---
openapi: 3.0.0
info:
  title: Secureframe API
  description: |
    ## Introduction

    [Secureframe](https://secureframe.com/) exposes a REST API for use by customers, partners, and community developers.

    The Secureframe API utilizes [resource-oriented endpoints](https://cloud.google.com/apis/design/resources) and returns requests in the form of standard JSON responses, based on the [JSON API spec](https://jsonapi.org/). Search utilizes [Lucene Syntax](https://lucene.apache.org/core/2_9_4/queryparsersyntax.html).

    API URL (latest version): https://api.secureframe.com

    New to Secureframe?\
    Customers: [Start here](https://secureframe.com/request-demo)\
    Partners: [Start here](https://secureframe.com/contact/partner)

    ### MCP Documentation

    Looking for MCP documentation? [Start here](https://mcp.secureframe.com/mcp_docs)

    ## Authentication

    Secureframe utilizes API keys to authenticate requests. API keys are assigned on a per company <> user basis. API secrets can only be viewed a single time at key creation. Please securely store your secrets and do not share your keys in a public medium. If you forget your secret, you must generate a new API key.

    To view, create, and revoke API keys, navigate to the Secureframe Console -> Your Profile -> Company settings -> API keys. This page is protected by RBAC and only accessible by certain roles.
    To authenticate with an API Key and Secret, include the header `'Authorization: <YOUR_API_KEY> <YOUR_KEY_SECRET>'` in your request.

    ```
    --header 'Authorization: <YOUR_API_KEY> <YOUR_SECRET_KEY>'
    ```

    Requests made via HTTP will be redirected to HTTPS.

    ## Authorization

    Secureframe utilizes role-based access control (RBAC) to determine which requests are authorized based on the assigned company <> user.

    As an example, let’s say a user is assigned to a custom role called “Risk Manager”, and that role does not have permission to view Tests. If a request is made to a Tests endpoint with an API Key <> Secret pair assigned to that user, the request will fail.

    To determine the permissions of each role, navigate to the Secureframe Console -> Personnel -> Personnel settings -> Roles and click into the applicable role.

    ## Creating a Request

    Reference the below template in `cURL` for creating a request with parameters:

    ```bash
    curl --location -g --request GET \
         --header 'Authorization: <YOUR_API_KEY> <YOUR_SECRET_KEY>' \
         'https://api.secureframe.com/<ENDPOINT>?include[<PARAM>]=<VALUE>
    ```

    Note: Our API does not directly support bulk updates - only one object can be updated per request. That said, you can utilize loops to mimic bulk operations.

    ## Request History

    API requests, just like console-based requests, are tracked in the Audit Log (note: API vs Console requests are not differentiated visually).

    To access the Audit Log, navigate to the Secureframe Console -> Your Profile -> Company settings -> Audit Log. This page is protected by RBAC and only accessible by certain roles.

    ## Rate Limiting

    Requests are limited to 500 requests per minute per IP address. If the limit is exceeded, requests will be blocked until requests are available based on the aforementioned limit.

    ## Errors

    | HTTP Status Code        | Description                                                                           |
    | ----------------------- | ------------------------------------------------------------------------------------- |
    | 200 - OK                | Request successful                                                                    |
    | 400 - Bad Request       | Invalid request                                                                       |
    | 401 - Unauthorized      | Invalid authentication to make requested response. API key and/or secret are invalid. |
    | 403 - Forbidden         | Invalid authorization to requested resource. Insufficient permissions based on RBAC.  |
    | 429 - Too Many Requests | Rate limit of 500 requests per minute has been reached for the IP address.            |
    | 500                     | Internal server error                                                                 |

    ## Versioning

    Secureframe makes many additive API changes that are _backwards compatible_ and able to be supported in all API versions:

    - Adding operations
    - Adding optional parameters
    - Adding optional request headers
    - Adding response attributes
    - Adding response headers

    Backwards _incompatible_ changes require Secureframe to release a new dated API version, as the can potentially break an integration:

    - Removing operations
    - Removing, renaming, or changing the type of a parameter
    - Adding a required parameter or making a previously optional parameter now required
    - Removing attributes from request responses
    - Adding a required header
    - Introducing new parameter data validation constraints
    - Updating authentication and authorization mechanisms

    | Dated Version (Release Date) | API URL                      | Deprecation Date |
    | :--------------------------- | :--------------------------- | :--------------- |
    | 2023-10-18                   | https://api.secureframe.com/ | -                |

    ## API Changelog

    ### 2023-10-18

    - Released API Dated Version 2023-10-18
    - Initial release.
  version: '2023-10-18'
  x-logo:
    url: https://media.secureframe.com/logo-dark.svg
servers:
- url: https://api.secureframe.com
- url: https://api-uk.secureframe.com
paths:
  "/cloud_resources/{cloud_resource_id}/framework_asset_scopes":
    get:
      tags:
      - Cloud Resource Framework Asset Scope
      operationId: cloudResourcesCompanyFrameworkAssetScopesIndex
      parameters:
      - name: cloud_resource_id
        description: Scope response to cloud_resource_id
        required: true
        in: path
        schema:
          type: string
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - manually_scoped_by
        explode: false
        style: form
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/FrameworkAssetScope"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |-
        Returns a list of Framework Asset Scopes for the Cloud Resource by ID

        The absence of a Framework Asset Scope indicates the asset is not in scope for the Framework.
      summary: List Framework Asset Scopes
      security:
      - header_authorization: &1 []
      x-controller: api/cloud_resources/company_framework_asset_scopes
      x-action: index
    post:
      tags:
      - Cloud Resource Framework Asset Scope
      operationId: cloudResourcesCompanyFrameworkAssetScopesCreate
      parameters:
      - name: active
        description: Flag to indicate if this Framework Asset Scope is active.
        required: false
        in: query
        schema:
          type: boolean
      - name: cloud_resource_id
        description: Scope response to cloud_resource_id
        required: true
        in: path
        schema:
          type: string
      - name: framework_id
        description: The ID of the Framework assigned to this Framework Asset Scope.
        required: false
        in: query
        schema:
          type: string
          format: uuid
      - name: manually_scoped_reason
        description: Reason if this Framework Asset Scope is manually scoped.
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/FrameworkAssetScope"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Create a Framework Asset Scope for the Cloud Resource by ID
      summary: Create Framework Asset Scope
      security:
      - header_authorization: *1
      x-controller: api/cloud_resources/company_framework_asset_scopes
      x-action: create
  "/cloud_resources":
    get:
      tags:
      - Cloud Resource
      operationId: cloudResourcesIndex
      parameters:
      - name: include
        description: 'Comma delimited string of relationships to include. Note: company_vendor_connection
          is deprecated, please use integration_connection instead.'
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - company_vendor_connection
            - integration_connection
            - owner
        explode: false
        style: form
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the Cloud Resource data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      - name: sort
        description: 'Comma delimited string of fields to sort the results by, applied
          in the order given. Prefix a field with `-` to sort it in descending order,
          for example `?sort=-cloud_resource_type,created_at`. Sortable fields: `cloud_resource_type`,
          `created_at`, `id`, `in_audit_scope`, `region`, `third_party_id`, `updated_at`,
          `vendor_name`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/CloudResource"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of Cloud Resources.
        ### Search parameters

        - `cloud_resource_type` — The type of this Cloud Resource
          - Valid values: `account`, `acm_certificate`, `alert`, `analytics`, `api_management_service`, `app_gateway`, `app_workflow`, `athena_workgroup`, `audit_config_all_services`, `authentication_policy`, `authorization_role_assignment`, `autoscaling_group`, `batch_account`, `cdn`, `certificate`, `check_point_quantum_access_layer`, `check_point_quantum_access_role`, `check_point_quantum_access_rulebase`, `check_point_quantum_access_rule`, `check_point_quantum_host`, `check_point_quantum_https_layer`, `check_point_quantum_https_rulebase`, `check_point_quantum_ips_status`, `check_point_quantum_nat_rulebase`, `check_point_quantum_network`, `check_point_quantum_tcp_service`, `check_point_quantum_threat_indicator`, `check_point_quantum_udp_service`, `cloudfront_distribution`, `cloudtrail`, `cloudwatchlogs_log_group`, `cluster`, `cluster_node_pool`, `compute_backend_service`, `compute_disk`, `compute_instance`, `compute_network`, `compute_subnetwork`, `compute_target_http_proxy_list`, `compute_url_map`, `configservice_recorder`, `container_cluster`, `container_registry`, `crypto_key`, `data_collection_rule`, `data_collection_rule_association`, `database`, `database_backup`, `database_firewall_rule`, `database_replica`, `datadog_dashboard`, `datadog_monitor`, `datalake_analytics`, `datalake_storage`, `desktop_virtualization_application_group`, `desktop_virtualization_host_pool`, `desktop_virtualization_workspace`, `dms_instance`, `diagnostic_setting`, `dns_managed_zone`, `docker_image`, `domain`, `domain_record`, `droplet`, `droplet_neighbor`, `dynamodb_table`, `ec2_image`, `ec2_instance`, `ec2_security_group`, `ec2_snapshot`, `ec2_subnet`, `ec2_volume`, `ec2_vpc`, `ec2_vpc_peering_connections`, `ecr_repository`, `efs_filesystem`, `eks_cluster`, `elasticloadbalancing`, `elb`, `elbv2`, `elbv2_listener`, `es_domain`, `event_hub`, `firehose_stream`, `firewall`, `floating_ip`, `fsx_file_system`, `glacier_vault`, `guardduty_detector`, `heroku_addon`, `heroku_app`, `iam_certificate`, `iam_group`, `iam_mfa_device`, `iam_password_policy`, `iam_role`, `iam_user`, `iam_account`, `iam_credential_report`, `image`, `iot`, `key`, `key_vault`, `keyring`, `kinesis_stream`, `kms_key`, `lambda_function`, `load_balancer`, `log_alert`, `log_profile`, `metric`, `microsoft_compute_virtualmachines`, `microsoft_compute_virtualmachines_scaleset`, `microsoft_container_images`, `microsoft_dbformysql_servers`, `microsoft_dbforpostgresql_servers`, `microsoft_sentinel_alert_rule`, `microsoft_sentinel_content_package`, `microsoft_sentinel_data_connector`, `microsoft_sentinel_incident`, `microsoft_sentinel_threat_indicator`, `microsoft_sql_servers`, `microsoft_sql_servers_blob_auditing_policy`, `microsoft_sql_servers_databases`, `microsoft_storage_storageaccounts`, `monitor_action_group`, `monitoring_alert_policy`, `monitor_scheduled_query_rule`, `nat_gateway`, `network_interface`, `network_load_balancer`, `network_policy`, `network_watcher`, `operational_insights_workspace`, `organizations_account`, `password_policy`, `policy_assignment`, `project`, `project_resource`, `public_ip_address`, `rds_cluster`, `rds_instance`, `rds_snapshot`, `redis_service`, `resourcemanager_project`, `redshift`, `region`, `registry`, `registry_repository`, `route53domain`, `route_table`, `s3_bucket`, `sagemaker_notebook`, `search_service`, `security_auto_provisioning_setting`, `security_contact`, `security_pricing`, `security_group`, `servicebus`, `service_account`, `ses_dkim`, `ses_ruleset`, `snapshot`, `sns_topic`, `space`, `space_cor`, `sql_instance`, `sqs_queue`, `ssl_proxy`, `ssm_instance`, `ssm_parameter`, `storage_bucket`, `storage_container`, `storage_volume`, `subscription`, `transfer_server`, `virtual_machine_extension`, `virtual_network`, `vpc`, `vpc_member`, `web_app_service`, `xray_encryption_config`
        - `created_at` — The date this Cloud Resource was created
        - `id` — The ID of the Cloud Resource
        - `in_audit_scope` — Flag to indicate if this Cloud Resource is in scope. [DEPRECATED - Use the Cloud Resource Framework Asset Scope [endpoint](/tag/Cloud-Resource-Framework-Asset-Scope#operation/cloudResourcesCompanyFrameworkAssetScopesIndex)]
          - Valid values: `true`, `false`
        - `region` — The region this Cloud Resource belongs to
        - `third_party_id` — The identifier for this Cloud Resource on the vendor side
        - `updated_at` — The date this Cloud Resource was last updated
        - `vendor_name` — The name of the vendor that this Cloud Resource is from
      summary: List Cloud Resources
      security:
      - header_authorization: &2 []
      x-controller: api/cloud_resources
      x-action: index
  "/cloud_resources/{id}":
    get:
      tags:
      - Cloud Resource
      operationId: cloudResourcesShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: include
        description: 'Comma delimited string of relationships to include. Note: company_vendor_connection
          is deprecated, please use integration_connection instead.'
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - company_vendor_connection
            - integration_connection
            - owner
        explode: false
        style: form
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/CloudResource"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a single Cloud Resource by ID
      summary: Get a Cloud Resource
      security:
      - header_authorization: *2
      x-controller: api/cloud_resources
      x-action: show
    put:
      tags:
      - Cloud Resource
      operationId: cloudResourcesUpdate
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: in_audit_scope
        description: Flag to indicate if this Cloud Resource is in scope. [DEPRECATED
          - Use the Cloud Resource Framework Asset Scope [endpoint](/tag/Cloud-Resource-Framework-Asset-Scope#operation/cloudResourcesCompanyFrameworkAssetScopesCreate)]
        required: false
        in: query
        schema:
          type: boolean
      - name: out_of_audit_scope_reason
        description: Out of scope reason if the Cloud Resource is not in scope. [DEPRECATED
          - Use the Cloud Resource Framework Asset Scope [endpoint](/tag/Cloud-Resource-Framework-Asset-Scope#operation/cloudResourcesCompanyFrameworkAssetScopesCreate)]
        required: false
        in: query
        schema:
          type: string
          enum:
          - development_asset
          - staging_asset
          - out_of_scope_production_asset
      - name: owner_id
        description: ID of the User that's the owner of this Cloud Resource.
        required: false
        in: query
        schema:
          type: string
          format: uuid
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/CloudResource"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Update a Cloud Resource by ID
      summary: Update a Cloud Resource
      security:
      - header_authorization: *2
      x-controller: api/cloud_resources
      x-action: update
  "/comments":
    get:
      tags:
      - Comment
      operationId: commentsIndex
      parameters:
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - author
        explode: false
        style: form
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the Comment data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      - name: sort
        description: 'Comma delimited string of fields to sort the results by, applied
          in the order given. Prefix a field with `-` to sort it in descending order,
          for example `?sort=-commentable_type,commentable_id`. Sortable fields: `commentable_type`,
          `commentable_id`, `company_id`, `content`, `id`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/Comment"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of Comments.
        ### Search parameters

