List SCF security controls from the reference catalog. Returns paginated controls with SCF ID, title, description, and mapped frameworks. Filter by domain, framework, or free-text search.

Get a single SCF control by ID. Returns description, mapped frameworks, assessment objectives, and linked evidence items from the reference catalog.

List every compliance framework mapped in the SCF catalog (NIST 800-53, ISO 27001, SOC 2, FedRAMP, GDPR, and 350+ more). Returns framework identifiers and display names.

List every compliance domain in the SCF taxonomy. Domains group related controls (e.g., GOV = Governance, AST = Asset Management, IAC = Identity & Access Control).

List evidence items from the SCF reference catalog — the 272 standard evidence types that can be collected to demonstrate control implementation. Supports free-text search and pagination.

List SCF assessment objectives — the 5,736 test criteria used to evaluate control implementation. Optionally filter by control ID; supports free-text search and pagination.

List controls scoped to the organization with implementation status. Filter by scope status, domain, framework, CSF function, weighting, or free-text search. Paginated.

Get one scoped control in detail: owner, implementation notes, evidence links, and audit history. Identify by scf_id, not by UUID.

Update a scoped control's implementation fields (write — editor+ role). Identify by scf_id, not UUID. Only provided fields are applied.

Get the organization's implementation statistics: counts by status, overall completion percentage, and per-framework coverage breakdown.

Bulk-scope every control mapped to a framework into the organization (write — editor+ role). Creates a scoped-control entry for each control in the framework.

Batch-update up to 500 scoped controls in one transaction (write — editor+ role). Each operation identifies its target by scf_id; status values are lowercase.

List evidence items tracked against an organization's controls. Returns each item's tracking status, maturity level, and linked controls. Optionally filter by system.

Create an evidence tracking record from a catalog evidence ID (write — editor+ role). Starts tracking an evidence item for the organization.

Get the organization's evidence maturity summary: average maturity score, automation percentage, distribution by maturity level, and improvement opportunities.

Get one evidence item's collection maturity: current level (1=Ad Hoc to 5=Optimized), contributing factors, upgrade potential, and tracking state.

Get upgrade-path recommendations for maturing one evidence item's collection: target level, effort, impact, and step-by-step actions — the same guidance shown in the platform UI.

Get system-aware collection suggestions for one evidence item: which tracked system currently collects it, which in-scope systems are capable of collecting it, and tailored collection guidance.

List the organization's evidence coverage gaps: evidence required by in-scope controls that is not yet tracked, with overall coverage percentage.

Get evidence collection health for the organization: per-item freshness status (green/amber/red) against collection frequency, with a roll-up summary.

List all files uploaded or ingested for an evidence item. Returns filename, content type, upload timestamp, validation status, and a pre-signed download URL (15-min expiry).

Get metadata and a pre-signed download URL (15-min expiry) for a single evidence file. Use to inspect or retrieve a specific uploaded artifact.

Upsert an evidence item's tracking fields (write — editor+ role). Creates the tracking row if missing. All body fields are optional; only provided fields are applied.

Get the validation result for a single evidence file: status (valid/warning/partial/invalid), completeness score, individual rule findings, source, and timestamp.

Re-run the validation engine against an evidence file (write — editor+ role). Checks catalog existence, content type, field coverage, freshness, storage. Returns the updated result.

Get aggregate evidence validation metrics for the organization dashboard: total files validated, counts by status (valid/warning/partial/invalid), and overall pass rate.

Queue an AI assessment of a single evidence file (write — editor+ role, async). Returns a pending record; poll scf_get_evidence_assessment until status is sufficient/partial/insufficient.

Get the AI assessment for an evidence file: status, relevance score (0–100), structured findings, summary, and audit metadata (model, tokens, cost). Poll after scf_trigger_evidence_assessment.

Queue AI assessments for multiple evidence files (write — editor+ role, async, max 50). Provide evidence_id, file_ids, and/or assess_unassessed. Returns count queued.

Get aggregate AI assessment metrics for the organization dashboard: total assessed, counts by status, unassessed count, average relevance score, and total cost in cents.

List evidence collection tasks — the work queue showing what needs to be collected, by whom, and by when. Optionally filter by assignee or status.

Queue a windowed AI assessment that scores every file in the evidence item's frequency window as one portfolio (write — editor+ role, async). Returns 422 if tracking or frequency is missing.

