List SCF security controls from the reference catalog. Returns paginated controls with SCF ID, title, description, and mapped frameworks. Filter by domain, framework, or free-text search.

Get a single SCF control by ID. Returns description, mapped frameworks, assessment objectives, and linked evidence items from the reference catalog.

List every compliance framework mapped in the SCF catalog (NIST 800-53, ISO 27001, SOC 2, FedRAMP, GDPR, and 350+ more). Returns framework identifiers and display names.

List every compliance domain in the SCF taxonomy. Domains group related controls (e.g., GOV = Governance, AST = Asset Management, IAC = Identity & Access Control).

List evidence items from the SCF reference catalog — the 272 standard evidence types that can be collected to demonstrate control implementation. Supports free-text search and pagination.

List SCF assessment objectives — the 5,736 test criteria used to evaluate control implementation. Optionally filter by control ID; supports free-text search and pagination.

Get one SCF domain with its controls (read, no org). Deprecated controls are excluded unless include_deprecated is set; a deprecated domain still resolves, badged.

Get one catalog evidence entry with the controls it maps to (read, no org). The reference definition, not an organization's tracking record — see scf_get_evidence for that.

List controls scoped to the organization with status, basis, target maturity, materiality, procedure and last validation. Filter by scope, domain, framework, team, basis, material. Paginated.

Get one scoped control: owner, notes, scope/basis/target/material overrides with reason, set_at and set_by, procedure_document_id, last validation. Identify by scf_id, not UUID.

Update a scoped control's implementation fields (write — editor+). Identify by scf_id. Only provided fields apply. Material controls: admin for not_applicable. at_risk raises a deficiency.

Get the organization's implementation statistics: counts by status, overall completion percentage, and per-framework coverage breakdown.

Bulk-scope every control mapped to a framework into the organization (write — editor+ role). Creates a scoped-control entry for each control in the framework.

Batch-update up to 500 scoped controls in one transaction (write — editor+). Each operation targets an scf_id. Material/MCR controls: no deselect (409); at_risk raises a deficiency.

Unscope every control mapped only to these frameworks (destructive write — editor). Shared controls are kept. An MCR framework, or one taking out a material control, needs an admin and a reason.

Get framework coverage and selection state (read — viewer): each framework's coverage, basis, obligation_type and obligation_source, and basis_counts (in-scope controls by mcr/dsr/unclassified).

Preview adding or removing frameworks WITHOUT applying it (read — viewer): controls entering or leaving scope, orphaned evidence, and on remove basis_downgrades (controls whose basis weakens).

Force one control in or out of scope (write — editor+). 'include'/'exclude' pin it; 'inherit' clears it. Excluding an MCR or material control needs an admin key and a reason (editors 403).

Record why a scoped framework is in scope (write — ADMIN role): basis mcr|dsr, obligation_type and obligation_source. Replaces all three; null clears. Only an active (scoped) framework, else 404.

Override one control's derived obligation basis (write — ADMIN role): mcr or dsr with a reason, or null to clear and derive it from its frameworks again. 404 if the control has no scope record.

Override one control's target maturity (write — ADMIN role): a level L0–L5 with a reason, or null to inherit its domain's target again (domain targets: scf_update_org_settings).

Set whether one control is material (write — ADMIN's own key; a platform key gets 403): true/false with a reason, or null for the catalogue default (material at weighting 10).

Link one control to its signed-off procedure document, or null to unlink (write — editor+). The document must be this org's procedure, approved or published when linked (400 otherwise).

List evidence items tracked against an organization's controls. Returns each item's tracking status, maturity level, and linked controls. Optionally filter by system.

Create an evidence tracking record from a catalog evidence ID (write — editor+ role). Starts tracking an evidence item for the organization.

Get the organization's evidence maturity summary: average maturity score, automation percentage, distribution by maturity level, and improvement opportunities.

Get one evidence item's collection maturity: current level (1=Ad Hoc to 5=Optimized), contributing factors, upgrade potential, and tracking state.

Get upgrade-path recommendations for maturing one evidence item's collection: target level, effort, impact, and step-by-step actions — the same guidance shown in the platform UI.

Get system-aware collection suggestions for one evidence item: which tracked system currently collects it, which in-scope systems are capable of collecting it, and tailored collection guidance.