        - `commentable_type` — The type of the commentable object
          - Valid values: `Company`, `CompanyAudit`, `CompanyAuditTest`, `CompanyControlV2`, `CompanyFrameworkRequirement`, `CompanyTest`, `CompanyRisk`, `Evidence`, `PoamItem`, `CompanySspReportAssessmentObjective`, `CompanySspReportRequirement`, `Policy`, `VendorRiskDetail`, `VendorRiskReviewItem`, `VendorRiskDocument`, `VendorRiskReviewAnswer`
        - `commentable_id` — The ID of the commentable object
        - `company_id` — The ID of the company
        - `content` — The content of the comment
        - `id` — The ID of the comment
      summary: List Comments
      security:
      - header_authorization: &3 []
      x-controller: api/comments
      x-action: index
    post:
      tags:
      - Comment
      operationId: commentsCreate
      parameters:
      - name: commentable_id
        description: The ID of the commentable resource
        required: true
        in: query
        schema:
          type: string
          format: uuid
      - name: commentable_type
        description: The type of the commentable resource
        required: true
        in: query
        schema:
          type: string
          enum:
          - Company
          - CompanyAudit
          - CompanyAuditTest
          - CompanyControlV2
          - CompanyFrameworkRequirement
          - CompanyTest
          - CompanyRisk
          - Evidence
          - PoamItem
          - CompanySspReportAssessmentObjective
          - CompanySspReportRequirement
          - Policy
          - VendorRiskDetail
          - VendorRiskReviewItem
          - VendorRiskDocument
          - VendorRiskReviewAnswer
      - name: content
        description: The content of the comment
        required: true
        in: query
        schema:
          type: string
      - name: conversation_id
        description: Conversation ID to associate with the comment
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/Comment"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Creates a new Comment
      summary: Create a Comment
      security:
      - header_authorization: *3
      x-controller: api/comments
      x-action: create
  "/comments/{id}":
    get:
      tags:
      - Comment
      operationId: commentsShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - author
        explode: false
        style: form
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/Comment"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a single Comment by ID
      summary: Get a Comment
      security:
      - header_authorization: *3
      x-controller: api/comments
      x-action: show
    put:
      tags:
      - Comment
      operationId: commentsUpdate
      parameters:
      - name: content
        description: The updated content of the comment
        required: false
        in: query
        schema:
          type: string
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/Comment"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Updates a Comment by ID
      summary: Update a Comment
      security:
      - header_authorization: *3
      x-controller: api/comments
      x-action: update
    delete:
      tags:
      - Comment
      operationId: commentsDestroy
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Deletes a Comment by ID
      summary: Delete a Comment
      security:
      - header_authorization: *3
      x-controller: api/comments
      x-action: destroy
  "/controls":
    get:
      tags:
      - Control
      operationId: companyControlV2sIndex
      parameters:
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - author
            - owner
        explode: false
        style: form
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the Control data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      - name: sort
        description: 'Comma delimited string of fields to sort the results by, applied
          in the order given. Prefix a field with `-` to sort it in descending order,
          for example `?sort=-author_name,description`. Sortable fields: `author_name`,
          `description`, `key`, `name`, `frameworks`, `created_at`, `custom`, `enabled`,
          `first_failed_at`, `health_status`, `id`, `implementation_date`, `owner_assigned_at`,
          `owner_name`, `updated_at`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/Control"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of Controls.
        ### Search parameters

        - `author_name` — The author name of the Control
        - `description` — The description of the Control
        - `key` — The key of the Control
        - `name` — The name of the Control
        - `frameworks` — The framework keys for this Control
        - `created_at` — The date when this Control was created
        - `custom` — True if Control is custom, False if authored by Secureframe
          - Valid values: `true`, `false`
        - `enabled` — True if the Control is currently enabled
          - Valid values: `true`, `false`
        - `first_failed_at` — When the Control first failed
        - `health_status` — The overall health of the Control
          - Valid values: `at_risk`, `deleted`, `draft`, `healthy`, `not_applicable`, `not_tested`, `unhealthy`, `unmapped`
        - `id` — The ID of the Control
        - `implementation_date` — The implementation date of the Control
        - `owner_assigned_at` — When the owner was assigned to the Control
        - `owner_name` — The Control owner's name
        - `updated_at` — The date the Control was last updated
      summary: List Controls
      security:
      - header_authorization: &4 []
      x-controller: api/company_control_v2s
      x-action: index
  "/controls/{id}":
    get:
      tags:
      - Control
      operationId: companyControlV2sShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - author
            - owner
        explode: false
        style: form
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/Control"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a Control by ID
      summary: Get a Control
      security:
      - header_authorization: *4
      x-controller: api/company_control_v2s
      x-action: show
  "/framework_requirements":
    get:
      tags:
      - Framework Requirement
      operationId: companyFrameworkRequirementsIndex
      parameters:
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - framework
        explode: false
        style: form
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the Framework Requirement data using Lucene
          syntax.
        required: false
        in: query
        schema:
          type: string
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      - name: sort
        description: 'Comma delimited string of fields to sort the results by, applied
          in the order given. Prefix a field with `-` to sort it in descending order,
          for example `?sort=-enabled,health_status`. Sortable fields: `enabled`,
          `health_status`, `id`, `key`, `name`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/FrameworkRequirement"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of Framework Requirements.
        ### Search parameters

        - `enabled` — True if the Framework Requirement is currently enabled
          - Valid values: `true`, `false`
        - `health_status` — The overall health of the Framework Requirement
          - Valid values: `at_risk`, `deleted`, `draft`, `healthy`, `not_applicable`, `not_tested`, `unhealthy`
        - `id` — The ID of the Framework Requirement
        - `key` — The key of the Framework Requirement
        - `name` — The name of the Framework Requirement
      summary: List Framework Requirements
      security:
      - header_authorization: &5 []
      x-controller: api/company_framework_requirements
      x-action: index
  "/framework_requirements/{id}":
    get:
      tags:
      - Framework Requirement
      operationId: companyFrameworkRequirementsShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - framework
        explode: false
        style: form
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/FrameworkRequirement"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a Framework Requirement by ID
      summary: Get a Framework Requirement
      security:
      - header_authorization: *5
      x-controller: api/company_framework_requirements
      x-action: show
  "/frameworks":
    get:
      tags:
      - Framework
      operationId: companyFrameworksIndex
      parameters:
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the Framework data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: sort
        description: 'Comma delimited string of fields to sort the results by, applied
          in the order given. Prefix a field with `-` to sort it in descending order,
          for example `?sort=-created_at,id`. Sortable fields: `created_at`, `id`,
          `title`, `updated_at`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/Framework"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of Frameworks.
        ### Search parameters

        - `created_at` — The date when this Framework was created
        - `id` — The ID of the Framework
        - `title` — The title of the Framework
        - `updated_at` — The date the Framework was last updated
      summary: List Frameworks
      security:
      - header_authorization: &6 []
      x-controller: api/company_frameworks
      x-action: index
  "/frameworks/{id}":
    get:
      tags:
      - Framework
      operationId: companyFrameworksShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/Framework"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a Framework by ID
      summary: Get a Framework
      security:
      - header_authorization: *6
      x-controller: api/company_frameworks
      x-action: show
  "/risks":
    get:
      tags:
      - Risk
      operationId: companyRisksIndex
      parameters:
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - owner
        explode: false
        style: form
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the Risk data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      - name: sort
        description: 'Comma delimited string of fields to sort the results by, applied
          in the order given. Prefix a field with `-` to sort it in descending order,
          for example `?sort=-archived,id`. Sortable fields: `archived`, `id`, `custom_risk_id`,
          `owner_name`, `description`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/CompanyRisk"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of Risks.
        ### Search parameters

        - `archived` — Flag to indicate if this risk is archived
          - Valid values: `true`, `false`
        - `id` — The ID of the risk
        - `custom_risk_id` — The custom risk ID
        - `owner_name` — The name of the User that is the owner for this risk
        - `description` — The description of the risk
      summary: List Risks
      security:
      - header_authorization: &7 []
      x-controller: api/company_risks
      x-action: index
  "/risks/{id}":
    get:
      tags:
      - Risk
      operationId: companyRisksShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - owner
        explode: false
        style: form
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/CompanyRisk"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a Risk by ID
      summary: Get a Risk
      security:
      - header_authorization: *7
      x-controller: api/company_risks
      x-action: show
  "/ssp_duty_roles":
    get:
      tags:
      - SSP Duty Role
      operationId: companySspDutyAssignmentMatrixAssignmentsIndex
      parameters:
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the SSP Duty Role data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: sort
        description: 'Field to sort the results by. Prefix it with `-` to sort in
          descending order, for example `?sort=-created_at`. This endpoint sorts on
          one field only — supplying more than one comma delimited field returns a
          400. Sortable fields: `created_at`, `id`, `ssp_duty_id`, `ssp_report_id`,
          `ssp_role_id`, `updated_at`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/SspDutyRole"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of SSP Duty Roles
        ### Search parameters

        - `created_at` — The date the assignment was created
        - `id` — The ID of the assignment
        - `ssp_duty_id` — The ID of the duty
        - `ssp_report_id` — The ID of the associated SSP report
        - `ssp_role_id` — The ID of the role
        - `updated_at` — The date the assignment was last updated
      summary: List SSP Duty Roles
      security:
      - header_authorization: &8 []
      x-controller: api/company_ssp_duty_assignment_matrix_assignments
      x-action: index
    post:
      tags:
      - SSP Duty Role
      operationId: companySspDutyAssignmentMatrixAssignmentsCreate
      parameters:
      - name: ssp_duty_id
        description: The ID of the duty.
        required: true
        in: query
        schema:
          type: string
          format: uuid
      - name: ssp_report_id
        description: The ID of the SSP report.
        required: true
        in: query
        schema:
          type: string
          format: uuid
      - name: ssp_role_id
        description: The ID of the role.
        required: true
        in: query
        schema:
          type: string
          format: uuid
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspDutyRole"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Create a new SSP Duty Role
      summary: Create an SSP Duty Role
      security:
      - header_authorization: *8
      x-controller: api/company_ssp_duty_assignment_matrix_assignments
      x-action: create
  "/ssp_duty_roles/{id}":
    get:
      tags:
      - SSP Duty Role
      operationId: companySspDutyAssignmentMatrixAssignmentsShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspDutyRole"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a single SSP Duty Role by ID
      summary: Get an SSP Duty Role
      security:
      - header_authorization: *8
      x-controller: api/company_ssp_duty_assignment_matrix_assignments
      x-action: show
    delete:
      tags:
      - SSP Duty Role
      operationId: companySspDutyAssignmentMatrixAssignmentsDestroy
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        '200':
          description: OK
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Delete an SSP Duty Role by ID
      summary: Delete an SSP Duty Role
      security:
      - header_authorization: *8
      x-controller: api/company_ssp_duty_assignment_matrix_assignments
      x-action: destroy
  "/ssp_duties":
    get:
      tags:
      - SSP Duty
      operationId: companySspDutyAssignmentMatrixDutiesIndex
      parameters:
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the SSP Duty data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: sort
        description: 'Field to sort the results by. Prefix it with `-` to sort in
          descending order, for example `?sort=-id`. This endpoint sorts on one field
          only — supplying more than one comma delimited field returns a 400. Sortable
          fields: `id`, `created_at`, `description`, `duty`, `ssp_report_id`, `updated_at`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/SspDuty"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of SSP Duties
        ### Search parameters

        - `id` — The ID of the SSP Duty Assignment Matrix Duty
        - `created_at` — The date this duty was created
        - `description` — The description of the duty
        - `duty` — The duty name
        - `ssp_report_id` — The ID of the associated SSP Report
        - `updated_at` — The date this duty was last updated
      summary: List SSP Duties
      security:
      - header_authorization: &9 []
      x-controller: api/company_ssp_duty_assignment_matrix_duties
      x-action: index
    post:
      tags:
      - SSP Duty
      operationId: companySspDutyAssignmentMatrixDutiesCreate
      parameters:
      - name: description
        description: The description of the duty.
        required: false
        in: query
        schema:
          type: string
      - name: duty
        description: The duty name.
        required: true
        in: query
        schema:
          type: string
      - name: ssp_report_id
        description: The ID of the SSP Report.
        required: true
        in: query
        schema:
          type: string
          format: uuid
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspDuty"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Create a new SSP Duty
      summary: Create an SSP Duty
      security:
      - header_authorization: *9
      x-controller: api/company_ssp_duty_assignment_matrix_duties
      x-action: create
  "/ssp_duties/{id}":
    get:
      tags:
      - SSP Duty
      operationId: companySspDutyAssignmentMatrixDutiesShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspDuty"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a single SSP Duty by ID
      summary: Get an SSP Duty
      security:
      - header_authorization: *9
      x-controller: api/company_ssp_duty_assignment_matrix_duties
      x-action: show
    put:
      tags:
      - SSP Duty
      operationId: companySspDutyAssignmentMatrixDutiesUpdate
      parameters:
      - name: description
        description: The description of the duty.
        required: false
        in: query
        schema:
          type: string
      - name: duty
        description: The duty name.
        required: true
        in: query
        schema:
          type: string
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspDuty"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Update an SSP Duty by ID
      summary: Update an SSP Duty
      security:
      - header_authorization: *9
      x-controller: api/company_ssp_duty_assignment_matrix_duties
      x-action: update
    delete:
      tags:
      - SSP Duty
      operationId: companySspDutyAssignmentMatrixDutiesDestroy
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        '200':
          description: OK
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Delete an SSP Duty by ID
      summary: Delete an SSP Duty
      security:
      - header_authorization: *9
      x-controller: api/company_ssp_duty_assignment_matrix_duties
      x-action: destroy
  "/ssp_roles":
    get:
      tags:
      - SSP Role
      operationId: companySspDutyAssignmentMatrixRolesIndex
      parameters:
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the SSP Role data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: sort
        description: 'Field to sort the results by. Prefix it with `-` to sort in
          descending order, for example `?sort=-created_at`. This endpoint sorts on
          one field only — supplying more than one comma delimited field returns a
          400. Sortable fields: `created_at`, `description`, `id`, `role`, `ssp_report_id`,
          `updated_at`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/SspRole"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of SSP Roles.
        ### Search parameters