List recent windowed AI assessments for an evidence item (newest first). Each entry includes window bounds, frequency, file IDs, coverage, status, relevance score, findings, and cost.

Get one windowed AI assessment by ID. Returns full detail: window bounds, frequency, file IDs, coverage, expected artifact types, status, relevance score, findings, summary, hashes, tokens, cost.

Queue windowed AI assessments for up to 25 evidence IDs (write — editor+ role, async). Items without tracking or a frequency set are reported under skipped_detail in the response.

Get aggregate windowed-assessment metrics for the organization dashboard: total windows assessed, counts by status (including insufficient_sample), average relevance score, and total cost in cents.

Get the rolled-up assessment composite for one SCF control: composite score, status band, included/missing evidence IDs, mandatory gaps, per-window detail. 404 if no composite row exists yet (async).

List rolled-up assessment composites for the org. Cursor-paginated, worst-band first (insufficient → sufficient). Filter by status/domain/computation_version. Pass next_cursor to page forward.

List risk assessments in the organization's risk register. Returns each risk's likelihood, impact, treatment status, and linked controls.

Get one risk assessment in detail: likelihood, inherent and residual impact scores, treatment plan, owner, and review date.

Create a new risk assessment in the risk register (write — editor+ role). Likelihood and impact scores populate the 5×5 risk matrix.

Get the 5×5 risk matrix data for the organization — risk distribution across likelihood × impact, ready for visualization.

Get the organization's aggregate risk summary: totals by severity, treatment status breakdown, and trend data.

List the organization's custom risk definitions — org-defined risks alongside the static SCF catalog, carrying auto-generated R-ORG-N codes.

Create a custom org-defined risk (write — editor+ role). Auto-generates an R-ORG-N code and creates the matching risk assessment record.

Update a custom risk definition's metadata — title, description, category (write — editor+ role). Only provided fields are applied.

Delete a custom risk definition, its assessment record, and every control mapping (destructive write — editor+ role). Irreversible.

List controls linked to a custom risk. Returns catalog_control_ids plus scoped_controls with implementation status — same shape as the built-in controls-for-risk endpoint.

Link a scoped control to a custom risk (write — editor+ role). The control must already be scoped (in-scope) for this organization.

Unlink a scoped control from a custom risk (write — editor+ role). The control and risk both remain; only the mapping is removed.

List third-party vendors in the organization's TPRM (Third-Party Risk Management) registry. Optionally filter by status or criticality. Paginated.

Get one vendor's detail: certifications, assessments, computed risk score, and latest research results.

Create a vendor in the TPRM registry (write — editor+ role). Platform auto-scores risk based on criticality and data handling.

Update an existing vendor record (write — editor+ role). Only provided fields are applied.

Queue AI security research for a vendor (write — editor+ role, async). Checks HIBP breach data, NVD vulnerabilities, and public posture. Returns a task ID; poll scf_get_vendor_research.

Get the latest vendor research result: breach history, known vulnerabilities, and security posture analysis. Poll this after scf_trigger_vendor_research.

Queue an AI vendor security assessment (write — editor+ role, async, HTTP 202). Replaces the deprecated DPSIA trigger. Returns assessment_id + job_id; poll scf_get_vendor_assessment_status.

List a vendor's AI security assessments, newest first. Includes status, RAG rating, recommendation, and report fields per record.

Get a vendor's latest completed AI security assessment: RAG status, recommendation, executive summary, report_markdown/report_json. 404 if none completed yet.

Get one vendor AI assessment by ID with full detail: services_used, data_role, RAG status, recommendation, full report fields, and research sources.

Get the job status of a queued vendor AI assessment: status, started_at, completed_at, error_message. Poll this after scf_trigger_vendor_assessment.

Get the authenticated caller's profile: name, email, organization memberships, and per-org role.

List every organization the caller has access to. Returns org UUID, name, subscription tier, and member count. Use this first to obtain the org_id other tools need.

Get one organization's detail: subscription tier, member count, usage limits, and settings.

List members of one organization with their role (admin, editor, or viewer).

Get the caller's work queue: prioritized pending tasks, assignments, and action items across every organization they belong to.

Get one organization's audit trail: field-level changes to controls, evidence, and related entities, with actor, timestamp, and before/after values.

Get the caller's notifications: new assignments, comments, status changes, and system alerts.