List the organization's evidence coverage gaps: evidence required by in-scope controls that is not yet tracked, with overall coverage percentage.

Get evidence collection health for the organization: per-item freshness status (green/amber/red) against collection frequency, with a roll-up summary.

List all files uploaded or ingested for an evidence item. Returns filename, content type, upload timestamp, validation status, and a pre-signed download URL (15-min expiry).

Get metadata and a pre-signed download URL (15-min expiry) for a single evidence file. Use to inspect or retrieve a specific uploaded artifact.

Upsert an evidence item's tracking fields (write — editor+ role). Creates the tracking row if missing. All body fields are optional; only provided fields are applied.

Get the validation result for a single evidence file: status (valid/warning/partial/invalid), completeness score, individual rule findings, source, and timestamp.

Re-run the validation engine against an evidence file (write — editor+ role). Checks catalog existence, content type, field coverage, freshness, storage. Returns the updated result.

Get aggregate evidence validation metrics for the organization dashboard: total files validated, counts by status (valid/warning/partial/invalid), and overall pass rate.

Queue an AI assessment of a single evidence file (write — editor+ role, async). Returns a pending record; poll scf_get_evidence_assessment until status is sufficient/partial/insufficient.

Get the AI assessment for an evidence file: status, relevance score (0–100), structured findings, summary, and audit metadata (model, tokens, cost). Poll after scf_trigger_evidence_assessment.

Queue AI assessments for multiple evidence files (write — editor+ role, async, max 50). Provide evidence_id, file_ids, and/or assess_unassessed. Returns count queued.

Get aggregate AI assessment metrics for the organization dashboard: total assessed, counts by status, unassessed count, average relevance score, and total cost in cents.

List evidence collection tasks — the work queue showing what needs to be collected, by whom, and by when. Optionally filter by assignee or status.

Queue a windowed AI assessment that scores every file in the evidence item's frequency window as one portfolio (write — editor+ role, async). Returns 422 if tracking or frequency is missing.

List recent windowed AI assessments for an evidence item (newest first). Each entry includes window bounds, frequency, file IDs, coverage, status, relevance score, findings, and cost.

Get one windowed AI assessment by ID. Returns full detail: window bounds, frequency, file IDs, coverage, expected artifact types, status, relevance score, findings, summary, hashes, tokens, cost.

Queue windowed AI assessments for up to 25 evidence IDs (write — editor+ role, async). Items without tracking or a frequency set are reported under skipped_detail in the response.

Get aggregate windowed-assessment metrics for the organization dashboard: total windows assessed, counts by status (including insufficient_sample), average relevance score, and total cost in cents.

Get the rolled-up assessment composite for one SCF control: composite score, status band, included/missing evidence IDs, mandatory gaps, per-window detail. 404 if no composite row exists yet (async).

List rolled-up assessment composites for the org. Cursor-paginated, worst-band first (insufficient → sufficient). Filter by status/domain/computation_version. Pass next_cursor to page forward.

Get one evidence tracking record (read — viewer role): tracked flag, collection method, owner, assignee, frequency, system, maturity level and its catalog deprecation badge.

Create or update up to 500 evidence tracking records in one transaction (write — editor role). Each upserts by evidence_id; only fields given change. Use instead of 500 scf_update_evidence calls.

Create a manual evidence collection task against a tracking record (write — editor role). Due date and evidence_tracking_id are required; status defaults to not_started, priority to medium.

Update an evidence collection task (write — editor role). Only passed fields change: due date, status, type, priority, title, description, notes, assignee, owning team.

Mark an evidence collection task completed (write — editor role). Sets status to completed and stamps the completion date; optional completion notes are stored with it.

Approve, reject or request revision on one uploaded file (write — editor). Rejecting raises a deficiency on each in-scope control it supports. 410 where per-window review is on.

Soft-delete an evidence file (destructive write — editor role). The record is marked deleted and drops out of listings; the stored object is retained for audit and retention.

List evidence whose next collection falls due within N days (read — viewer role), computed from each item's frequency and last upload. The daily 'what is due' view.

Report evidence whose declared frequency disagrees with the observed upload cadence over the last 90 days (read — viewer role). Only misaligned items are returned.