        - `created_at` — The date this role was created
        - `description` — The description of the role
        - `id` — The ID of the SSP Role
        - `role` — The role name
        - `ssp_report_id` — The ID of the associated SSP report
        - `updated_at` — The date this role was last updated
      summary: List SSP Roles
      security:
      - header_authorization: &10 []
      x-controller: api/company_ssp_duty_assignment_matrix_roles
      x-action: index
    post:
      tags:
      - SSP Role
      operationId: companySspDutyAssignmentMatrixRolesCreate
      parameters:
      - name: description
        description: The description of the role.
        required: false
        in: query
        schema:
          type: string
      - name: role
        description: The role name.
        required: true
        in: query
        schema:
          type: string
      - name: ssp_report_id
        description: The ID of the associated SSP Report.
        required: true
        in: query
        schema:
          type: string
          format: uuid
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspRole"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Create a new SSP Role
      summary: Create a SSP Role
      security:
      - header_authorization: *10
      x-controller: api/company_ssp_duty_assignment_matrix_roles
      x-action: create
  "/ssp_roles/{id}":
    get:
      tags:
      - SSP Role
      operationId: companySspDutyAssignmentMatrixRolesShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspRole"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a SSP Role by ID
      summary: Get a SSP Role
      security:
      - header_authorization: *10
      x-controller: api/company_ssp_duty_assignment_matrix_roles
      x-action: show
    put:
      tags:
      - SSP Role
      operationId: companySspDutyAssignmentMatrixRolesUpdate
      parameters:
      - name: description
        description: The description of the role.
        required: false
        in: query
        schema:
          type: string
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: role
        description: The role name.
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspRole"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Update a SSP Role by ID
      summary: Update a SSP Role
      security:
      - header_authorization: *10
      x-controller: api/company_ssp_duty_assignment_matrix_roles
      x-action: update
    delete:
      tags:
      - SSP Role
      operationId: companySspDutyAssignmentMatrixRolesDestroy
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        '200':
          description: OK
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Delete a SSP Role by ID
      summary: Delete a SSP Role
      security:
      - header_authorization: *10
      x-controller: api/company_ssp_duty_assignment_matrix_roles
      x-action: destroy
  "/ssp_policies":
    get:
      tags:
      - SSP Policy
      operationId: companySspPoliciesIndex
      parameters:
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the SSP Policy data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: sort
        description: 'Comma delimited string of fields to sort the results by, applied
          in the order given. Prefix a field with `-` to sort it in descending order,
          for example `?sort=-control_id,id`. Sortable fields: `control_id`, `id`,
          `name`, `owner`, `ssp_report_id`, `summary`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/SspPolicy"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of SSP Policies.
        ### Search parameters

        - `control_id` — The ID of the associated control
        - `id` — The ID of the SSP policy
        - `name` — The name of the SSP policy
        - `owner` — The owner of the SSP policy
        - `ssp_report_id` — The ID of the associated SSP report
        - `summary` — The summary of the SSP policy
      summary: List SSP Policies
      security:
      - header_authorization: &11 []
      x-controller: api/company_ssp_policies
      x-action: index
    post:
      tags:
      - SSP Policy
      operationId: companySspPoliciesCreate
      parameters:
      - name: control_id
        description: The ID of the associated control.
        required: false
        in: query
        schema:
          type: string
          format: uuid
      - name: name
        description: The name of the SSP policy.
        required: true
        in: query
        schema:
          type: string
      - name: owner
        description: The owner of the SSP policy.
        required: false
        in: query
        schema:
          type: string
      - name: ssp_report_id
        description: The ID of the associated SSP report.
        required: true
        in: query
        schema:
          type: string
          format: uuid
      - name: summary
        description: The summary of the SSP policy.
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspPolicy"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Creates a new SSP Policy
      summary: Create an SSP Policy
      security:
      - header_authorization: *11
      x-controller: api/company_ssp_policies
      x-action: create
  "/ssp_policies/{id}":
    get:
      tags:
      - SSP Policy
      operationId: companySspPoliciesShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspPolicy"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a single SSP Policy by ID
      summary: Get an SSP Policy
      security:
      - header_authorization: *11
      x-controller: api/company_ssp_policies
      x-action: show
    put:
      tags:
      - SSP Policy
      operationId: companySspPoliciesUpdate
      parameters:
      - name: control_id
        description: The ID of the associated control.
        required: false
        in: query
        schema:
          type: string
          format: uuid
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: name
        description: The name of the SSP policy.
        required: false
        in: query
        schema:
          type: string
      - name: owner
        description: The owner of the SSP policy.
        required: false
        in: query
        schema:
          type: string
      - name: summary
        description: The summary of the SSP policy.
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspPolicy"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Updates an SSP Policy by ID
      summary: Update an SSP Policy
      security:
      - header_authorization: *11
      x-controller: api/company_ssp_policies
      x-action: update
    delete:
      tags:
      - SSP Policy
      operationId: companySspPoliciesDestroy
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Deletes an SSP Policy by ID
      summary: Delete an SSP Policy
      security:
      - header_authorization: *11
      x-controller: api/company_ssp_policies
      x-action: destroy
  "/ssp_report_assessment_objectives":
    get:
      tags:
      - SSP Report Assessment Objective
      operationId: companySspReportAssessmentObjectivesIndex
      parameters:
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the SSP Report Assessment Objective data using
          Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: sort
        description: 'Comma delimited string of fields to sort the results by, applied
          in the order given. Prefix a field with `-` to sort it in descending order,
          for example `?sort=-created_at,framework_requirement_id`. Sortable fields:
          `created_at`, `framework_requirement_id`, `framework_requirement_name`,
          `id`, `implementation_statement`, `response`, `ssp_report_id`, `ssp_report_requirement_id`,
          `updated_at`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/SspReportAssessmentObjective"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of SSP Report Assessment Objectives.
        ### Search parameters

        - `created_at` — The date this Assessment Objective was created
        - `framework_requirement_id` — The ID of the Framework Requirement
        - `framework_requirement_name` — The name of the Framework Requirement
        - `id` — The ID of the SSP Report Assessment Objective
        - `implementation_statement` — The implementation statement
        - `response` — The response status of the Assessment Objective
          - Valid values: `implemented`, `not_applicable`, `no_response`, `partially_implemented`, `poam`
        - `ssp_report_id` — The ID of the associated SSP Report
        - `ssp_report_requirement_id` — The ID of the SSP Report Requirement
        - `updated_at` — The date this Assessment Objective was last updated
      summary: List SSP Report Assessment Objectives
      security:
      - header_authorization: &12 []
      x-controller: api/company_ssp_report_assessment_objectives
      x-action: index
  "/ssp_report_assessment_objectives/{id}":
    get:
      tags:
      - SSP Report Assessment Objective
      operationId: companySspReportAssessmentObjectivesShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspReportAssessmentObjective"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns an SSP Report Assessment Objective by ID
      summary: Get an SSP Report Assessment Objective
      security:
      - header_authorization: *12
      x-controller: api/company_ssp_report_assessment_objectives
      x-action: show
    put:
      tags:
      - SSP Report Assessment Objective
      operationId: companySspReportAssessmentObjectivesUpdate
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: implementation_statement
        description: The implementation statement for this Assessment Objective.
        required: false
        in: query
        schema:
          type: string
      - name: response
        description: The response status.
        required: false
        in: query
        schema:
          type: string
          enum:
          - implemented
          - not_applicable
          - no_response
          - partially_implemented
          - poam
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspReportAssessmentObjective"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Update an SSP Report Assessment Objective by ID
      summary: Update an SSP Report Assessment Objective
      security:
      - header_authorization: *12
      x-controller: api/company_ssp_report_assessment_objectives
      x-action: update
  "/ssp_report_section_blocks":
    get:
      tags:
      - SSP Report Section Block
      operationId: companySspReportSectionBlocksIndex
      parameters:
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the SSP Report Section Block data using Lucene
          syntax.
        required: false
        in: query
        schema:
          type: string
      - name: sort
        description: 'Field to sort the results by. Prefix it with `-` to sort in
          descending order, for example `?sort=-block_key`. This endpoint sorts on
          one field only — supplying more than one comma delimited field returns a
          400. Sortable fields: `block_key`, `block_type`, `created_at`, `id`, `ssp_report_id`,
          `ssp_report_section_id`, `updated_at`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/SspReportSectionBlock"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of SSP Report Section Blocks.
        ### Search parameters

        - `block_key` — The block key of the SSP Report Section Block
        - `block_type` — The block type of the SSP Report Section Block
        - `created_at` — The date when this SSP Report Section Block was created
        - `id` — The ID of the SSP Report Section Block
        - `ssp_report_id` — The ID of the associated SSP report
        - `ssp_report_section_id` — The ID of the associated SSP report section
        - `updated_at` — The date when this SSP Report Section Block was last updated
      summary: List SSP Report Section Blocks
      security:
      - header_authorization: &13 []
      x-controller: api/company_ssp_report_section_blocks
      x-action: index
  "/ssp_report_section_blocks/{id}":
    get:
      tags:
      - SSP Report Section Block
      operationId: companySspReportSectionBlocksShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspReportSectionBlock"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns an SSP Report Section Block by ID
      summary: Get an SSP Report Section Block
      security:
      - header_authorization: *13
      x-controller: api/company_ssp_report_section_blocks
      x-action: show
    put:
      tags:
      - SSP Report Section Block
      operationId: companySspReportSectionBlocksUpdate
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: value
        description: 'The value for this block. Shape depends on block_type: a scalar
          for input/textarea/select/checkbox/color_picker/website_extractor, an array
          for multiselect, or an array of contact objects for contacts.'
        required: false
        in: query
        schema:
          type: object
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspReportSectionBlock"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Update an SSP Report Section Block's value by ID
      summary: Update an SSP Report Section Block
      security:
      - header_authorization: *13
      x-controller: api/company_ssp_report_section_blocks
      x-action: update
  "/ssp_report_sections":
    get:
      tags:
      - SSP Report Section
      operationId: companySspReportSectionsIndex
      parameters:
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the SSP Report Section data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: sort
        description: 'Field to sort the results by. Prefix it with `-` to sort in
          descending order, for example `?sort=-created_at`. This endpoint sorts on
          one field only — supplying more than one comma delimited field returns a
          400. Sortable fields: `created_at`, `description`, `id`, `position`, `ssp_report_id`,
          `section_key`, `status`, `title`, `updated_at`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/SspReportSection"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of SSP Report Sections.
        ### Search parameters

        - `created_at` — The date when this SSP Report Section was created
        - `description` — The description of the SSP Report Section
        - `id` — The ID of the SSP Report Section
        - `position` — The position of the SSP Report Section
        - `ssp_report_id` — The ID of the associated SSP report
        - `section_key` — The section key of the SSP Report Section
        - `status` — The status of the SSP Report Section
          - Valid values: `not_started`, `in_progress`, `completed`
        - `title` — The title of the SSP Report Section
        - `updated_at` — The date when this SSP Report Section was last updated
      summary: List SSP Report Sections
      security:
      - header_authorization: &14 []
      x-controller: api/company_ssp_report_sections
      x-action: index
  "/ssp_report_sections/{id}":
    get:
      tags:
      - SSP Report Section
      operationId: companySspReportSectionsShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspReportSection"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns an SSP Report Section by ID
      summary: Get an SSP Report Section
      security:
      - header_authorization: *14
      x-controller: api/company_ssp_report_sections
      x-action: show
    put:
      tags:
      - SSP Report Section
      operationId: companySspReportSectionsUpdate
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: position
        description: The position of the SSP Report Section.
        required: false
        in: query
        schema:
          type: integer
      - name: status
        description: The status of the SSP Report Section (not_started, in_progress,
          completed).
        required: false
        in: query
        schema:
          type: string
          enum:
          - not_started
          - in_progress
          - completed
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspReportSection"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Update an SSP Report Section by ID
      summary: Update an SSP Report Section
      security:
      - header_authorization: *14
      x-controller: api/company_ssp_report_sections
      x-action: update
  "/ssp_reports":
    get:
      tags:
      - SSP Report
      operationId: companySspReportsIndex
      parameters:
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - framework
        explode: false
        style: form
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the SSP Report data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      - name: sort
        description: 'Field to sort the results by. Prefix it with `-` to sort in
          descending order, for example `?sort=-completion_progress_percentage`. This
          endpoint sorts on one field only — supplying more than one comma delimited
          field returns a 400. Sortable fields: `completion_progress_percentage`,
          `created_at`, `framework_id`, `id`, `name`, `sprs_score`, `updated_at`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/SspReport"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of SSP Reports.
        ### Search parameters

        - `completion_progress_percentage` — The completion progress percentage of the SSP Report
        - `created_at` — The date when this SSP Report was created
        - `framework_id` — The ID of the associated Framework
        - `id` — The ID of the SSP Report
        - `name` — The name of the SSP Report
        - `sprs_score` — The SPRS score of the SSP Report
        - `updated_at` — The date when this SSP Report was last updated
      summary: List SSP Reports
      security:
      - header_authorization: &15 []
      x-controller: api/company_ssp_reports
      x-action: index
    post:
      tags:
      - SSP Report
      operationId: companySspReportsCreate
      parameters:
      - name: framework_id
        description: The ID of the Framework to associate with the SSP Report.
        required: true
        in: query
        schema:
          type: string
          format: uuid
      - name: name
        description: The name of the SSP Report.
        required: true
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspReport"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Creates a new SSP Report
      summary: Create an SSP Report
      security:
      - header_authorization: *15
      x-controller: api/company_ssp_reports
      x-action: create
  "/ssp_reports/{id}":
    get:
      tags:
      - SSP Report
      operationId: companySspReportsShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - framework
        explode: false
        style: form
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspReport"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns an SSP Report by ID
      summary: Get an SSP Report
      security:
      - header_authorization: *15
      x-controller: api/company_ssp_reports
      x-action: show
  "/ssp_vendors":
    get:
      tags:
      - SSP Vendor
      operationId: companySspVendorsIndex
      parameters:
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the SSP Vendor data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: sort
        description: 'Comma delimited string of fields to sort the results by, applied
          in the order given. Prefix a field with `-` to sort it in descending order,
          for example `?sort=-categories,id`. Sortable fields: `categories`, `id`,
          `name`, `purpose`, `ssp_report_id`, `vendor_type`, `website`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/SspVendor"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of SSP Vendors.
        ### Search parameters

