--- updatedAt: 2026-05-27T12:53:27.000Z agentTools: projectIndex: https://developer.onetrust.com/onetrust/llms.txt --- # Create Control Use this API to create a new control in the Controls Library. # OpenAPI definition ```json { "openapi": "3.1.0", "info": { "title": "Tech Risk & Compliance - IT Risk Management", "description": "The IT Risk Management API provides comprehensive REST endpoints for managing enterprise security controls, threats, vulnerabilities, and their implementations with OAuth2 security and extensive customization capabilities.", "version": "1.0", "contact": { "name": "OneTrust Support", "url": "https://my.onetrust.com/s/contactsupport" }, "license": { "name": "Apache 2.0", "url": "https://www.apache.org/licenses/LICENSE-2.0" } }, "servers": [ { "url": "https://{hostname}", "variables": { "hostname": { "default": "hostname", "description": "The OneTrust hostname such as app.onetrust.com, app-eu.onetrust.com, app-de.onetrust.com, app-uk.onetrust.com, app-apac.onetrust.com, trial.onetrust.com, or uat.onetrust.com." } } } ], "tags": [ { "name": "Controls", "description": "APIs to manage the complete control lifecycle including creation, updates, deletion, retrieval, and entity type management with framework integration and custom attributes.", "externalDocs": { "description": "OpenAPI 3.1.0 - Download Definition", "url": "https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-it-risk-management.json" }, "x-displayName": "Controls" } ], "paths": { "/api/controls/v1/controls": { "post": { "operationId": "addControlUsingPOST", "summary": "Create Control", "description": "Use this API to create a new control in the Controls Library.", "tags": [ "Controls" ], "x-onetrust": { "spec-label": "https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-it-risk-management.json" }, "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TechRiskCompliance-ITRiskManagement_ControlCreateRequestDto" } } } }, "responses": { "201": { "description": "Created", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/TechRiskCompliance-ITRiskManagement_IdResponseUUID" } } } }, "400": { "description": "Bad Request" }, "401": { "description": "Unauthorized" }, "403": { "description": "Forbidden" }, "429": { "description": "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview).", "headers": { "Retry-After": { "schema": { "description": "The number of seconds after which requests will be allowed again.", "format": "int32" } }, "ot-period": { "schema": { "description": "The unit of time for which the rate limit applies", "enum": [ "HOUR", "MINUTE" ] } }, "ot-ratelimit-event-id": { "schema": { "description": "The unique identifier for the rate-limiting event.", "format": "uuid" } }, "ot-request-made": { "schema": { "description": "The number of requests made within the specified period.", "format": "int32" } }, "ot-requests-allowed": { "schema": { "description": "The number of requests allowed within the specified period.", "format": "int32" } } } }, "500": { "description": "Internal Server Error" } }, "security": [ { "TechRiskCompliance-ITRiskManagement_OAUTH2": [ "CONTROL" ] } ] } } }, "components": { "schemas": { "TechRiskCompliance-ITRiskManagement_AssociatedAttributeValueInformation": { "type": "object", "properties": { "id": { "description": "Unique identifier for the attribute option", "type": "string", "format": "uuid", "example": "a34ccec7-1ec0-4d65-9075-bdd0d923f1d1" }, "value": { "description": "Attribute value", "type": "string", "example": "Text Value" }, "valueKey": { "description": "Translation key used for localizing the value", "type": "string", "example": "attribute.option.valueKey" }, "colorCode": { "description": "Color code associated with the option. Used for score-based attributes.", "type": "string", "example": "red" } }, "required": [ "value" ] }, "TechRiskCompliance-ITRiskManagement_AttributeValueInformation": { "type": "object", "properties": { "id": { "description": "Unique identifier for the attribute option", "type": "string", "format": "uuid", "example": "a34ccec7-1ec0-4d65-9075-bdd0d923f1d1" }, "value": { "description": "Attribute value", "type": "string", "example": "Text Value" }, "valueKey": { "description": "Translation key used for localizing the value", "type": "string", "example": "attribute.option.valueKey" }, "colorCode": { "description": "Color code associated with the option. Used for score-based attributes.", "type": "string", "example": "red" }, "optionSelectionValue": { "description": "Selection score value linked to the option. Used for score-based or numerical-based attributes.", "type": "string", "example": "3.5" }, "displayLabel": { "description": "Display name for the option, used for external attributes managed by other systems", "type": "string", "example": "United State | San Francisco" }, "associatedAttributeValueInformation": { "description": "Associated attribute option information", "type": "array", "items": { "$ref": "#/components/schemas/TechRiskCompliance-ITRiskManagement_AssociatedAttributeValueInformation" } }, "disabled": { "description": "Indicates whether this attribute