List AI verdicts awaiting a human decision, worst first (read — viewer role). tier=file (default) lists per-file verdicts; tier=window is the web app's Awaiting-confirmation queue.

Record a human decision on a file's current AI assessment (write — editor role). confirmed keeps the verdict; overridden needs a reason and at least one objective re-designation.

Queue a fresh windowed AI assessment for every evidence item whose newest file postdates its last assessment (write — editor role). Capped per run; returns how many were queued.

Set a windowed assessment's acceptance review (write — editor): approved, rejected (raises a deficiency per in-scope control), needs_revision, or not_reviewed to revoke.

Confirm or override a window's current AI verdict (write — editor role). overridden needs a reason and ≥1 objective re-designation. One decision per version; 422 without objectives: confirm.

List every AI verdict a window assessment has received, newest first (read — viewer role). Each version is frozen as reached (model, prompt version, designations) plus any human decision on it.

List the whole risk register (ordered by risk code): scores, treatment status and any acceptance (accepted_by, accepted_at, rationale, expiry, acceptance_state). Filter by status, level, category.

Get one risk assessment: inherent and residual scores, treatment plan, owner, review date, and any acceptance (accepted_by, accepted_at, rationale, expires_on, acceptance_state).

Create a new risk assessment in the risk register (write — editor+ role). Likelihood and impact scores populate the 5×5 risk matrix.

Get the 5×5 risk matrix data for the organization — risk distribution across likelihood × impact, ready for visualization.

Get the organization's aggregate risk summary: totals by severity, treatment status breakdown, and trend data.

List the organization's custom risk definitions — org-defined risks alongside the static SCF catalog, carrying auto-generated R-ORG-N codes.

Create a custom org-defined risk (write — editor+ role). Auto-generates an R-ORG-N code and creates the matching risk assessment record.

Update a custom risk definition's metadata — title, description, category (write — editor+ role). Only provided fields are applied.

Delete a custom risk definition, its assessment record, and every control mapping (destructive write — editor+ role). Irreversible.

List controls linked to a custom risk: catalog_control_ids, links (scf_id + document_id of the standard it is an exception against) and scoped_controls with implementation status.

Link a control to a custom risk (write — editor+), optionally with the document whose standard it is an exception against. Changing an accepted exception's links clears its approval.

Unlink a control from a custom risk (write — editor+ role). The control and risk both remain; only the mapping is removed. Unlinking clears an accepted exception's approval.

Update a scored risk by code (write — editor). Only passed fields change. Setting accepted records no approval (use scf_accept_risk); re-scoring an accepted risk clears its approval.

Delete an organization's scoring of a risk code (destructive write — editor role). The catalog or custom risk definition itself remains; only this org's assessment row is removed.

List the risk codes a control addresses and this organization's assessments of them (read — viewer role). Control-to-risk traceability from the SCF catalog mapping.

List the controls that address a risk code (read — viewer role). Works for catalog risks (R-XX-N via the SCF mapping) and custom risks (R-ORG-N via the org's control mappings).

Get the organization's risk profile (read — viewer role): the severity thresholds that band the 5×5 matrix into low, medium, high and critical. Auto-created with defaults if unset.

Accept a risk (write — admin): records you as approver, now, the rationale and expiry. Renews an accepted risk. Also accepts a standards exception. A platform key without a user gets 403.

Set or clear the standard's document on a custom risk's control link (write — editor). A changed document clears an accepted exception's approval.

List third-party vendors in the organization's TPRM (Third-Party Risk Management) registry. Optionally filter by status or criticality. Paginated.

Get one vendor's detail: certifications, assessments, computed risk score, and latest research results.

Create a vendor in the TPRM registry (write — editor+ role). Platform auto-scores risk based on criticality and data handling.

Update an existing vendor record (write — editor+ role). Only provided fields are applied.

Queue AI security research for a vendor (write — editor+ role, async). Checks HIBP breach data, NVD vulnerabilities, and public posture. Returns a task ID; poll scf_get_vendor_research.

Get the latest vendor research result: breach history, known vulnerabilities, and security posture analysis. Poll this after scf_trigger_vendor_research.

