASSESSED` - ISO 27001: `CONFORMING`, `MINOR_NON_CONFORMITY`, `MAJOR_NON_CONFORMITY`, `NOT_ASSESSED` - FedRAMP: `SATISFIED`, `NOT_SATISFIED`, `OTHER_THAN_SATISFIED`, `NOT_ASSESSED` - FedRAMP Key Security Indicators (KSI): `TRUE`, `FALSE`, `PARTIAL`, `NOT_ASSESSED` Distinct from `ControlStatus`, which is the computed tests/documents-passing status — a different concept.
        - `justification` string, nullable, required — Free-text reasoning for the assessment; `null` when none has been recorded.
    - `pageInfo` PageInfo, required — Provides information about the pagination of a dataset.
      - `endCursor` string, nullable, required — The cursor that points to the end of the current page, or null if there is no such cursor.
      - `hasNextPage` boolean, required — Indicates if there is another page after the current page.
      - `hasPreviousPage` boolean, required — Indicates if there is a page before the current page.
      - `startCursor` string, nullable, required — The cursor that points to the start of the current page, or null if there is no such cursor.

---

[API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/versions/6c1f7590538b/schema)