        - `categories` — The asset categories for this SSP Vendor
          - Valid values: `cui_asset`, `security_protection_asset`, `contractor_risk_management_asset`, `specialized_asset`, `out_of_scope_asset`
        - `id` — The ID of the SSP Vendor
        - `name` — The name of the SSP Vendor
        - `purpose` — The purpose of the SSP Vendor
        - `ssp_report_id` — The ID of the associated SSP Report
        - `vendor_type` — The type of the SSP Vendor
          - Valid values: `on_prem`, `csp`, `msp_mspp`, `other`
        - `website` — The website of the SSP Vendor
      summary: List SSP Vendors
      security:
      - header_authorization: &16 []
      x-controller: api/company_ssp_vendors
      x-action: index
    post:
      tags:
      - SSP Vendor
      operationId: companySspVendorsCreate
      parameters:
      - name: categories
        description: The asset categories for the SSP Vendor.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - cui_asset
            - security_protection_asset
            - contractor_risk_management_asset
            - specialized_asset
            - out_of_scope_asset
        explode: true
      - name: name
        description: The name of the SSP Vendor.
        required: true
        in: query
        schema:
          type: string
      - name: purpose
        description: The purpose of the SSP Vendor.
        required: false
        in: query
        schema:
          type: string
      - name: ssp_report_id
        description: The ID of the SSP Report to associate this Vendor with.
        required: true
        in: query
        schema:
          type: string
          format: uuid
      - name: vendor_type
        description: The vendor type for the SSP Vendor.
        required: false
        in: query
        schema:
          type: string
          enum:
          - on_prem
          - csp
          - msp_mspp
          - other
      - name: website
        description: The website of the SSP Vendor.
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspVendor"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Create a new SSP Vendor.
      summary: Create an SSP Vendor
      security:
      - header_authorization: *16
      x-controller: api/company_ssp_vendors
      x-action: create
  "/ssp_vendors/{id}":
    get:
      tags:
      - SSP Vendor
      operationId: companySspVendorsShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspVendor"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a single SSP Vendor by ID.
      summary: Get an SSP Vendor
      security:
      - header_authorization: *16
      x-controller: api/company_ssp_vendors
      x-action: show
    put:
      tags:
      - SSP Vendor
      operationId: companySspVendorsUpdate
      parameters:
      - name: categories
        description: The asset categories for the SSP Vendor.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - cui_asset
            - security_protection_asset
            - contractor_risk_management_asset
            - specialized_asset
            - out_of_scope_asset
        explode: true
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: name
        description: The name of the SSP Vendor.
        required: false
        in: query
        schema:
          type: string
      - name: purpose
        description: The purpose of the SSP Vendor.
        required: false
        in: query
        schema:
          type: string
      - name: vendor_type
        description: The vendor type for the SSP Vendor.
        required: false
        in: query
        schema:
          type: string
          enum:
          - on_prem
          - csp
          - msp_mspp
          - other
      - name: website
        description: The website of the SSP Vendor.
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SspVendor"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Update an SSP Vendor by ID.
      summary: Update an SSP Vendor
      security:
      - header_authorization: *16
      x-controller: api/company_ssp_vendors
      x-action: update
    delete:
      tags:
      - SSP Vendor
      operationId: companySspVendorsDestroy
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        '200':
          description: OK
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Delete an SSP Vendor by ID.
      summary: Delete an SSP Vendor
      security:
      - header_authorization: *16
      x-controller: api/company_ssp_vendors
      x-action: destroy
  "/tests/{test_id}/evidences":
    post:
      tags:
      - Test Evidence
      operationId: companyTestsEvidencesCreate
      parameters:
      - name: activity_completion
        description: The date the activity was completed, as `YYYY-MM-DD`.
        required: false
        in: query
        schema:
          type: string
          format: date
      - name: test_id
        description: The ID of the Test to attach the evidence
        required: true
        in: path
        schema:
          type: string
          format: uuid
      - name: upload_id
        description: The `id` returned by `POST /file_uploads` — the `create_file_upload`
          tool — whose bytes you have already PUT to storage. The way to attach a
          preloaded file. Required unless `file` is given.
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/Evidence"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |-
        Uploads evidence to a Test.

        Send the file one of two ways, and provide exactly one of them.

        `upload_id` attaches a file whose bytes you sent straight to storage, which is the right
        choice for anything large and the only workable one for a caller that cannot send
        multipart. Three steps:

        1. Call `POST /file_uploads` with the file's `filename`, `byte_size` and `checksum`. It
           returns a short-lived `url`, the `headers` to send with it, and an `id`.
        2. PUT the file's bytes to that `url`, with exactly the `headers` returned. The request
           body is the file's contents as they are on disk — raw bytes, not base64, not multipart,
           not wrapped in JSON — so there is nothing to encode or convert.
        3. Send the `id` here as `upload_id`.

        `file` is the alternative for a direct REST caller — the file's bytes as a multipart
        upload in this request, with no preloading step.
      summary: Create Test Evidence
      security:
      - header_authorization: []
      x-controller: api/company_tests/evidences
      x-action: create
      x-mcp-description: |-
        Attach an evidence file to a Test.

        The bytes are not sent here. Stage the file first with the `create_file_upload` tool,
        which hands back a `url` and an `id`; PUT the file's raw bytes to that `url`; then call
        this tool with that `id` as `upload_id`. The bytes must already be in storage by the
        time you call this — an `upload_id` whose PUT never happened is refused rather than
        attached empty. `create_file_upload` documents the size limit and the two expiry
        windows.

        Each `upload_id` is redeemable once. Attaching the same file to a second Test means
        staging it again.
      requestBody:
        required: false
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                file:
                  type: string
                  format: binary
                  description: The evidence file's bytes, as a multipart upload in
                    this request. The alternative to `upload_id`, for a direct REST
                    caller. Required unless `upload_id` is given.
                  example: Users/Downloads/some_file.png
  "/tests/{test_id}/exports":
    post:
      tags:
      - Test Export
      operationId: companyTestsTestExportsCreate
      parameters:
      - name: framework_id
        description: The ID of the Company's Framework for the export
        required: false
        in: query
        schema:
          type: string
          format: uuid
      - name: is_json
        description: 'If the export should be a JSON file or not (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      - name: test_id
        description: The ID of the test to attach the evidence
        required: true
        in: path
        schema:
          type: string
          format: uuid
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/TestExport"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Creates a new Test Export for a Test.
      summary: Create a Test Export
      security:
      - header_authorization: []
      x-controller: api/company_tests/test_exports
      x-action: create
  "/tests":
    get:
      tags:
      - Test
      operationId: companyTestsIndex
      parameters:
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - enabled_field_updated_by
            - owner
            - promoted_by
        explode: false
        style: form
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the Test data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      - name: sort
        description: 'Comma delimited string of fields to sort the results by, applied
          in the order given. Prefix a field with `-` to sort it in descending order,
          for example `?sort=-author_name,created_at`. Sortable fields: `author_name`,
          `created_at`, `custom`, `description`, `enabled`, `enabled_field_updated_by_user`,
          `frameworks`, `health_status`, `id`, `key`, `last_evaluated`, `next_due_date`,
          `owner_assigned_at`, `owner_name`, `pass`, `passed_with_upload`, `promote_at`,
          `recommended_action`, `required_implementation_date`, `resource_category`,
          `status`, `test_domain`, `test_function`, `test_interval_seconds`, `test_type`,
          `title`, `tolerance_window_seconds`, `updated_at`, `vendor_name`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/Test"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of Tests.
        ### Search parameters

        - `author_name` — The author name of the Test
        - `created_at` — The date when this Test was created
        - `custom` — True if the Test is custom (user generated), false if it's Secureframe-authored
          - Valid values: `true`, `false`
        - `description` — The description of the Test
        - `enabled` — True if the Test is currently enabled
          - Valid values: `true`, `false`
        - `enabled_field_updated_by_user` — True if the Test's enabled field was last changed by a user, false otherwise
          - Valid values: `true`, `false`
        - `frameworks` — The framework keys for this Test
        - `health_status` — The overall health of the Test
          - Valid values: `pass`, `at_risk`, `fail`, `disabled`
        - `id` — The ID of the Test
        - `key` — The user-friendly identifier used to reference this Test
        - `last_evaluated` — The date the Test was last evaluated at
        - `next_due_date` — The date new Test evidence is needed by if applicable
        - `owner_assigned_at` — The date the Test owner was assigned
        - `owner_name` — The Test owner's name
        - `pass` — True if the Test is passing, false otherwise. [DEPRECATED - Use health_status instead]
          - Valid values: `true`, `false`
        - `passed_with_upload` — True if the Test passed from the existence of an upload, false otherwise
          - Valid values: `true`, `false`
        - `promote_at` — The current date set for implementation of the Test
        - `recommended_action` — Actions for completing the Test
        - `required_implementation_date` — The pre-configured date the Test must be implemented by
        - `resource_category` — The category the Test resource belongs to
        - `status` — The status of the Test. [DEPRECATED - Use health_status instead]
          - Valid values: `pass`, `at_risk`, `fail`, `disabled`
        - `test_domain` — The domain the Test belongs to
        - `test_function` — The purpose of the Test
        - `test_interval_seconds` — The interval in which Test evidence should be collected if applicable
        - `test_type` — The type of Test
        - `title` — The title of the Test
        - `tolerance_window_seconds` — The time between the Test interval elapsing and evidence becoming stale and Test failing if applicable
        - `updated_at` — The date the Test was last updated
        - `vendor_name` — The vendor name associated with the Test if applicable
      summary: List Tests
      security:
      - header_authorization: &17 []
      x-controller: api/company_tests
      x-action: index
    post:
      tags:
      - Test
      operationId: companyTestsCreate
      parameters:
      - name: control_ids
        description: The IDs of the controls to map this test to.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            format: uuid
        explode: true
      - name: description
        description: The description for the test.
        required: false
        in: query
        schema:
          type: string
      - name: detailed_remediation_steps
        description: Guidance for remediating this test in the event it fails.
        required: false
        in: query
        schema:
          type: string
      - name: owner_id
        description: The UUID of a user.
        required: false
        in: query
        schema:
          type: string
          format: uuid
      - name: resource_category
        description: The category the test resource belongs to.
        required: false
        in: query
        schema:
          type: string
          enum:
          - Access Key
          - Access Point
          - Agent
          - Authentication Factor
          - Background Screening
          - Block Storage
          - Board of Directors
          - Cardholder Data
          - Certificate
          - Code
          - Code of Conduct
          - Confidentiality Agreement
          - Container
          - Content Delivery Network
          - Control
          - Customer
          - Data
          - Data Stream
          - Data Warehouse
          - Debug Service
          - Diagram
          - Domain Name System
          - Emergency Lighting
          - Encryption Key
          - Endpoint
          - Equipment
          - Facility
          - File Storage
          - File System
          - Fire Suppression
          - Firewall Rule
          - Hosting Service
          - IAM Resource
          - Identity and Management
          - Information Security Management System
          - Information Security Team
          - Infrastructure
          - Instance
          - Load Balancer
          - Log
          - Machine Learning
          - Maintenance
          - Message Service
          - Metric
          - Migration Service
          - Network
          - Non-Relational Database
          - Notification Service
          - Object Storage
          - Password
          - Password Vault
          - Patch
          - Performance Review
          - Personnel
          - Policy
          - Power
          - Procedure
          - Protected Health Information
          - Regulatory Obligation
          - Relational Database
          - Removable Media
          - Repository
          - Repository Branch
          - Risk
          - Search Service
          - Serverless Function
          - Service
          - Software
          - Special Interest Group
          - SSH Key
          - Storage
          - Temperature
          - Test Data
          - Ticket
          - Transfer Service
          - Vendor
          - Virtual Network
          - Vulnerability
          - Web Application
      - name: test_domain
        description: The domain the test belongs to.
        required: false
        in: query
        schema:
          type: string
          enum:
          - Asset Management
          - Availability
          - Change Management
          - Communications
          - Data Security
          - Governance
          - Identity and Access Management
          - Incident Response
          - Network Security
          - Physical Security
          - Privacy
          - Risk Management
          - Vendor Management
          - Vulnerability Management
      - name: test_function
        description: The purpose of the test.
        required: false
        in: query
        schema:
          type: string
          enum:
          - Access Control
          - Agreements
          - Approval
          - Architecture
          - Backup
          - Baseline Configuration
          - Business Continuity
          - Capacity Monitoring
          - Certificate Management
          - Charter
          - Commitments
          - Compliance Meetings
          - Data Handling
          - Data Loss Prevention
          - Data Retention
          - Dependency Testing
          - Encryption-at-Rest
          - Encryption-in-Transit
          - Endpoint Security
          - Equipment Management
          - Equipment Tracking
          - Gap Remediation
          - High Availability
          - Human Resources
          - Incident Management
          - Infrastructure Security
          - Integration Testing
          - Internal and External Channels
          - Internal Audit
          - Internal Controls
          - Inventory
          - Key Management
          - Lawful Basis
          - Least Functionality
          - Least Privilege
          - Logging
          - Media Handling
          - Multi-factor Authentication
          - Network Security
          - Objectives
          - Password Complexity
          - Password Management
          - Password Reset
          - Patching
          - Penetration Testing
          - Physical Security
          - Policy Acceptance
          - Policy Management
          - Procedure Management
          - Procedures Acceptance
          - Risk Assessment
          - Risk Tracking
          - Risk Treatment
          - SAST
          - Security Monitoring
          - Tracking
          - Training
          - Vendor Management
          - Vendor Review
          - Version Control
          - Vulnerability Scans
          - Vulnerability Tracking
      - name: test_interval_seconds
        description: How often new evidence should be collected for the test.
        required: false
        in: query
        schema:
          type: string
          enum:
          - one_day
          - one_week
          - two_weeks
          - one_month
          - three_months
          - six_months
          - one_year
          - none
      - name: title
        description: The test title.
        required: true
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/Test"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: 'Creates an upload Test: a Test that passes while current evidence
        is attached to it.'
      summary: Create a Test
      security:
      - header_authorization: *17
      x-controller: api/company_tests
      x-action: create
  "/tests/{id}":
    get:
      tags:
      - Test
      operationId: companyTestsShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - enabled_field_updated_by
            - owner
            - promoted_by
        explode: false
        style: form
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/Test"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a Test by ID
      summary: Get a Test
      security:
      - header_authorization: *17
      x-controller: api/company_tests
      x-action: show
    put:
      tags:
      - Test
      operationId: companyTestsUpdate
      parameters:
      - name: disabled_justification
        description: The justification reason for why this test is disabled.
        required: false
        in: query
        schema:
          type: string
      - name: enabled
        description: true or false for whether this test should be enabled or disabled.
        required: false
        in: query
        schema:
          type: boolean
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: next_due_date
        description: Date time in ISO8601 format.
        required: false
        in: query
        schema:
          type: string
          format: date-time
      - name: owner_id
        description: The UUID of a user.
        required: false
        in: query
        schema:
          type: string
          format: uuid
      - name: passed_with_upload_justification
        description: The justification reason for why this test is passed with upload.
        required: false
        in: query
        schema:
          type: string
      - name: promote_at
        description: Date time in ISO8601 format.
        required: false
        in: query
        schema:
          type: string
          format: date-time
      - name: test_interval_seconds
        description: How often the test should be run.
        required: false
        in: query
        schema:
          type: string
          enum:
          - one_day
          - one_week
          - two_weeks
          - one_month
          - three_months
          - six_months
          - one_year
          - none
      - name: tolerance_window_seconds
        description: The tolerance window representation for a test to be at risk.
        required: false
        in: query
        schema:
          type: string
          enum:
          - one_day
          - one_week
          - two_weeks
          - one_month
          - three_months
          - six_months
          - one_year
          - none
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/Test"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Update a Test by ID
      summary: Update a Test
      security:
      - header_authorization: *17
      x-controller: api/company_tests
      x-action: update
  "/user_accounts":
    get:
      tags:
      - User Account
      operationId: companyUserVendorsIndex
      parameters:
      - name: include
        description: 'Comma delimited string of relationships to include. Note: company_vendor_connection
          is deprecated, please use integration_connection instead.'
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - company_user
            - company_vendor_connection
            - integration_connection
        explode: false
        style: form
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the User Account data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      - name: sort
        description: 'Comma delimited string of fields to sort the results by, applied
          in the order given. Prefix a field with `-` to sort it in descending order,
          for example `?sort=-active,created_at`. Sortable fields: `active`, `created_at`,
          `email`, `first_name`, `has_user`, `id`, `last_name`, `third_party_id`,
          `updated_at`, `vendor_name`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/UserAccount"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of User Accounts.
        ### Search parameters