Queue an AI vendor security assessment (write — editor+ role, async, HTTP 202). Replaces the deprecated DPSIA trigger. Returns assessment_id + job_id; poll scf_get_vendor_assessment_status.

List a vendor's AI security assessments, newest first. Includes status, RAG rating, recommendation, and report fields per record.

Get a vendor's latest completed AI security assessment: RAG status, recommendation, executive summary, report_markdown/report_json. 404 if none completed yet.

Get one vendor AI assessment by ID with full detail: services_used, data_role, RAG status, recommendation, full report fields, and research sources.

Get the job status of a queued vendor AI assessment: status, started_at, completed_at, error_message. Poll this after scf_trigger_vendor_assessment.

List a vendor's certifications (read — viewer role): name, issuing body, certificate number, status, issue and expiry dates, scope and verification URL.

Record a certification a vendor holds (write — editor role), e.g. ISO 27001 or SOC 2 Type II. Status defaults to valid; track expiry_date so renewals surface.

Update a vendor certification (write — editor role). Only passed fields change; use it to mark a certificate expired or revoked, or to record the renewed expiry date.

Delete a vendor certification record (destructive write — editor role). Prefer status=expired or revoked when the history matters.

List remediation action items for one vendor, or across every vendor when vendor_id is omitted (read — viewer role). Filter by status or priority.

Create a remediation action item against a vendor (write — editor role), typically from an assessment finding. Priority defaults to medium, status to open.

Update a vendor action item (write — editor role). Only passed fields change; set status=completed with completed_date to close it.

Delete a vendor action item (destructive write — editor role). Prefer status=cancelled when the record should stay visible.

List compensating controls recorded against a vendor's gaps (read — viewer): gap, offsetting control, effectiveness, notes. For the org's own controls use scf_list_org_compensating_controls.

Record a compensating control for a vendor gap (write — editor role): what the gap is, what offsets it, and how effective that is (full, partial or minimal — default partial).

Update a vendor compensating control (write — editor role). Only passed fields change: gap description, control text, effectiveness rating, risk-reduction notes.

Delete a vendor compensating control record (destructive write — editor role).

Get the authenticated caller's profile: name, email, organization memberships, and per-org role.

List every organization the caller has access to. Returns org UUID, name, subscription tier, and member count. Use this first to obtain the org_id other tools need.

Get one organization's detail: subscription tier, member count, usage limits, and settings.

List members of one organization with their role (admin, editor, or viewer).

Get the caller's work queue: prioritized pending tasks, assignments, and action items across every organization they belong to.

Get one org's GRC work queue (read — viewer): overdue evidence tasks, blocking controls (material first, then catalogue weighting), stale schedules. assigned_to_me narrows to the caller.

Query one organization's append-only audit trail (read — viewer role): field-level changes with actor, source and before/after values. Filter by entity, control, action, actor, source, date or text.

Cheap has-anything-changed probe (read — viewer role): newest audit timestamp and row count for one organization. Compare with the pair you last saw; poll this before re-pulling the audit log.

Get the caller's notifications: assignments, comments, status changes and alerts, including risk_acceptance_expired (a risk) and control_validation_due (a control).

Mark notifications read for the current user (write — self only): one by notification_id, or every notification when all=true. Acknowledge after processing scf_get_notifications.

Get an organization's settings (read — viewer): profile (business_size, mission_statement), per-domain maturity_targets, name, industry, owner teams and feature switches.

Update the organization profile and maturity targets (write — admin): business_size, mission_statement, maturity_targets. Partial: only passed fields change.

List an organization's 11 KSI capability themes. Themes group NIST 800-53 controls into security capability areas for a high-level posture view.

List an organization's capabilities. Capabilities map to systems and evidence, showing what security functions the infrastructure supports.

List the organization's systems with boundary and recovery record (in_scope, criticality, RTO/RPO hours, data classification, hosting). Filter by linked vendor or boundary decision.

Create a system in the organization's infrastructure inventory (write — editor+ role). Systems can be linked to capabilities and evidence.

Update a system record (write — editor+ role), including its boundary and recovery record. All fields are optional; only provided fields are applied.

Get the multi-axis KSI scorecard for every capability theme. Returns per-theme Implementation Coverage, Maturity, Evidence Coverage, Evidence Quality, and composite KSI Posture Score bands.