List an organization's 11 KSI capability themes. Themes group NIST 800-53 controls into security capability areas for a high-level posture view.

List an organization's capabilities. Capabilities map to systems and evidence, showing what security functions the infrastructure supports.

List the organization's infrastructure systems — the tools and platforms that implement security capabilities. Optionally filter by linked vendor.

Create a system in the organization's infrastructure inventory (write — editor+ role). Systems can be linked to capabilities and evidence.

Update an existing system record (write — editor+ role). All fields are optional; only provided fields are applied.

Get the multi-axis KSI scorecard for every capability theme. Returns per-theme Implementation Coverage, Maturity, Evidence Coverage, Evidence Quality, and composite KSI Posture Score bands.

Get a single capability theme (KSI) with full posture, multi-axis scores, band, and legacy posture_percentage.

List SCF controls mapped to a capability theme (KSI), with scoping status, implementation status, and maturity level. Supports pagination and scope filtering — ideal for KSI drill-down.

List system-catalog templates — the platform's knowledge base of known vendors/tools (slug, vendor, type, recipe maturity levels). Optionally search by name.

Get one system-catalog template by slug with full detail: aliases and curated evidence-collection recipes (maturity level, steps, frequency, estimated time).

Get evidence-collection recipes for a system, matched via its catalog template, alias, or fallback. Returns matched_via, the template summary, and per-maturity-level recipe steps.

Queue AI generation of evidence-collection recipes for a system (write — editor+ role, async, HTTP 202). Poll scf_get_recipe_generation_status for progress.

Get the status of a queued AI recipe-generation job for a system. Poll this after scf_generate_system_recipes.

Get per-theme evidence metrics: controls with evidence, file counts by assessment status, average relevance score, and derived confidence (strong/moderate/weak/none). Use for KSI evidence dashboards.

Create a webhook endpoint for evidence-inbox ingestion (write — admin role). Returns the plaintext HMAC signing secret exactly once — store it immediately; it cannot be retrieved later.

List the organization's webhook endpoints (newest first). Returns name, status, delivery count, and secret prefix.

Get one webhook endpoint's detail: delivery stats, allowed evidence IDs, and rate-limit configuration.

Revoke a webhook endpoint — soft-delete that marks it inactive (destructive write — admin role). Future deliveries return 403; the record remains for audit.

Rotate the HMAC signing secret for a webhook endpoint (write — admin role). The old secret is invalidated immediately. Returns the new plaintext secret exactly once.

List delivery logs for a webhook endpoint (newest first). Each entry shows signature validation result, processing status, evidence ID, and timestamps.

List the ISMS document generators available to this organization (read — viewer role): generator name, document type, tier, derivative flag. Call before scf_generate_documents.

List the SCF domains this organization can currently generate documents for (read — viewer role). A domain appears only when it has enough scoped controls to produce a document.

Get the organization's document-generation settings (read — viewer role): whether doc-gen is enabled, whether derivative generators are enabled, and the SCF licence acknowledgement state.

Enable or configure document generation (write — admin role). Generation stays blocked until the SCF licence is acknowledged, so the first call usually sets both enabled and acknowledge_licence.

Queue ISMS document generation for one or more generators (write — admin role). Returns a task_id; poll scf_get_document_generation_status. Existing documents are skipped unless force is set.

Poll this organization's in-flight document generation (read — viewer role). Returns {status: 'idle'} when nothing is running. Call after scf_generate_documents until it completes.

List generated ISMS documents (read — viewer role): lifecycle status, section counts, unresolved conflicts, pending retirements, and whether the document is stale against current org inputs.

Get one generated document in full (read — viewer role): metadata plus every section with its merge state — clean, edited, conflicted or pending retirement. Use this to read a document.

Replace one section's content with a human edit (write — editor role). Tracked as a human layer, so a later regeneration reports a conflict instead of overwriting it silently.

Get the generator's own version of a section, ignoring any human edit (read — viewer role). Use it to see what the platform would produce before resolving a conflict.

Resolve one section's merge state (write — editor role). keep_mine/take_generated settle a conflict; retire/keep dispose of a pending retirement. The wrong pair for the state returns 409.

Move a document through its lifecycle — draft to review, review to approved, approved to published (write — approving and publishing need admin). Valid targets are enforced by the platform.

Get a document's version and transition history (read — viewer role): who moved it between lifecycle states, when, why, and what each generation version changed.