        - `active` — Flag to indicate if this is an active User Account on the vendor side. Defaults to true if the vendor does not support or provide this value.
          - Valid values: `true`, `false`
        - `created_at` — The date this User Account was created
        - `email` — The email received from the connection
        - `first_name` — The first name of the user received from the connection
        - `has_user` — Flag to indicate if this User Account has a User. False indicates that it's an unlinked account
          - Valid values: `true`, `false`
        - `id` — The ID of the User Account
        - `last_name` — The last name of the user received from the connection
        - `third_party_id` — The identifier for this User Account on the vendor side
        - `updated_at` — The date this User Account was last updated
        - `vendor_name` — The name of the vendor that this User Account is from
      summary: List User Accounts
      security:
      - header_authorization: &18 []
      x-controller: api/company_user_vendors
      x-action: index
  "/user_accounts/{id}":
    get:
      tags:
      - User Account
      operationId: companyUserVendorsShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: include
        description: 'Comma delimited string of relationships to include. Note: company_vendor_connection
          is deprecated, please use integration_connection instead.'
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - company_user
            - company_vendor_connection
            - integration_connection
        explode: false
        style: form
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/UserAccount"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a single User Account by ID
      summary: Get a User Account
      security:
      - header_authorization: *18
      x-controller: api/company_user_vendors
      x-action: show
  "/user_accounts/{id}/link":
    put:
      tags:
      - User Account
      operationId: companyUserVendorsLink
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: user_id
        description: The ID of the user to link to the User Account. If user_id is
          not provided or is an empty string, the User Account will be unlinked.
        required: false
        in: query
        schema:
          type: string
          format: uuid
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/UserAccount"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Links a User to a User Account.
      summary: Link a User Account
      security:
      - header_authorization: *18
      x-controller: api/company_user_vendors
      x-action: link
  "/users/{user_id}/evidences":
    post:
      tags:
      - User Evidence
      operationId: companyUsersEvidencesCreate
      parameters:
      - name: activity_completion
        description: The date the activity was completed, as `YYYY-MM-DD`.
        required: false
        in: query
        schema:
          type: string
          format: date
      - name: document_type
        description: The type of evidence being uploaded for this user
        required: true
        in: query
        schema:
          type: string
          enum:
          - background_check_report
          - ccpa_training_screenshot
          - gdpr_training_screenshot
          - handling_cui_training_screenshot
          - hipaa_training_screenshot
          - password_manager_screenshot
          - password_policy_screenshot
          - pci_secure_code_training_screenshot
          - pci_training_screenshot
          - security_training_screenshot
          - security_training_new_hire_screenshot
      - name: upload_id
        description: The `id` returned by `POST /file_uploads` — the `create_file_upload`
          tool — whose bytes you have already PUT to storage. The way to attach a
          preloaded file. Required unless `file` is given.
        required: false
        in: query
        schema:
          type: string
      - name: user_id
        description: The id of the user to attach the evidence
        required: true
        in: path
        schema:
          type: string
          format: uuid
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/Evidence"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |-
        Uploads evidence for a User.

        Send the file one of two ways, and provide exactly one of them.

        `upload_id` attaches a file whose bytes you sent straight to storage, which is the right
        choice for anything large and the only workable one for a caller that cannot send
        multipart. Three steps:

        1. Call `POST /file_uploads` with the file's `filename`, `byte_size` and `checksum`. It
           returns a short-lived `url`, the `headers` to send with it, and an `id`.
        2. PUT the file's bytes to that `url`, with exactly the `headers` returned. The request
           body is the file's contents as they are on disk — raw bytes, not base64, not multipart,
           not wrapped in JSON — so there is nothing to encode or convert.
        3. Send the `id` here as `upload_id`.

        `file` is the alternative for a direct REST caller — the file's bytes as a multipart
        upload in this request, with no preloading step.
      summary: Create User Evidence
      security:
      - header_authorization: []
      x-controller: api/company_users/evidences
      x-action: create
      x-mcp-description: |-
        Attach an evidence file to a User.

        The bytes are not sent here. Stage the file first with the `create_file_upload` tool,
        which hands back a `url` and an `id`; PUT the file's raw bytes to that `url`; then call
        this tool with that `id` as `upload_id`. The bytes must already be in storage by the
        time you call this — an `upload_id` whose PUT never happened is refused rather than
        attached empty. `create_file_upload` documents the size limit and the two expiry
        windows.

        Each `upload_id` is redeemable once. Attaching the same file to a second User means
        staging it again.
      requestBody:
        required: false
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                file:
                  type: string
                  format: binary
                  description: The evidence file's bytes, as a multipart upload in
                    this request. The alternative to `upload_id`, for a direct REST
                    caller. Required unless `upload_id` is given.
                  example: Users/Downloads/some_file.png
  "/users":
    get:
      tags:
      - User
      operationId: companyUsersIndex
      parameters:
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - manager
        explode: false
        style: form
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the User data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      - name: sort
        description: 'Comma delimited string of fields to sort the results by, applied
          in the order given. Prefix a field with `-` to sort it in descending order,
          for example `?sort=-active,department_id`. Sortable fields: `active`, `department_id`,
          `email`, `employee_type`, `end_date`, `first_name`, `id`, `in_audit_scope`,
          `invited`, `invited_at`, `last_name`, `name`, `onboarding_status`, `personnel_status`,
          `preferred_first_name`, `secureframe_agent_acknowledged_at`, `start_date`,
          `title`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/User"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of Users.
        ### Search parameters

        - `active` — Flag to indicate if this User is active
          - Valid values: `true`, `false`
        - `department_id` — The department_id of the User
        - `email` — The email of the User
        - `employee_type` — The employee_type of the User
          - Valid values: `contractor`, `employee`, `non_employee`, `auditor`, `external`, `workspace`
        - `end_date` — The end date for the User
        - `first_name` — The first name of the User
        - `id` — The ID of the User
        - `in_audit_scope` — Flag to indicate if the User is in audit scope
          - Valid values: `true`, `false`
        - `invited` — Flag to indicate if this User has been invited
          - Valid values: `true`, `false`
        - `invited_at` — The date the User was invited
        - `last_name` — The last name of the User
        - `name` — The name of the User
        - `onboarding_status` — The onboarding status of the User
          - Valid values: `not_started`, `security_training`, `security_training_questionnaire`, `hipaa_training`, `pci_training`, `pci_secure_code_training`, `ccpa_training`, `gdpr_training`, `handling_cui_training`, `accept_policies`, `background_check`, `secureframe_agent`, `secureframe_federal_mdm`, `completed`
        - `personnel_status` — The personnel status of the User
          - Valid values: `uncategorized`, `not_invited`, `overdue_tasks`, `incomplete_tasks`, `all_tasks_completed`, `offboarded`, `active_accounts`, `inactive`
        - `preferred_first_name` — The preferred first name of the User
        - `secureframe_agent_acknowledged_at` — The date that the User acknowledged secureframe agent
        - `start_date` — The start date of the User
        - `title` — The title of the User
      summary: List Users
      security:
      - header_authorization: &19 []
      x-controller: api/company_users
      x-action: index
  "/users/{id}":
    get:
      tags:
      - User
      operationId: companyUsersShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - manager
        explode: false
        style: form
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/User"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a User by ID
      summary: Get a User
      security:
      - header_authorization: *19
      x-controller: api/company_users
      x-action: show
    put:
      tags:
      - User
      operationId: companyUsersUpdate
      parameters:
      - name: active
        description: True if the user account is active, false if it has been disabled.
        required: false
        in: query
        schema:
          type: boolean
      - name: employee_type
        description: The type of employee.
        required: false
        in: query
        schema:
          type: string
          enum:
          - contractor
          - employee
          - non_employee
          - auditor
          - external
          - workspace
      - name: end_date
        description: Date when the user's employement ended in ISO 8601 format.
        required: false
        in: query
        schema:
          type: string
          format: date-time
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: in_audit_scope
        description: True if the user should be audited, false otherwise - only updateable
          in certain cases.
        required: false
        in: query
        schema:
          type: boolean
      - name: start_date
        description: Date when the user's employement started in ISO 8601 format.
        required: false
        in: query
        schema:
          type: string
          format: date-time
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/User"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Update a User by ID
      summary: Update a User
      security:
      - header_authorization: *19
      x-controller: api/company_users
      x-action: update
  "/integration_connections":
    get:
      tags:
      - Integration Connection
      operationId: companyVendorConnectionsIndex
      parameters:
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - company_vendor
        explode: false
        style: form
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the Integration Connection data using Lucene
          syntax.
        required: false
        in: query
        schema:
          type: string
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      - name: sort
        description: 'Comma delimited string of fields to sort the results by, applied
          in the order given. Prefix a field with `-` to sort it in descending order,
          for example `?sort=-id,name`. Sortable fields: `id`, `name`, `status`, `updated_at`,
          `vendor_name`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/IntegrationConnection"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of Integration Connections.
        ### Search parameters

        - `id` — The ID of the Integration Connection
        - `name` — The name of the Integration Connection if applicable
        - `status` — The status of the Integration Connection
          - Valid values: `connected`, `disabled`, `not_connected`, `pending`
        - `updated_at` — The date this Integration Connection was last updated
        - `vendor_name` — The name of the vendor for this Integration Connection
      summary: List Integration Connections
      security:
      - header_authorization: &20 []
      x-controller: api/company_vendor_connections
      x-action: index
  "/integration_connections/{id}":
    get:
      tags:
      - Integration Connection
      operationId: companyVendorConnectionsShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - company_vendor
        explode: false
        style: form
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/IntegrationConnection"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns an Integration Connection by ID
      summary: Get an Integration Connection
      security:
      - header_authorization: *20
      x-controller: api/company_vendor_connections
      x-action: show
  "/integration_connections/{id}/archive":
    put:
      tags:
      - Integration Connection
      operationId: companyVendorConnectionsArchive
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/IntegrationConnection"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Archives an Integration Connection by ID.
      summary: Archive an Integration Connection
      security:
      - header_authorization: *20
      x-controller: api/company_vendor_connections
      x-action: archive
  "/vendors":
    get:
      tags:
      - Vendor
      operationId: companyVendorsIndex
      parameters:
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the Vendor data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: sort
        description: 'Comma delimited string of fields to sort the results by, applied
          in the order given. Prefix a field with `-` to sort it in descending order,
          for example `?sort=-archived,id`. Sortable fields: `archived`, `id`, `name`,
          `owner_name`, `risk_level`, `updated_at`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/Vendor"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of Vendors.
        [DEPRECATED - Use the Third Party Risk Management Vendor [endpoint](/tag/Third-Party-Risk-Management-Vendor#operation/tprmVendorRiskDetailsIndex)].If you have not done so already, please also migrate your Vendors frontend experience by going to [the vendors page](https://app.secureframe.com/vendors/) and clicking “Take me to new TPRM.”
        ### Search parameters

        - `archived` — Flag to indicate if this Vendor is archived
          - Valid values: `true`, `false`
        - `id` — The ID of the Vendor
        - `name` — The name of the Vendor
        - `owner_name` — The name of the User that is the owner for this Vendor
        - `risk_level` — The risk level for this Vendor
          - Valid values: `high`, `medium`, `low`
        - `updated_at` — The date this Vendor was last updated
      summary: List Vendors
      security:
      - header_authorization: &21 []
      x-controller: api/company_vendors
      x-action: index
  "/vendors/{id}":
    get:
      tags:
      - Vendor
      operationId: companyVendorsShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/Vendor"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |-
        Returns a single Vendor by ID
        [DEPRECATED - Use the Third Party Risk Management Vendor [endpoint](/tag/Third-Party-Risk-Management-Vendor#operation/tprmVendorRiskDetailsIndex)].If you have not done so already, please also migrate your Vendors frontend experience by going to [the vendors page](https://app.secureframe.com/vendors/) and clicking “Take me to new TPRM.”
      summary: Get a Vendor
      security:
      - header_authorization: *21
      x-controller: api/company_vendors
      x-action: show
  "/vendors/{id}/archive":
    put:
      tags:
      - Vendor
      operationId: companyVendorsArchive
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: terminated_at
        description: The date this vendor was terminated.
        required: false
        in: query
        schema:
          type: string
          format: date-time
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/Vendor"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |-
        Archives a Vendor by ID.
        [DEPRECATED - Use the Third Party Risk Management Vendor [endpoint](/tag/Third-Party-Risk-Management-Vendor#operation/tprmVendorRiskDetailsIndex)].If you have not done so already, please also migrate your Vendors frontend experience by going to [the vendors page](https://app.secureframe.com/vendors/) and clicking “Take me to new TPRM.”
      summary: Archive a Vendor
      security:
      - header_authorization: *21
      x-controller: api/company_vendors
      x-action: archive
  "/custom_connections/{id}/data":
    post:
      tags:
      - Custom Integration
      operationId: customConnectionsResourceDataCreate
      parameters:
      - name: id
        description: The ID of the custom connection.
        required: true
        in: path
        schema:
          type: string
          format: uuid
      responses:
        '202':
          description: Accepted      The data is enqueued for processing.
        '400':
          description: Bad Request   The request body was not in the correct format.
        '401':
          description: Unauthorized  The Authorization header was invalid.
        '403':
          description: Forbidden     The API key provided was not authorized to push
            data for this custom connection.
        '404':
          description: Not Found     A custom connection could not be found for the
            provided ID.
      description: |-
        Publish resource data to a custom integration.

        This endpoint accepts a list of resource data objects, each containing the current state of a resource to be
        processed. This data will be processed and if successful, the results will be available in the Custom Automated
        Tests feature, as well as the Asset Inventory and/or other Secureframe features.

        **Early access:** This endpoint is currently only available to customers in our Early Access program. Please contact
        Secureframe to request access. All details are subject to change.

        ### New schemas
        If a schema does not already exist for the provided slug, one will be created automatically based on the structure
        of the first resource data object in the request.

        After a schema is created, it must be defined using the "Define Schema" workflow in the Secureframe application
        interface in order for the data to be processed.

        ### Resource data format
        You can provide us data in any JSON structure you like, as long as all resources in a schema follow the same
        format. We recommend you provide the data to us with as few changes as possible from the original format in your
        system or as provided by the vendor.

        At least one field must uniquely identify the resource within the schema, and be set as its "primary ID" when
        defining the schema. The primary ID cannot be changed after the schema is created.

        The data may be nested (e.g. `{ "name": { "first": "Alan", "last": "Turing" } }`). However, arrays are not currently
        supported and will be ignored.

        ### Supported model mappings
        When you send resource data to Secureframe using schemas that have a model mapping set up, the data will be mapped to corresponding models in the Secureframe application. \
        \
        You can structure your data in any way that makes sense for your systems, as long as all required fields are present for the chosen category. \
        The field names in your data don't need to match our internal field names - the mapping is handled automatically based on the schema definition. \
        We recommend providing data in a format as close as possible to the examples below. This approach simplifies integration and makes it easier to properly map your data to our system. \
        After processing, your data will appear in the appropriate sections of the Secureframe application, such as Asset Inventory, Personnel, or Training Records, depending on the schema's category.