Get a single capability theme (KSI) with full posture, multi-axis scores, band, and legacy posture_percentage.

List SCF controls mapped to a capability theme (KSI), with scoping status, implementation status, and maturity level. Supports pagination and scope filtering — ideal for KSI drill-down.

List system-catalog templates — the platform's knowledge base of known vendors/tools (slug, vendor, type, recipe maturity levels). Optionally search by name.

Get one system-catalog template by slug with full detail: aliases and curated evidence-collection recipes (maturity level, steps, frequency, estimated time).

Get evidence-collection recipes for a system, matched via its catalog template, alias, or fallback. Returns matched_via, the template summary, and per-maturity-level recipe steps.

Queue AI generation of evidence-collection recipes for a system (write — editor+ role, async, HTTP 202). Poll scf_get_recipe_generation_status for progress.

Get the status of a queued AI recipe-generation job for a system. Poll this after scf_generate_system_recipes.

Get per-theme evidence metrics: controls with evidence, file counts by assessment status, average relevance score, and derived confidence (strong/moderate/weak/none). Use for KSI evidence dashboards.

Get one system from the organization's inventory (read — viewer role): name, type, vendor, description, catalog template link and the evidence it is configured to provide.

List the evidence types a system can provide and how (read — viewer role): capability status potential/configured/active, collection method, confidence and data format.

Declare that a system can provide one evidence type (write — editor role). One entry per evidence_id per system; status defaults to potential, confidence to medium.

Update a system's evidence capability (write — editor role). Only passed fields change; move status potential → configured → active as the collector is wired up.

Find every system that can provide a given evidence type (read — viewer role) — the inverse of the per-system capability list. Filter by capability status.

Create a webhook endpoint for evidence-inbox ingestion (write — admin role). Returns the plaintext HMAC signing secret exactly once — store it immediately; it cannot be retrieved later.

List the organization's webhook endpoints (newest first). Returns name, status, delivery count, and secret prefix.

Get one webhook endpoint's detail: delivery stats, allowed evidence IDs, and rate-limit configuration.

Revoke a webhook endpoint — soft-delete that marks it inactive (destructive write — admin role). Future deliveries return 403; the record remains for audit.

Rotate the HMAC signing secret for a webhook endpoint (write — admin role). The old secret is invalidated immediately. Returns the new plaintext secret exactly once.

List delivery logs for a webhook endpoint (newest first). Each entry shows signature validation result, processing status, evidence ID, and timestamps.

List the ISMS document generators available to this organization (read — viewer role): generator name, document type, tier, derivative flag. Call before scf_generate_documents.

List the SCF domains this organization can currently generate documents for (read — viewer role). A domain appears only when it has enough scoped controls to produce a document.

Get the organization's document-generation settings (read — viewer role): whether doc-gen is enabled, whether derivative generators are enabled, and the SCF licence acknowledgement state.

Enable or configure document generation (write — admin role). Generation stays blocked until the SCF licence is acknowledged, so the first call usually sets both enabled and acknowledge_licence.

Queue ISMS document generation for one or more generators (write — admin role). Returns a task_id; poll scf_get_document_generation_status. Existing documents are skipped unless force is set.

Poll this organization's in-flight document generation (read — viewer role). Returns {status: 'idle'} when nothing is running. Call after scf_generate_documents until it completes.

List generated ISMS documents (read — viewer role): lifecycle status, section counts, unresolved conflicts, pending retirements, and whether the document is stale against current org inputs.

Get one generated document in full (read — viewer role): metadata plus every section with its merge state — clean, edited, conflicted or pending retirement. Use this to read a document.

Replace one section's content with a human edit (write — editor role). Tracked as a human layer, so a later regeneration reports a conflict instead of overwriting it silently.

Get the generator's own version of a section, ignoring any human edit (read — viewer role). Use it to see what the platform would produce before resolving a conflict.

Resolve one section's merge state (write — editor role). keep_mine/take_generated settle a conflict; retire/keep dispose of a pending retirement. The wrong pair for the state returns 409.

Move a document through its lifecycle — draft to review, review to approved, approved to published (write — approving and publishing need admin). Valid targets are enforced by the platform.