option is currently disabled.", "type": "boolean", "example": false, "default": "false" } }, "required": [ "value" ] }, "TechRiskCompliance-ITRiskManagement_IdResponseUUID": { "type": "object", "properties": { "id": { "description": "Primary identifier of the created or updated entity, typically a UUID.", "type": "string", "format": "uuid", "example": "123e4567-e89b-12d3-a456-426614174000" } }, "required": [ "id" ] }, "TechRiskCompliance-ITRiskManagement_ControlCreateRequestDto": { "type": "object", "properties": { "identifier": { "description": "The identifier of the control.", "type": "string", "example": "A.1.1", "maxLength": 50, "minLength": 1 }, "name": { "description": "The name of the control.", "type": "string", "example": "Control ABC", "maxLength": 300, "minLength": 1 }, "orgGroupId": { "description": "The identifier of the organization the master control is linked to. In general, this is top organization in the org hierarchy.", "type": "string", "format": "uuid", "example": "1a2b3c4e-5f6g-7h8i-9j0k-1l2m3n4o5p6q" }, "description": { "description": "Description of the control.", "type": "string", "example": "Testing Control", "maxLength": 4000, "minLength": 0 }, "recommendation": { "description": "The recommendation status of this control based on Athena logic.", "type": "string", "example": "Recommended", "maxLength": 500, "minLength": 0 }, "frameworkId": { "description": "Identifier of the framework the control is tied to.", "type": "string", "format": "uuid", "example": "1a2b3c4e-5f6g-7h8i-9j0k-1l2m3n4o5p6q" }, "frameworkName": { "description": "Name of the framework the control is tied to.", "type": "string", "example": "NIST", "maxLength": 500, "minLength": 0 }, "frameworkNameKey": { "description": "Identifier used for translation of Framework Name.", "type": "string", "example": "framework.NIST", "maxLength": 500, "minLength": 0 }, "status": { "description": "The new status of the control. This can be Active, Archived, or Pending.", "type": "string", "example": "Active", "enum": [ "Active", "Archived", "Pending" ] }, "categoryId": { "description": "The identifier of the category tied to the control. Optional if no category is needed or if category name is provided.", "type": "string", "format": "uuid", "example": "1a2b3c4e-5f6g-7h8i-9j0k-1l2m3n4o5p6q" }, "categoryName": { "description": "The name of the category tied to the control. Optional if category Id is provided.", "type": "string", "example": "Access Control", "maxLength": 500, "minLength": 0 }, "categoryNameKey": { "description": "Identifier used for translation of category name. Optional if category Id is provided.", "type": "string", "example": "category.AccessControl", "maxLength": 500, "minLength": 0 }, "attributes": { "description": "Custom Attributes", "type": "object", "additionalProperties": { "type": "array", "items": { "$ref": "#/components/schemas/TechRiskCompliance-ITRiskManagement_AttributeValueInformation" } } }, "implementationGuidance": { "description": "Implementation guidance of control.", "type": "string", "example": "Testing Control" }, "seedControlId": { "description": "The identifier of an existing control to use as a template for creating this new control.", "type": "string", "format": "uuid", "example": "123e4567-e89b-12d3-a456-426614174000" }, "importBatchId": { "description": "The identifier of the import batch this control belongs to when importing multiple controls.", "type": "string", "format": "uuid", "example": "123e4567-e89b-12d3-a456-426614174001" }, "origin": { "description": "The origin or creation method of this control (Manual, Import, API, etc.).", "type": "string", "example": "Manual", "enum": [ "BulkImport", "Manual", "FrameworkImport", "FrameworkContentUpdate" ] }, "otControlIdentifier": { "description": "The OneTrust system identifier for this control when importing from the OneTrust catalog.", "type": "string", "format": "uuid", "example": "123e4567-e89b-12d3-a456-426614174002" } }, "required": [ "identifier", "name", "orgGroupId", "origin" ] } }, "securitySchemes": { "TechRiskCompliance-ITRiskManagement_OAUTH2": { "type": "oauth2", "flows": { "clientCredentials": { "tokenUrl": "https://{hostname}/api/access/v1/oauth/token", "scopes": { "CONTROL": "Access to Control Implementation operations for external systems", "ITRM": "Access to ITRM operations for external systems" } } } } } }, "x-readme": { "explorer-enabled": false, "proxy-enabled": false, "metrics-enabled": false }, "x-onetrust": { "spec-label": "OpenAPI 3.1.0" } } ``` # Sibling pages * [Get List of Controls](https://developer.onetrust.com/onetrust/reference/findcontrolsbycriteriausingpost_1.md) * [Delete Control](https://developer.onetrust.com/onetrust/reference/removecontrolusingdelete_1.md) * [Update Control](https://developer.onetrust.com/onetrust/reference/updatecontrolusingput_1.md) * [Get List of Control Entity Source Types](https://developer.onetrust.com/onetrust/reference/getallenabledcontrolentitytypesusingget.md) * [Get Related Control Entity Types](https://developer.onetrust.com/onetrust/reference/getallrelatedcontrolentitytypesusingget.md)