        **Cloud resources** \
        \
        Cloud resources are the resources used for creating and updating any cloud-based or on-premise servers, virtual machines, VPNs, databases, etc.
        These should be used any time you want to import data about hardware or cloud-based infrastructure components that are in scope for your compliance plan. \
        \
        Example resource data for a cloud resource:
        ```json
        {
          "id": "123", // required, type: string
          "cloud_resource_type": "ec2_instance", // required, type: string, supported values listed below
          "description": "My Cloud Resource", // optional, type: string
          "account": "my-account", // optional, type: string
          "region": "us-west-2" // optional, type: string, shown as Location in Asset Inventory
        }
        ```
        <details>
        <summary>Supported values for `cloud_resource_type`</summary>

        - account
        - acm_certificate
        - alert
        - analytics
        - api_management_service
        - app_gateway
        - app_workflow
        - athena_workgroup
        - audit_config_all_services
        - authentication_policy
        - authorization_role_assignment
        - autoscaling_group
        - batch_account
        - cdn
        - certificate
        - check_point_quantum_access_layer
        - check_point_quantum_access_role
        - check_point_quantum_access_rulebase
        - check_point_quantum_access_rule
        - check_point_quantum_host
        - check_point_quantum_https_layer
        - check_point_quantum_https_rulebase
        - check_point_quantum_ips_status
        - check_point_quantum_nat_rulebase
        - check_point_quantum_network
        - check_point_quantum_tcp_service
        - check_point_quantum_threat_indicator
        - check_point_quantum_udp_service
        - cloudfront_distribution
        - cloudtrail
        - cloudwatchlogs_log_group
        - cluster
        - cluster_node_pool
        - compute_backend_service
        - compute_disk
        - compute_instance
        - compute_network
        - compute_subnetwork
        - compute_target_http_proxy_list
        - compute_url_map
        - configservice_recorder
        - container_cluster
        - container_registry
        - crypto_key
        - data_collection_rule
        - data_collection_rule_association
        - database
        - database_backup
        - database_firewall_rule
        - database_replica
        - datadog_dashboard
        - datadog_monitor
        - datalake_analytics
        - datalake_storage
        - desktop_virtualization_application_group
        - desktop_virtualization_host_pool
        - desktop_virtualization_workspace
        - dms_instance
        - diagnostic_setting
        - dns_managed_zone
        - docker_image
        - domain
        - domain_record
        - droplet
        - droplet_neighbor
        - dynamodb_table
        - ec2_image
        - ec2_instance
        - ec2_security_group
        - ec2_snapshot
        - ec2_subnet
        - ec2_volume
        - ec2_vpc
        - ec2_vpc_peering_connections
        - ecr_repository
        - efs_filesystem
        - eks_cluster
        - elasticloadbalancing
        - elb
        - elbv2
        - elbv2_listener
        - es_domain
        - event_hub
        - firehose_stream
        - firewall
        - floating_ip
        - fsx_file_system
        - glacier_vault
        - guardduty_detector
        - heroku_addon
        - heroku_app
        - iam_certificate
        - iam_group
        - iam_mfa_device
        - iam_password_policy
        - iam_role
        - iam_user
        - iam_account
        - iam_credential_report
        - image
        - iot
        - key
        - key_vault
        - keyring
        - kinesis_stream
        - kms_key
        - lambda_function
        - load_balancer
        - log_alert
        - log_profile
        - metric
        - microsoft_compute_virtualmachines
        - microsoft_compute_virtualmachines_scaleset
        - microsoft_container_images
        - microsoft_dbformysql_servers
        - microsoft_dbforpostgresql_servers
        - microsoft_sentinel_alert_rule
        - microsoft_sentinel_content_package
        - microsoft_sentinel_data_connector
        - microsoft_sentinel_incident
        - microsoft_sentinel_threat_indicator
        - microsoft_sql_servers
        - microsoft_sql_servers_blob_auditing_policy
        - microsoft_sql_servers_databases
        - microsoft_storage_storageaccounts
        - monitor_action_group
        - monitoring_alert_policy
        - monitor_scheduled_query_rule
        - nat_gateway
        - network_interface
        - network_load_balancer
        - network_policy
        - network_watcher
        - operational_insights_workspace
        - organizations_account
        - password_policy
        - policy_assignment
        - project
        - project_resource
        - public_ip_address
        - rds_cluster
        - rds_instance
        - rds_snapshot
        - redis_service
        - resourcemanager_project
        - redshift
        - region
        - registry
        - registry_repository
        - route53domain
        - route_table
        - s3_bucket
        - sagemaker_notebook
        - search_service
        - security_auto_provisioning_setting
        - security_contact
        - security_pricing
        - security_group
        - servicebus
        - service_account
        - ses_dkim
        - ses_ruleset
        - snapshot
        - sns_topic
        - space
        - space_cor
        - sql_instance
        - sqs_queue
        - ssl_proxy
        - ssm_instance
        - ssm_parameter
        - storage_bucket
        - storage_container
        - storage_volume
        - subscription
        - transfer_server
        - virtual_machine_extension
        - virtual_network
        - vpc
        - vpc_member
        - web_app_service
        - xray_encryption_config

        </details>

        **Training records** \
        \
        Training records specify that a certain person has completed a training course. These should be used when you have data from an external training system and you want to bring that data into Secureframe. \
        The `completed_at` attribute should be set if training was completed.
        \
        Example resource data for a training record:
        ```json
        {
          "id": "123", // required, type: string
          "completed_at": "2024-01-01T00:00:00Z", // type: datetime, format: ISO 8601
          "user_email": "john.doe@example.com", // required, type: string
          "training_slug": "security_awareness_training" // required, type: string, supported values listed below
        }
        ```
        <details>
        <summary>Supported values for `training_slug`</summary>

        - ccpa_training
        - gdpr_training
        - hipaa_training
        - pci_secure_code_training
        - pci_training
        - security_awareness_training

        </details>

        **Personnel accounts** \
        \
        Personnel accounts are records that a person has an account granting them access to a certain system. \
        You can use this to import information about these accounts into the Secureframe application's Personnel section. \
        \
        Example resource data for a personnel account:
        ```json
        {
          "id": "123", // required, type: string
          "email": "john.doe@example.com", // required, type: string
          "secondary_email": "john.doe2@example.com", // optional, type: string
          "username": "john.doe", // optional, type: string
          "first_name": "John", // optional, type: string
          "preferred_first_name": "John", // optional, type: string
          "last_name": "Doe", // optional, type: string
          "admin": false, // optional, type: boolean
          "active": true, // optional, type: boolean
          "roles": "Admin, Auditor", // optional, type: string, comma-separate to assign multiple roles
          "two_factor_enabled": true // optional, type: boolean
        }
        ```

        **Devices** \
        \
        Devices are records that a person has a device that is managed by your organization. \
        You can use this to import information about these devices into the Computers tab of the Secureframe application's Asset inventory section. \
        \
        Example resource data for a device:
        ```json
        {
          "device_name": "John's MacBook Pro", // optional, type: string
          "email": "john.doe@example.com", // optional, type: string
          "model": "MacBook Pro 16-inch", // optional, type: string
          "make": "Apple", // optional, type: string
          "serial_number": "F2NK4NGXQW2", // optional, type: string
          "enroll_date": "2024-03-01T12:00:00Z", // optional, type: datetime, format: ISO 8601
          "device_uuid": "12345678-1234-1234-1234-123456789012", // optional, type: string
          "last_checkin_at": "2025-03-17T10:30:00Z", // optional, type: datetime, format: ISO 8601
          "os": "macOS 14.3", // optional, type: string
          "cpu": "Apple M2 Max", // optional, type: string
          "memory": "32GB", // optional, type: string
          "mac_address": "00:1A:2B:3C:4D:5E", // optional, type: string
          "remote_ip": "127.0.0.1", // optional, type: string
          "hard_drive_encrypted": true, // optional, type: boolean
          "active": true, // optional, type: boolean
          "native_anti_virus_enabled": true, // optional, type: boolean
          "password_enforcement_enabled": true, // optional, type: boolean
          "local_firewall_enabled": true, // optional, type: boolean
          "session_timeout_enabled": true, // optional, type: boolean
          "anti_virus_software": "XProtect", // optional, type: string
          "macos_filevault_enabled": true // optional, type: boolean
        }
        ```

        ### Processing
        This data will be processed asynchronously, and a `202 Accepted` response indicates the data is enqueued for
        processing. There may be a delay before the data is available in the Secureframe application, especially if a large
        amount of data is being processed.

        Data for a given connection will be processed in the order it is enqueued, even if provided in separate requests
        or for separate schemas.

        #### Partial updates
        By default, the data in a request will replace the existing data for the resource and is expected to be the complete
        state of a resource. To perform a partial update, you can set the `partial` parameter to `true`. When processing a partial
        update, only the fields specified in the request will be updated. Any fields not specified in the request will be
        left unchanged. If you want to delete a field, you can set its value to `null`.
      summary: Publish data
      security:
      - header_authorization: []
      x-controller: api/custom_connections/resource_data
      x-action: create
      requestBody:
        description: request
        content:
          application/json:
            schema:
              "$ref": "#/components/schemas/Models_CustomConnections_CreateResourceDataRequest"
  "/devices/{device_id}/framework_asset_scopes":
    get:
      tags:
      - Device Framework Asset Scope
      operationId: devicesCompanyFrameworkAssetScopesIndex
      parameters:
      - name: device_id
        description: Scope response to device_id
        required: true
        in: path
        schema:
          type: string
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - manually_scoped_by
        explode: false
        style: form
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/FrameworkAssetScope"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |-
        Returns a list of Framework Asset Scopes for the Device by ID

        The absence of a Framework Asset Scope indicates the asset is not in scope for the Framework.
      summary: List Framework Asset Scopes
      security:
      - header_authorization: &22 []
      x-controller: api/devices/company_framework_asset_scopes
      x-action: index
    post:
      tags:
      - Device Framework Asset Scope
      operationId: devicesCompanyFrameworkAssetScopesCreate
      parameters:
      - name: active
        description: Flag to indicate if this Framework Asset Scope is active.
        required: false
        in: query
        schema:
          type: boolean
      - name: device_id
        description: Scope response to device_id
        required: true
        in: path
        schema:
          type: string
      - name: framework_id
        description: The ID of the Framework assigned to this Framework Asset Scope.
        required: false
        in: query
        schema:
          type: string
          format: uuid
      - name: manually_scoped_reason
        description: Reason if this Framework Asset Scope is manually scoped.
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/FrameworkAssetScope"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Create a Framework Asset Scope for the Device by ID
      summary: Create Framework Asset Scope
      security:
      - header_authorization: *22
      x-controller: api/devices/company_framework_asset_scopes
      x-action: create
  "/devices":
    get:
      tags:
      - Device
      operationId: devicesIndex
      parameters:
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - device_user
            - owner
        explode: false
        style: form
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the Device data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      - name: sort
        description: 'Comma delimited string of fields to sort the results by, applied
          in the order given. Prefix a field with `-` to sort it in descending order,
          for example `?sort=-cpu,created_at`. Sortable fields: `cpu`, `created_at`,
          `device_name`, `device_user_name`, `hard_drive_encrypted`, `id`, `in_audit_scope`,
          `last_checkin_at`, `local_firewall_enabled`, `mac_address`, `make`, `memory`,
          `model`, `native_anti_virus_enabled`, `os`, `out_of_audit_scope_reason`,
          `owner_name`, `password_enforcement_enabled`, `remote_ip`, `serial_number`,
          `session_timeout_enabled`, `updated_at`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/Device"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of Devices.
        ### Search parameters

        - `cpu` — The cpu info available for this Device
        - `created_at` — The date this Device object was created
        - `device_name` — The name of the Device
        - `device_user_name` — The Device user's name
        - `hard_drive_encrypted` — Flag to indicate if the hard drive is encrypted
          - Valid values: `true`, `false`
        - `id` — The ID of the Device
        - `in_audit_scope` — Flag to indicate if this Device is in scope. [DEPRECATED - Use the Device Framework Asset Scope [endpoint](/tag/Device-Framework-Asset-Scope#operation/devicesCompanyFrameworkAssetScopesIndex)]
          - Valid values: `true`, `false`
        - `last_checkin_at` — The date this Device last checked in
        - `local_firewall_enabled` — Flag to indicate if the local firewall is enabled
          - Valid values: `true`, `false`
        - `mac_address` — The MAC address of the Device
        - `make` — The make of the Device
        - `memory` — The memory of the Device
        - `model` — The model of the Device
        - `native_anti_virus_enabled` — Flag to indicate if native antivirus is enabled
          - Valid values: `true`, `false`
        - `os` — The operating system of the Device
        - `out_of_audit_scope_reason` — Out of scope reason if the Device is not in scope
          - Valid values: `development_asset`, `staging_asset`, `out_of_scope_production_asset`
        - `owner_name` — The Device owner's name
        - `password_enforcement_enabled` — Flag to indicate if password enforcement is enabled
          - Valid values: `true`, `false`
        - `remote_ip` — The remote IP of the Device
        - `serial_number` — The serial number of the Device
        - `session_timeout_enabled` — Flag to indicate if session timeout is enabled
          - Valid values: `true`, `false`
        - `updated_at` — The date this Device was last updated
      summary: List Devices
      security:
      - header_authorization: &23 []
      x-controller: api/devices
      x-action: index
  "/devices/{id}":
    get:
      tags:
      - Device
      operationId: devicesShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - device_user
            - owner
        explode: false
        style: form
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/Device"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a single Device by ID
      summary: Get a Device
      security:
      - header_authorization: *23
      x-controller: api/devices
      x-action: show
  "/evidences":
    get:
      tags:
      - Evidence
      operationId: evidencesIndex
      parameters:
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the Evidence data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: sort
        description: 'Field to sort the results by. Prefix it with `-` to sort in
          descending order, for example `?sort=-accepted`. This endpoint sorts on
          one field only — supplying more than one comma delimited field returns a
          400. Sortable fields: `accepted`, `activity_completion`, `created_at`, `document_id`,
          `evidence_type`, `evidenceable_id`, `evidenceable_type`, `id`, `updated_at`,
          `vendor_id`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/Evidence"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of Evidence.
        ### Search parameters