Export a document as rendered markdown or HTML text (read — viewer role). The platform also renders PDF, but that is a binary download and is not offered here — fetch it from the web UI instead.

Preview a document's assembled content as structured JSON (read — viewer role) — the merged result of generated and edited sections without rendering to a file.

List the organization's audit engagements (read — viewer role). Each entry carries its frameworks, status, dates and the catalog version its scope was frozen against.

Get one audit engagement's detail (read — viewer role, or an auditor assigned to this engagement).

Create an audit engagement (write — admin role). This freezes the in-scope controls for the named frameworks against the current catalog version, so the scope renders even after deprecations.

Update an audit engagement's name, frameworks, status or dates (write — admin role). Only the fields you pass are changed.

Delete an audit engagement and its frozen scope (destructive write — admin role). Returns no content on success. Auditor access granted through this engagement is revoked with it.

Get an engagement's frozen control scope (read — viewer role, or an assigned auditor). Rows carry a catalog lifecycle badge, so controls deprecated since the freeze still render, marked.

Get the engagement's scope presented natively in one of its frameworks (read — viewer, or assigned auditor): SCF controls organised by that framework's own structure, as an auditor reads them.

List the engagements the calling identity can read as an assigned auditor, across organizations (read). This is the auditor's own view — use scf_list_engagements for the organization-side list.

List the auditors granted read access to one engagement (read — viewer role).

Grant an existing user read access to one engagement (write — admin role). The grant is engagement-scoped: it exposes that engagement's frozen scope and queries, nothing else in the organization.

Revoke an auditor's access to one engagement (destructive write — admin role). Returns no content on success.

List an engagement's structured auditor queries (read — viewer role, or an assigned auditor). A query is an auditor's question against one control, with its responses and status.

Get one auditor query with its full response thread (read — viewer role, or an assigned auditor).

Raise an auditor query against one control in the engagement's scope (write — editor role, or an assigned auditor). The control must be in the engagement's frozen scope.

Add a response to an auditor query (write — editor role, or an assigned auditor). Returns the updated query with its full thread.

Move an auditor query through its lifecycle (write — editor role, or an assigned auditor). The platform validates the transition, so an invalid target is refused rather than recorded.

Get this organization's catalog position (read — viewer role): its catalog version, the platform's current version, and whether reconciliation is due or in flight. Start here.

Create a reconciliation preview run (write — admin role): what moving to the target catalog version would do to scoped controls, evidence and mappings. Changes nothing until apply.

List this organization's catalog reconciliation runs, newest first (read — viewer role), with each run's status and target version.

Get one reconciliation run in detail (read — viewer role): the computed diff, every deprecated entity needing a decision, and the planned action currently recorded against each.

Record decisions for a reconciliation run (write — admin role). REPLACES the run's planned actions, so send the complete list. Each deprecated entity gets migrate, retain or retire_only.

Apply a previewed reconciliation run (write — admin role). Asynchronous. The run must be 'previewed' and expected_to_version must match, so a stale preview is refused rather than applied.

Roll an applied reconciliation run back (destructive write — admin role). Asynchronous, and requires the typed confirmation string the run detail states.

Cancel a reconciliation run that has not been applied (write — admin role). The organization stays on its current catalog version.

Get this organization's catalog changelog (read — viewer role): what changed across reconciliations, newest first. Answers 'when did this control change, and what did we decide?'

Get the CDM document map (read — viewer role): per-domain coverage showing which ingested documents speak to which SCF domains, and where the corpus is silent. Finds documentation gaps.

List the documents ingested into the organization's CDM corpus (read — viewer role), with their ingestion state.

List control-level CDM proposals with nested citations (read — viewer role), highest consolidated score first. The review queue: 'this document evidences this control, here is where'.

Accept a control-level CDM proposal (write — editor role). One decision covers the whole card: the proposal and every citation under it flip to accepted together.

Dismiss a control-level CDM proposal (write — editor role). The proposal and its citations are dismissed together, and the reason — if given — is stored on each.

List CDM citation-level mappings (read — viewer role): the document passages proposed as evidence for a control, each lifecycle-badged. Use scf_list_cdm_proposals for the per-control view.

Search the organization's ingested policy corpus for passages relevant to one scoped control (read — viewer role). Ranked hits with source documents: 'what do our own documents say?'