scf_control_read
Read-only
Read an organization's scoped SCF controls: list with filters, fetch one control in full, view scoping stats and framework coverage, or preview a framework scope change before applying it.
Instructions
Read the organization's control scope: list scoped controls with filters, one control in full, scoping stats, framework scope summary, or preview a framework scope change. Pick with method.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| sort | No | Order: 'scf_id' (default), or 'weighting' — material controls first, then catalogue weighting highest first, then scf_id. Rows also carry target_maturity, target_source (control | domain), target_maturity_reason, procedure_document_id, procedure_document_status, last_validated_at, last_validated_by and last_validation_note Used by: list. | |
| basis | No | Filter by obligation basis: 'mcr', 'dsr', or 'unclassified' (no classified framework and no override). Each row carries obligation_basis, basis_source (override | framework) and basis_override_reason Used by: list. | |
| limit | No | Page size (1–200, default 50) Used by: list. | |
| domain | No | SCF domain code (e.g., 'GOV', 'AST', 'IAC') Used by: list. | |
| method | Yes | list: List controls scoped to the organization with status, basis, target maturity, materiality, procedure and last validation. Filter by scope, domain, framework, team, basis, material. Paginated. get: Get one scoped control: owner, notes, scope/basis/target/material overrides with reason, set_at and set_by, procedure_document_id, last validation. Identify by scf_id, not UUID. stats: Get the organization's implementation statistics: counts by status, overall completion percentage, and per-framework coverage breakdown. framework_scope: Get framework coverage and selection state (read — viewer): each framework's coverage, basis, obligation_type and obligation_source, and basis_counts (in-scope controls by mcr/dsr/unclassified). preview_framework_change: Preview adding or removing frameworks WITHOUT applying it (read — viewer): controls entering or leaving scope, orphaned evidence, and on remove basis_downgrades (controls whose basis weakens). | |
| offset | No | Pagination offset — number of results to skip (default 0) Used by: list. | |
| org_id | Yes | Organization UUID — obtain from scf_list_organizations | |
| scf_id | No | SCF control identifier in DOMAIN-NN format (e.g., 'AST-01', 'GOV-02') — NOT the UUID Used by: get. | |
| search | No | Free-text filter applied to control ID, name, or description Used by: list. | |
| team_id | No | Filter to controls this team is assigned to, accountable or consulted — obtain from scf_list_teams Used by: list. | |
| material | No | Filter by materiality: true for material controls (catalogue weighting 10, or an admin override), false for the rest. Rows carry material, material_source (control | weighting) and material_reason Used by: list. | |
| my_teams | No | Filter to controls assigned to any team the caller belongs to; intersects with team_id rather than overriding it. 'The caller' is the API key's identity; on a self-hosted instance that is a service account on no team, so this returns nothing — use team_id instead. Used by: list. | |
| framework | No | Framework slug (e.g., 'nist-800-53') to filter mapped controls Used by: list. | |
| operation | No | 'add' to preview scoping these frameworks in, 'remove' to preview taking them out Used by: preview_framework_change. | |
| frameworks | No | Framework slugs to model — obtain from scf_list_frameworks Used by: preview_framework_change. | |
| function_id | No | Filter to controls assigned to any team aligned to this function — obtain from scf_list_functions Used by: list. | |
| csf_function | No | NIST CSF function: 'GOVERN', 'IDENTIFY', 'PROTECT', 'DETECT', 'RESPOND', or 'RECOVER' Used by: list. | |
| scope_status | No | Scope filter: 'in_scope' (selected), 'out_of_scope' (deselected), or 'all' (default — everything) Used by: list. | |
| control_weighting | No | Weighting threshold on a 0–10 scale Used by: list. | |
| accountable_owner_type | No | Filter by the accountable team's primary owner: 'internal' or 'external_contractor' Used by: list. |