Get a document's version and transition history (read — viewer role): who moved it between lifecycle states, when, why, and what each generation version changed.

Export a document as rendered markdown or HTML text (read — viewer role). The platform also renders PDF, but that is a binary download and is not offered here — fetch it from the web UI instead.

Preview a document's assembled content as structured JSON (read — viewer role) — the merged result of generated and edited sections without rendering to a file.

List the organization's audit engagements (read — viewer role). Each entry carries its frameworks, status, dates and the catalog version its scope was frozen against.

Get one audit engagement's detail (read — viewer role, or an auditor assigned to this engagement).

Create an audit engagement in draft (write — editor role). Freezes the in-scope controls for the named frameworks against the current catalog version, so the scope renders after deprecations.

Update an engagement's name, frameworks, status or dates (write — editor role). Only passed fields change; status moves are caller-controlled: draft → active → under_review → closed.

Delete a draft audit engagement and its frozen scope (destructive write — admin role). Non-draft engagements are refused with 409 — close them instead. Auditor grants are revoked with it.

Get an engagement's frozen control scope (read — viewer role, or an assigned auditor). Rows carry a catalog lifecycle badge, so controls deprecated since the freeze still render, marked.

Get the engagement's scope presented natively in one of its frameworks (read — viewer, or assigned auditor): SCF controls organised by that framework's own structure, as an auditor reads them.

List engagements the caller holds an active auditor grant on, across organizations (read). The auditor's own view — use scf_list_engagements for the organization-side list.

List the auditors granted read access to one engagement (read — viewer role). Each grant carries its status: invited, active or revoked.

Grant an existing user read access to one engagement (write — admin role). Scoped to that engagement's frozen scope and queries only; re-granting a revoked auditor reactivates the grant.

Revoke an auditor's access to one engagement (destructive write — admin role). Returns no content on success.

List an engagement's structured auditor queries (read — viewer role, or an assigned auditor). A query is an auditor's question against one control, with its responses and status.

Get one auditor query with its full response thread (read — viewer role, or an assigned auditor).

Raise an auditor query against one control in the engagement's scope (write — org member or assigned auditor). The control must be in the engagement's frozen scope.

Add a response to an auditor query (write — org member or assigned auditor). Posting a response moves an open query to answered. Returns the updated query with its full thread.

Move an auditor query through its lifecycle (write — org member or assigned auditor). Allowed: open → answered|closed, answered → open|closed, closed → open. Others are refused.

Get this organization's catalog position (read — viewer role): its catalog version, the platform's current version, and whether reconciliation is due or in flight. Start here.

Create a reconciliation preview run (write — admin role): what moving to the target catalog version would do to scoped controls, evidence and mappings. Changes nothing until apply.

List this organization's catalog reconciliation runs, newest first (read — viewer role), with each run's status and target version.

Get one reconciliation run in detail (read — viewer role): the computed diff, every deprecated entity needing a decision, and the planned action currently recorded against each.

Record decisions for a reconciliation run (write — admin role). REPLACES the run's planned actions, so send the complete list. Each deprecated entity gets migrate, retain or retire_only.

Apply a previewed reconciliation run (write — admin role). Asynchronous. The run must be 'previewed' and expected_to_version must match, so a stale preview is refused rather than applied.

Roll an applied reconciliation run back (destructive write — admin role). Asynchronous, and requires the typed confirmation string the run detail states.

Cancel a reconciliation run that has not been applied (write — admin role). The organization stays on its current catalog version.

Get this organization's catalog changelog (read — viewer role): what changed across reconciliations, newest first. Answers 'when did this control change, and what did we decide?'

List the platform's business functions (read — any member): the fixed set every team aligns to, identical for every tenant. Needed for the function_id on scf_create_team.

List the organization's teams (read — viewer role). Archived teams are hidden unless include_inactive is set; they are kept, never deleted, so history still resolves.

Get one team with its full roster and advisory health warnings (read — viewer role), e.g. no primary owner or no members.

Create a team aligned to a business function (write — admin role). The team is born empty; that is legal and reported through health warnings, not refused.

Update a team's name, description, function alignment or active flag (write — admin role). Set is_active=false to archive; the row is never deleted.