        - `accepted` — Flag to indicate if the Evidence has been accepted
          - Valid values: `true`, `false`
        - `activity_completion` — The date the activity this Evidence documents was completed
        - `created_at` — The date this Evidence was created
        - `document_id` — The ID of the Document this Evidence was uploaded from
        - `evidence_type` — The type of the Evidence
          - Valid values: `accepted_policies`, `access_change_ticket`, `access_key_management_cloud_service_provider`, `access_request_forms`, `access_review`, `access_termination_forms`, `access_termination_ticket`, `account_lockout_cloud_services`, `account_lockout_duration_cloud_services`, `administrative_access_encryption`, `alerting_cloud_infrastructure`, `alerting_web_application`, `anti_malware`, `anti_malware_scans`, `anti_malware_server_endpoints`, `anti_spoofing`, `approved_scanning_vendor`, `architecture_diagram`, `asset_inventory_cloud_service_provider`, `asset_inventory_cloud_service_provider_owners`, `asset_inventory_removable_media`, `asset_inventory_user_endpoint_owners`, `asset_inventory_user_endpoint_screenshot`, `asset_inventory_user_endpoints`, `asset_inventory_version_control_repositories`, `asset_inventory_version_control_repository_owners`, `asset_inventory_wireless_access_points`, `asset_review`, `audit_evidence`, `authentication_and_encryption_configurations`, `authentication_credentials`, `autoscaling_cloud_service_providers`, `availability_zones_cloud_service_providers`, `background_check_report`, `background_check_report_unassigned`, `backup_restoration_template`, `backup_restoration_test_cloud_datastores`, `backup_retention_cloud_datastores`, `backup_schedule_cloud_datastores`, `baseline_configurations_cloud_service_providers`, `board_of_directors_bylaws`, `board_of_directors_meeting_minutes`, `board_of_directors_members`, `branch_access_restriction`, `bug_ticket_resolved`, `business_continuity_and_disaster_recovery_tabletop_exercise`, `business_impact_analysis`, `business_objective_document`, `card_reading_devices_inspection`, `card_reading_devices_inventory`, `card_reading_devices_training`, `career_page`, `ccpa_training_screenshot`, `centralized_repository_cryptographic_keys`, `cloud_infrastructure_users_export`, `cloud_report`, `cloud_resources_export`, `cloud_resource_inventory_export`, `cloud_services_screenshot`, `code_change_ticket`, `common_vulnerability_scan_result`, `company_ssp_report_section_block_attachment`, `company_ssp_report_assessment_objecttive`, `company_updates_page`, `compliance_and_regulation_inventory`, `compliance_report_hipaa`, `confidentiality_agreement`, `confidentiality_agreement_customers`, `confidentiality_agreement_vendors`, `configuration_change_ticket`, `configurations_for_obfuscating_sensitive_data`, `continuous_integration`, `contract_business_associate_agreement`, `contract_business_associate_subcontractor_agreement`, `contractors_export`, `controls_export`, `corrective_action_report`, `critical_change_communication`, `current_employees_export`, `custom`, `customer_notice_pci_dss`, `cybersecurity_insurance`, `data_disposal_log`, `data_flow_diagram`, `data_loss_prevention_alert_business_suite`, `data_disposal_prevention_business_suite`, `data_retention_requirements`, `database_backups`, `default_config_removal_cloud_services`, `default_config_removal_wireless_networks`, `detected_applications_export`, `development_dummy_data`, `devices_export`, `device_inventory_export`, `device_management_screenshot`, `devices_management_report`, `dast_scan`, `dynamic_application_security_testing_post_change`, `encryption_at_rest_cloud_datastores`, `encryption_at_rest_user_endpoints`, `encryption_in_transit_datastores`, `encryption_in_transit_web_application`, `encryption_keys`, `environment_segregation`, `file_integrity_monitoring_software`, `firewall_and_router_configuration_changes`, `firewall_cloud_service_provider`, `firewall_ruleset_cloud_service_provider`, `firewall_user_endpoints`, `firewall_web_application`, `framework_controls_export`, `framework_test_evidence_export`, `framework_tests_export`, `framework_isms_statement_of_applicability_export`, `gdpr_training_screenshot`, `generic_evidence`, `handling_cui_training_screenshot`, `help_desk_customers`, `hipaa_training_screenshot`, `ids_ips_configurations`, `incident_24_7_personnel`, `incident_response_tabletop_exercise`, `industry_membership`, `information_security_certification`, `intellectual_property_rights_inventory`, `internal_audit`, `internal_communications`, `internal_control_matrix_owners`, `interview_notes`, `isms_scope`, `isms_statement_of_applicability`, `job_descriptions`, `kpi_document`, `lessons_learned`, `log_retention_cloud_infrastructure`, `logging_cloud_infrastructure`, `logging_web_application`, `logical_access`, `master_service_agreement`, `mfa_business_suite`, `mfa_cloud_service_provider`, `mfa_human_resources_system`, `mfa_sso`, `mfa_version_control`, `minimum_password_age_cloud_services`, `monitoring_cloud_infrastructure`, `monitoring_web_application`, `nat_translation`, `network_configuration_changes`, `network_configurations_cloud_service_provider`, `network_configurations_wireless_settings`, `onboarding_ticket`, `organization_chart`, `organization_chart_distribution`, `oscal_diff`, `other`, `pan_details`, `password_age`, `password_complexity_business_suite`, `password_complexity_cloud_service_provider`, `password_complexity_human_resources_system`, `password_complexity_sso`, `password_complexity_version_control`, `password_creation`, `password_manager_screenshot`, `password_policy_screenshot`, `password_reuse_prevention_cloud_services`, `password_validation`, `patching_cloud_service_provider`, `pci_secure_code_training_screenshot`, `pci_training_screenshot`, `penetration_test_and_asv_scan`, `penetration_test_report`, `penetration_test_report_post_change`, `performance_review`, `personnel_export`, `poam_attachments`, `poam_items_export`, `policy_export`, `policy_review_calendar_invite`, `policy_review_meeting_minutes`, `privacy_policy`, `privacy_policy_last_updated`, `proprietary_software_products_inventory`, `rbac_matrix`, `recent_logging_activity`, `repositories_export`, `resume`, `review_findings_export`, `review_firewall_rules`, `review_verification_pci_dss`, `risk`, `risk_assessment`, `risk_assessment_answers_export`, `risk_assessment_vendors`, `risk_export`, `risk_register`, `risk_register_export`, `risk_register_snapshot_export`, `risk_treatment_plan`, `roles_and_responsibilities`, `route_table_screenshot`, `secure_certificate_and_trusted_keys`, `security_awareness_training`, `security_committee_meeting_minutes`, `security_control_failures`, `security_email`, `security_feature`, `security_incident_log`, `security_incident_ticket`, `security_incident_ticket_resolved`, `security_objective_document`, `security_review`, `security_training_screenshot`, `security_training_new_hire_screenshot`, `security_training_export`, `security_update_user_endpoints`, `security_web_page`, `sensitive_authentication_data_deleted`, `sensitive_authentication_data_not_stored`, `server_primary_function`, `service_contract`, `service_contract_pci_dss`, `session_timeout_cloud_services`, `session_timeout_user_endpoints`, `shared_accounts`, `sla`, `special_interest_group`, `ssh_key_management_cloud_service_provider`, `ssl_certificate`, `ssp_policy`, `system_description`, `system_installation`, `system_service`, `system_software_test`, `table_view`, `tabletop_exercise_bcdr`, `terminated_employees_export`, `terms_of_service`, `terms_of_service_last_updated`, `test_data_and_accounts`, `test_export`, `testing_wireless_access_points`, `third_party_accounts`, `third_party_anti_malware_endpoints`, `third_party_anti_malware_updates_endpoints`, `threat_detection_cloud_infrastructure`, `tickets_export`, `unique_password_authentication`, `unreadable_pan`, `user_access_review_accounts_export`, `user_identification`, `users_business_suite`, `users_cloud_service_provider`, `users_communication_tool`, `users_human_resources_system`, `users_mdm`, `users_password_manager`, `users_sso`, `users_version_control`, `vendor_access_list_export`, `vendor_risk`, `vendors_approved`, `vendors_export`, `vendor_risk_register_export`, `vendor_risk_register_snapshot_export`, `vendor_risk_review_answers_export`, `version_control_code_change_ticket`, `version_control_code_dependency_testing`, `version_control_code_pull_request_independent_approval_ticket`, `version_control_code_pull_request_template`, `version_control_code_static_application_security_testing`, `version_control_users_export`, `version_control_vendor`, `vulnerability_scanning_cloud_infrastructure`, `vulnerability_scanning_cloud_infrastructure_post_change`, `vulnerability_ticket`, `wireless_encryption`, `trust_center_nda_acceptances`, `editor_image`
        - `evidenceable_id` — The ID of the resource this Evidence is associated with
        - `evidenceable_type` — The type of resource this Evidence is associated with
          - Valid values: `Company`, `CompanyUser`, `CompanySspPolicy`
        - `id` — The ID of the Evidence
        - `updated_at` — The date this Evidence was last updated
        - `vendor_id` — The ID of the Vendor associated with this Evidence
      summary: List Evidence
      security:
      - header_authorization: &24 []
      x-controller: api/evidences
      x-action: index
  "/evidences/{id}":
    get:
      tags:
      - Evidence
      operationId: evidencesShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/Evidence"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a single Evidence by ID
      summary: Get an Evidence
      security:
      - header_authorization: *24
      x-controller: api/evidences
      x-action: show
  "/file_uploads":
    post:
      tags:
      - File Upload
      operationId: fileUploadsCreate
      parameters:
      - name: byte_size
        description: The exact size of the file in bytes. Must be 32 MB or smaller;
          a larger file is refused here rather than at the upload.
        required: true
        in: query
        schema:
          type: integer
      - name: checksum
        description: The base64-encoded MD5 digest of the file's raw bytes.
        required: true
        in: query
        schema:
          type: string
      - name: content_type
        description: The file's MIME type. Inferred from the filename when omitted.
        required: false
        in: query
        schema:
          type: string
      - name: filename
        description: The file's name, including its extension (for example `evidence.png`).
        required: true
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/FileUpload"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |-
        Stage a file upload.

        Stages a file so its bytes can be sent straight to storage rather than through this API.
        Three steps:

        1. Call this endpoint with the file's `filename`, `byte_size` and `checksum`. It returns a
           `url` to upload to, the `headers` to send with it, and an `id` to attach with. The two
           have separate deadlines: the `url` stops being accepted at `url_expires_at`, while the
           `id` stays redeemable until the later `id_expires_at`, so an upload whose bytes have
           already landed can still be attached after the URL is dead.
        2. PUT the file's bytes to that `url`, with exactly the `headers` returned. The request
           body is the file's contents as they are on disk — raw bytes, not base64, not multipart,
           not wrapped in JSON — so there is nothing to encode or convert. Send the headers
           unaltered, and make sure the bytes match the `byte_size` and `checksum` declared in
           step 1, or storage rejects the PUT.
        3. Send the `id` to an endpoint that attaches it, as `upload_id` in place of a multipart
           `file`. Each `id` is redeemable once; attaching the same file again means staging it
           again from step 1. The endpoints that accept an upload today are:
           - `POST /tests/{test_id}/evidences`:
             https://api.secureframe.com/docs#tag/test-evidence/POST/tests/{test_id}/evidences
           - `POST /users/{user_id}/evidences`:
             https://api.secureframe.com/docs#tag/user-evidence/POST/users/{user_id}/evidences
           - `PUT /trust_center_requests/{id}`:
             https://api.secureframe.com/docs#tag/trust-center-request/PUT/trust_center_requests/{id}
      summary: Stage a direct-to-storage File Upload and get an id for attaching the
        file
      security:
      - header_authorization: []
      x-controller: api/file_uploads
      x-action: create
      x-mcp-description: |-
        Stage a file so its bytes go straight to storage rather than through this API, and get
        back an id to attach it with. Uploading a file takes three steps, and only the first and
        third are tools — the middle one you make yourself.

        1. Call this tool with the file's `filename`, `byte_size` and `checksum`. The response
           contains a `url`, a `headers` object, and an `id`.
        2. PUT the file's bytes to that `url`, sending every entry in `headers` as a header,
           unaltered. The request body is the file's contents as they are on disk — raw bytes,
           not base64, not multipart, not wrapped in JSON — so there is nothing to encode or
           convert. Storage rejects the PUT unless the bytes match the `byte_size` and
           `checksum` declared in step 1, so declare them from the file you are actually sending.
        3. Pass the `id` as `upload_id` to the tool that attaches it: `create_test_evidence`,
           `create_user_evidence` or `update_trust_center_request`. Each `id` is redeemable
           once; attaching the same file again means staging it again from step 1.

        A file must be 32 MB or smaller. A larger `byte_size` is refused here, in step 1, before
        you have spent anything on the upload itself.

        The two halves of the handshake expire apart, and the response dates both. The `url`
        stops being accepted 15 minutes after staging, at `url_expires_at`; the `id` stays
        redeemable for an hour, until `id_expires_at`. Bytes that have already landed can
        therefore still be attached after the URL is dead, but a batch of uploads staged up
        front must all be PUT inside that first 15 minutes.
  "/knowledge_base_answers/{id}":
    get:
      tags:
      - Knowledge Base Answer
      operationId: knowledgeBaseAnswersShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/KnowledgeBaseAnswer"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a single Knowledge Base Answer by ID
      summary: Get a Knowledge Base Answer
      security:
      - header_authorization: &25 []
      x-controller: api/knowledge_base_answers
      x-action: show
    put:
      tags:
      - Knowledge Base Answer
      operationId: knowledgeBaseAnswersUpdate
      parameters:
      - name: content
        description: The content of the Knowledge Base Answer.
        required: false
        in: query
        schema:
          type: string
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: primary_answer
        description: Flag to indicate if this is the primary answer.
        required: false
        in: query
        schema:
          type: boolean
      - name: type
        description: The type of the Knowledge Base Answer.
        required: false
        in: query
        schema:
          type: string
          enum:
          - KnowledgeBaseAnswerFreeForm
          - KnowledgeBaseAnswerYesOrNo
          - KnowledgeBaseAnswerTrueOrFalse
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/KnowledgeBaseAnswer"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Update a Knowledge Base Answer by ID
      summary: Update a Knowledge Base Answer
      security:
      - header_authorization: *25
      x-controller: api/knowledge_base_answers
      x-action: update
    delete:
      tags:
      - Knowledge Base Answer
      operationId: knowledgeBaseAnswersDestroy
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        '200':
          description: OK
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Delete a Knowledge Base Answer by ID
      summary: Delete a Knowledge Base Answer
      security:
      - header_authorization: *25
      x-controller: api/knowledge_base_answers
      x-action: destroy
  "/knowledge_base_answers":
    post:
      tags:
      - Knowledge Base Answer
      operationId: knowledgeBaseAnswersCreate
      parameters:
      - name: content
        description: The content of the Knowledge Base Answer.
        required: true
        in: query
        schema:
          type: string
      - name: knowledge_base_question_id
        description: The ID of the associated Knowledge Base Question.
        required: true
        in: query
        schema:
          type: string
          format: uuid
      - name: primary_answer
        description: Flag to indicate if this is the primary answer.
        required: false
        in: query
        schema:
          type: boolean
      - name: type
        description: The type of the Knowledge Base Answer.
        required: true
        in: query
        schema:
          type: string
          enum:
          - KnowledgeBaseAnswerFreeForm
          - KnowledgeBaseAnswerYesOrNo
          - KnowledgeBaseAnswerTrueOrFalse
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/KnowledgeBaseAnswer"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Create a new Knowledge Base Answer
      summary: Create a Knowledge Base Answer
      security:
      - header_authorization: *25
      x-controller: api/knowledge_base_answers
      x-action: create
  "/knowledge_base_questions/{id}":
    get:
      tags:
      - Knowledge Base Question
      operationId: knowledgeBaseQuestionsShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - knowledge_base_answers
            - owner
        explode: false
        style: form
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/KnowledgeBaseQuestion"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a single Knowledge Base Question by ID
      summary: Get a Knowledge Base Question
      security:
      - header_authorization: &26 []
      x-controller: api/knowledge_base_questions
      x-action: show
    put:
      tags:
      - Knowledge Base Question
      operationId: knowledgeBaseQuestionsUpdate
      parameters:
      - name: content
        description: The content of the Knowledge Base Question.
        required: false
        in: query
        schema:
          type: string
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: manual_review_requested
        description: Flag to indicate if a manual review of the Knowledge Base Question
          is requested.
        required: false
        in: query
        schema:
          type: boolean
      - name: owner_id
        description: The ID of the owner of the Knowledge Base Question.
        required: false
        in: query
        schema:
          type: string
          format: uuid
      - name: review_frequency
        description: The frequency of the review of the Knowledge Base Question.
        required: false
        in: query
        schema:
          type: string
          enum:
          - Daily
          - Weekly
          - Biweekly
          - Monthly
          - Quarterly
          - Biannually
          - Annually
          - Never
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/KnowledgeBaseQuestion"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Update a Knowledge Base Question by ID
      summary: Update a Knowledge Base Question
      security:
      - header_authorization: *26
      x-controller: api/knowledge_base_questions
      x-action: update
    delete:
      tags:
      - Knowledge Base Question
      operationId: knowledgeBaseQuestionsDestroy
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        '200':
          description: OK
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Delete a Knowledge Base Question by ID
      summary: Delete a Knowledge Base Question
      security:
      - header_authorization: *26
      x-controller: api/knowledge_base_questions
      x-action: destroy
  "/knowledge_base_questions":
    post:
      tags:
      - Knowledge Base Question
      operationId: knowledgeBaseQuestionsCreate
      parameters:
      - name: content
        description: The content of the Knowledge Base Question.
        required: true
        in: query
        schema:
          type: string
      - name: owner_id
        description: The ID of the owner of the Knowledge Base Question.
        required: false
        in: query
        schema:
          type: string
          format: uuid
      - name: review_frequency
        description: The frequency of the review of the Knowledge Base Question.
        required: false
        in: query
        schema:
          type: string
          enum:
          - Daily
          - Weekly
          - Biweekly
          - Monthly
          - Quarterly
          - Biannually
          - Annually
          - Never
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/KnowledgeBaseQuestion"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Create a new Knowledge Base Question
      summary: Create a Knowledge Base Question
      security:
      - header_authorization: *26
      x-controller: api/knowledge_base_questions
      x-action: create
  "/poam_items":
    get:
      tags:
      - POA&M Item
      operationId: poamItemsIndex
      parameters:
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the POA&M Item data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: sort
        description: 'Comma delimited string of fields to sort the results by, applied
          in the order given. Prefix a field with `-` to sort it in descending order,
          for example `?sort=-discarded,due_date`. Sortable fields: `discarded`, `due_date`,
          `estimated_completion_date`, `id`, `identifier`, `issue`, `owner_name`,
          `risk_level`, `status`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/PoamItem"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of POA&M items.
        ### Search parameters

