Changelog
Back to All
Added

ControlMap API – Compliance Program Links & Endpoint Changes

August 4th, 2026

Summary

This release adds compliance program linkage to ControlMap: entity responses now show the compliance programs an item is linked to, and the search endpoints let you filter by program.

It also includes breaking changes — two operations move from DELETE to POST, the create-action-item response changes shape, an evidence response field is renamed, and a risk status value is renamed. Review the breaking change items below before upgrading. The major version stays v1, and the regional server list is unchanged.

Changes

Compliance programs

  • programs on entity responses

    • N/A → Available
    • Type: addition
    • Notes: Action item, control, evidence, policy, procedure, and risk responses now include the compliance programs each entity is linked to (through its objectives). Risk and control responses also list the linked framework objectives.

  • Filter by program on search

    • N/A → Available
    • Type: addition
    • Notes: The controls, evidence, governance, policies, procedures, risks, and action-item search endpoints accept an optional program_name filter to return only entities linked to a given program.

Action Items

  • POST /controlmap/v1/clients/{client_id}/action-items
    • Response shape changed
    • Type: breaking change
    • Notes: The create response now returns the full action-item object, matching the GET endpoint. Several fields are renamed or retyped and parent_entity_id is no longer returned — review how you read the create response before upgrading.

Assessments

  • POST /controlmap/v1/clients/{client_id}/assessments/common/questions/{question_code}/mappings/bulk-delete
    • Replaces DELETE .../mappings
    • Type: breaking change
    • Notes: Unmapping evidences, action items, policies, or procedures from an assessment question moved to this POST endpoint (same request body, 204 response). The previous DELETE .../questions/{question_code}/mappings route is removed.

Evidence

  • POST /controlmap/v1/clients/{client_id}/evidences/{evidence_id}/schedule/delete

    • Replaces DELETE .../schedule
    • Type: breaking change
    • Notes: Deleting an evidence refresh schedule moved to this POST endpoint and now takes a required schedule_action query parameter. The previous DELETE .../evidences/{evidence_id}/schedule route is removed.

  • POST /controlmap/v1/clients/{client_id}/evidence-mappings/refresh

    • client_id → clientId
    • Type: breaking change
    • Notes: The refresh response renamed its client_id field to clientId.

Risks

  • PATCH /controlmap/v1/clients/{client_id}/risks/{risk_id}
    • Remediation in progress → Needs Remediation
    • Type: breaking change
    • Notes: The risk status value Remediation in progress is renamed to Needs Remediation. Requests that send the old value are now rejected.

Request validation & pagination

  • Filtering and sorting

    • Grammar standardized
    • Type: change
    • Notes: Cross-client filter[client.*] parameters now require an eq:/in: operator prefix, and sort parameters now accept comma-separated multi-field values (some endpoints require an explicit +/- direction). Update calls that pass a bare filter value or an unsigned sort field.

  • Cursor pagination

    • next_cursor: null → field omitted
    • Type: change
    • Notes: On the evidence, framework-objectives, and client compliance-health list responses, the last page is now signaled by next_cursor being omitted rather than returned as null. Update loops that test for next_cursor === null.

Dates

  • Effective: [2026-08-04]