Add an organization member to a team as primary, delegate or member (write — admin role). Adding a primary or delegate when the seat is taken demotes the incumbent to member.

Remove a user from a team (destructive write — admin role). The membership row is deleted; the audit trail keeps the history.

Map of which team owns which scoped control or evidence item (read — viewer role). Unfiltered returns the whole map; narrow with item_ids, team_id or accountable_only.

Assign a team to one scoped control or evidence item (write — admin role). is_accountable makes it the accountable team and demotes any incumbent to consulted.

Assign one team to up to 500 controls or evidence items in one transaction with one aggregate notification (write — admin role). The bulk accountability tool.

Remove a team's assignment from a control or evidence item (destructive write — admin role).

List user assignments to controls, evidence items or tasks (read — viewer role). Filter by item type and id, or by user_id to see one person's workload.

Assign a user to a control, evidence item or task as primary or collaborator (write — editor role). Use scf_batch_update_evidence for evidence owners in bulk.

Remove a user assignment (destructive write — editor role).

List the comment thread on one control, evidence item or task (read — viewer role), oldest first, with authors, mentions and reply structure.

Post a comment on a control, evidence item or task (write — any member). Mention users by UUID to notify them; set parent_comment_id to reply in a thread.

Edit a comment you authored (write — author only). Replaces the body and, if given, the mentions; the platform keeps the edit history.

Retract a comment you authored (write — author only). Soft delete: the thread keeps its place, the body is withdrawn.

Get the organization's guided journey — the staged path it walks, with preconditions evaluated (read — viewer role). Never writes: an org without a journey sees the default template as a preview.

List the journey templates this deployment ships (read — viewer role). If importing a returned template_key 404s, the file's declared key differs from its filename stem — import by the stem.

Set or re-issue the org's journey from a template (write — ADMIN role). Merges by stage key: attestations survive; dropping an attested stage is refused (409). An uploaded template wins outright.

Pass a journey stage by named attestation (write — editor+). The ONLY way a stage passes — nothing advances on computed evidence — and who attested is recorded. A conditional pass needs target_date.

List the organisation's control deficiencies, newest first: hand-raised ones and those the platform raises (control at risk, insufficient composite, rejected evidence, capability tests).

Summarise open deficiencies: open_total, material_open_total, unlinked_open, and open counts per control (with material flag) and per domain.

Get one deficiency: title, priority, status, owner, due date, control or risk it is against, source, root cause, retest note and who closed it.

Raise a deficiency by hand (write — editor) against an in-scope control, an assessed risk, or both. At least one of scf_id or risk_code is required. Starts open.

Update a deficiency (write — editor). Only passed fields change. Completing needs a retest_note. There is no delete: set status cancelled instead.

List compensating controls recorded against the organisation's own controls (not vendor ones), with material, risk_acceptance_state and justified flags.

Get one organisation compensating control: gap, what compensates, effectiveness, risk_code, and whether it is still justified.

Record a compensating control for an in-scope control (write — editor). A material control needs risk_code: an accepted, linked risk with an approval in force (409 otherwise).

Update an organisation compensating control (write — editor). Only passed fields change; the control it is for does not. A changed risk_code is re-checked (409).

Record that an in-scope control was validated (write — editor): the note is the record. The control's cadence then sets when the next validation is due.

List the validation schedule: each in-scope control's cadence, last validation, next due date and state, plus counts per state (taken before the state filter).

List the organisation's monthly posture snapshots, most recent month first: period, when and how taken (scheduled or manual), and the counts recorded.

Get one month's posture snapshot by period (YYYY-MM). 404 if that month has none.

Take this month's posture snapshot now (write — editor). The schedule takes one on the 1st; a month has one snapshot, so a second is refused (409).

List capability tests (incident response exercises, continuity tests, others), most recently run first, with finding_count and open_finding_count.

Get one capability test with its findings, each returned as a deficiency.

Record a capability test as run (write — editor). Each finding becomes a deficiency. passed needs no findings; passed_with_findings or failed need at least one (422).

Correct a capability test (write — editor). Only passed fields change; none can be cleared. findings sent here are added. The result must still agree with the findings.

Add a finding to a capability test (write — editor); it is recorded as a deficiency linked to the test. Refused on a test recorded as passed: correct its result instead.