        - `discarded` — Whether the POA&M item has been discarded
          - Valid values: `true`, `false`
        - `due_date` — The due date of the POA&M item
        - `estimated_completion_date` — The estimated completion date of the POA&M item
        - `id` — The ID of the POA&M item
        - `identifier` — The identifier of the POA&M item
        - `issue` — The issue describing the POA&M item
        - `owner_name` — The name of the POA&M item owner
        - `risk_level` — The risk level of the POA&M item
          - Valid values: `low`, `medium`, `high`
        - `status` — The status of the POA&M item
          - Valid values: `draft`, `in_progress`, `closed`
      summary: List POA&M items
      security:
      - header_authorization: &27 []
      x-controller: api/poam_items
      x-action: index
    post:
      tags:
      - POA&M Item
      operationId: poamItemsCreate
      parameters:
      - name: due_date
        description: The due date of the POA&M item.
        required: false
        in: query
        schema:
          type: string
          format: date
      - name: estimated_completion_date
        description: The estimated completion date of the POA&M item.
        required: false
        in: query
        schema:
          type: string
          format: date
      - name: identifier
        description: The identifier of the POA&M item.
        required: false
        in: query
        schema:
          type: string
      - name: issue
        description: The issue describing the POA&M item.
        required: true
        in: query
        schema:
          type: string
      - name: owner_id
        description: The ID of the user who owns this POA&M item.
        required: true
        in: query
        schema:
          type: string
          format: uuid
      - name: remediation_plan
        description: The remediation plan for the POA&M item.
        required: false
        in: query
        schema:
          type: string
      - name: risk_level
        description: The risk level (defaults to low).
        required: false
        in: query
        schema:
          type: string
          enum:
          - low
          - medium
          - high
      - name: status
        description: The status (defaults to draft).
        required: false
        in: query
        schema:
          type: string
          enum:
          - draft
          - in_progress
          - closed
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/PoamItem"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Create a new POA&M item.
      summary: Create a POA&M item
      security:
      - header_authorization: *27
      x-controller: api/poam_items
      x-action: create
  "/poam_items/{id}":
    get:
      tags:
      - POA&M Item
      operationId: poamItemsShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/PoamItem"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a POA&M item by ID
      summary: Get a POA&M item
      security:
      - header_authorization: *27
      x-controller: api/poam_items
      x-action: show
    put:
      tags:
      - POA&M Item
      operationId: poamItemsUpdate
      parameters:
      - name: due_date
        description: The due date of the POA&M item.
        required: false
        in: query
        schema:
          type: string
          format: date
      - name: estimated_completion_date
        description: The estimated completion date of the POA&M item.
        required: false
        in: query
        schema:
          type: string
          format: date
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: identifier
        description: The identifier of the POA&M item.
        required: false
        in: query
        schema:
          type: string
      - name: issue
        description: The issue describing the POA&M item.
        required: false
        in: query
        schema:
          type: string
      - name: owner_id
        description: The ID of the user who owns this POA&M item.
        required: false
        in: query
        schema:
          type: string
          format: uuid
      - name: remediation_plan
        description: The remediation plan for the POA&M item.
        required: false
        in: query
        schema:
          type: string
      - name: risk_level
        description: The risk level.
        required: false
        in: query
        schema:
          type: string
          enum:
          - low
          - medium
          - high
      - name: status
        description: The status.
        required: false
        in: query
        schema:
          type: string
          enum:
          - draft
          - in_progress
          - closed
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/PoamItem"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Update a POA&M item by ID.
      summary: Update a POA&M item
      security:
      - header_authorization: *27
      x-controller: api/poam_items
      x-action: update
  "/poam_items/{id}/discard":
    put:
      tags:
      - POA&M Item
      operationId: poamItemsDiscard
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/PoamItem"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Discard a POA&M item by ID.
      summary: Discard a POA&M item
      security:
      - header_authorization: *27
      x-controller: api/poam_items
      x-action: discard
  "/policies":
    get:
      tags:
      - Policy
      operationId: policiesIndex
      parameters:
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - owner
        explode: false
        style: form
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the Policy data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      - name: sort
        description: 'Comma delimited string of fields to sort the results by, applied
          in the order given. Prefix a field with `-` to sort it in descending order,
          for example `?sort=-acceptance_rate,acceptance_status`. Sortable fields:
          `acceptance_rate`, `acceptance_status`, `framework_ids`, `groups`, `id`,
          `name`, `owner_id`, `owner_name`, `parent_policy_id`, `published_at`, `read_only`,
          `status`, `updated_at`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/Policy"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of Policies.
        ### Search parameters

        - `acceptance_rate` — The percentage of eligible personnel who have accepted this Policy
        - `acceptance_status` — Whether every eligible person has accepted this Policy
          - Valid values: `pending`, `completed`
        - `framework_ids` — The IDs of the Frameworks this Policy is mapped to
        - `groups` — The names of the personnel groups this Policy is assigned to
        - `id` — The ID of the Policy
        - `name` — The name of the Policy
        - `owner_id` — The ID of the User that owns this Policy
        - `owner_name` — The name of the User that owns this Policy
        - `parent_policy_id` — The ID of the Policy this Policy is an addendum to
        - `published_at` — The date this Policy was published
        - `read_only` — Flag to indicate if this Policy is informational and requires no acceptance
          - Valid values: `true`, `false`
        - `status` — The status of the Policy
          - Valid values: `needs_review`, `published`, `archived`
        - `updated_at` — The date this Policy was last updated
      summary: List Policies
      security:
      - header_authorization: &28 []
      x-controller: api/policies
      x-action: index
  "/policies/{id}":
    get:
      tags:
      - Policy
      operationId: policiesShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - owner
        explode: false
        style: form
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/PolicyDetail"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a single Policy by ID, including its content and any attached
        documents.
      summary: Get a Policy
      security:
      - header_authorization: *28
      x-controller: api/policies
      x-action: show
  "/repositories/{id}/framework_asset_scopes":
    get:
      tags:
      - Repository Framework Asset Scope
      operationId: repositoriesCompanyFrameworkAssetScopesIndex
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - manually_scoped_by
        explode: false
        style: form
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/FrameworkAssetScope"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |-
        Returns a list of Framework Asset Scopes for the Repository by ID.

        The absence of a Framework Asset Scope indicates the asset is not in scope for the Framework.
      summary: List Framework Asset Scopes
      security:
      - header_authorization: &29 []
      x-controller: api/repositories/company_framework_asset_scopes
      x-action: index
    post:
      tags:
      - Repository Framework Asset Scope
      operationId: repositoriesCompanyFrameworkAssetScopesCreate
      parameters:
      - name: active
        description: Flag to indicate if this Framework Asset Scope is active.
        required: false
        in: query
        schema:
          type: boolean
      - name: framework_id
        description: The ID of the Framework assigned to this Framework Asset Scope.
        required: false
        in: query
        schema:
          type: string
          format: uuid
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: manually_scoped_reason
        description: Reason if this Framework Asset Scope is manually scoped.
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/FrameworkAssetScope"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Create a Framework Asset Scope for the Repository by ID
      summary: Create Framework Asset Scope
      security:
      - header_authorization: *29
      x-controller: api/repositories/company_framework_asset_scopes
      x-action: create
  "/repositories":
    get:
      tags:
      - Repository
      operationId: repositoriesIndex
      parameters:
      - name: include
        description: 'Comma delimited string of relationships to include. Note: company_vendor_connection
          is deprecated, please use integration_connection instead.'
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - company_vendor_connection
            - integration_connection
            - owner
        explode: false
        style: form
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the Repository data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      - name: sort
        description: 'Comma delimited string of fields to sort the results by, applied
          in the order given. Prefix a field with `-` to sort it in descending order,
          for example `?sort=-created_at,id`. Sortable fields: `created_at`, `id`,
          `in_audit_scope`, `name`, `owner_name`, `private`, `updated_at`, `vendor_name`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/Repository"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of Repositories.
        ### Search parameters

        - `created_at` — The date this Repository was created
        - `id` — The ID of the Repository
        - `in_audit_scope` — Flag to indicate if the Repository is in audit scope. [DEPRECATED - Use the Repository Framework Asset Scope [endpoint](/tag/Repository-Framework-Asset-Scope#operation/repositoriesCompanyFrameworkAssetScopesIndex)]
          - Valid values: `true`, `false`
        - `name` — The name of the repository
        - `owner_name` — The Repository owner's name
        - `private` — Flag to indicate if the Repository is private
          - Valid values: `true`, `false`
        - `updated_at` — The date this Repository was last updated
        - `vendor_name` — The name of the vendor that this Repository is from
      summary: List Repositories
      security:
      - header_authorization: &30 []
      x-controller: api/repositories
      x-action: index
  "/repositories/{id}":
    get:
      tags:
      - Repository
      operationId: repositoriesShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: include
        description: 'Comma delimited string of relationships to include. Note: company_vendor_connection
          is deprecated, please use integration_connection instead.'
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - company_vendor_connection
            - integration_connection
            - owner
        explode: false
        style: form
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/Repository"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a single Repository by ID
      summary: Get a Repository
      security:
      - header_authorization: *30
      x-controller: api/repositories
      x-action: show
    put:
      tags:
      - Repository
      operationId: repositoriesUpdate
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: in_audit_scope
        description: Flag to indicate if this Repository is in scope. [DEPRECATED
          - Use the Repository Framework Asset Scope [endpoint](/tag/Repository-Framework-Asset-Scope#operation/repositoriesCompanyFrameworkAssetScopesCreate)]
        required: false
        in: query
        schema:
          type: boolean
      - name: out_of_audit_scope_reason
        description: Out of scope reason if the repository is not in scope. [DEPRECATED
          - Use the Repository Framework Asset Scope [endpoint](/tag/Repository-Framework-Asset-Scope#operation/repositoriesCompanyFrameworkAssetScopesCreate)]
        required: false
        in: query
        schema:
          type: string
          enum:
          - development_asset
          - staging_asset
          - out_of_scope_production_asset
      - name: owner_id
        description: ID of the User that's the owner of this repository.
        required: false
        in: query
        schema:
          type: string
          format: uuid
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/Repository"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Update a Repository by ID
      summary: Update a Repository
      security:
      - header_authorization: *30
      x-controller: api/repositories
      x-action: update
  "/security_questionnaires":
    post:
      tags:
      - Security Questionnaire
      operationId: securityQuestionnairesCreate
      parameters:
      - name: company_name
        description: The name of the client who is requesting the questionnaire
        required: false
        in: query
        schema:
          type: string
      - name: due_date
        description: The due date of the questionnaire
        required: false
        in: query
        schema:
          type: string
          format: date
      - name: owner_id
        description: The owner of the questionnaire
        required: true
        in: query
        schema:
          type: string
          format: uuid
      - name: questionnaire_template
        description: The template to use for the questionnaire
        required: false
        in: query
        schema:
          type: string
          enum:
          - custom
          - caiq
          - hecvat
          - hecvat_lite
          - sig
          - sig_lite
          - ccpa
          - cis
          - nist
          - vsa
          - pci_dss
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/SecurityQuestionnaire"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Creates a new Security Questionnaire.
      summary: Create a Security Questionnaire
      security:
      - header_authorization: []
      x-controller: api/security_questionnaires
      x-action: create
      requestBody:
        required: true
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                file:
                  type: string
                  format: binary
                  description: File which you want to attach as evidence
                  example: Users/Downloads/some_file.png
              required:
              - file
  "/tasks":
    get:
      tags:
      - Task
      operationId: tasksIndex
      parameters:
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - creator
            - owner
        explode: false
        style: form
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the Task data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      - name: sort
        description: 'Comma delimited string of fields to sort the results by, applied
          in the order given. Prefix a field with `-` to sort it in descending order,
          for example `?sort=-category,completed`. Sortable fields: `category`, `completed`,
          `completed_at`, `created_at`, `creator_name`, `description`, `dismissed_at`,
          `due_at`, `id`, `overdue`, `owner_id`, `owner_name`, `task_subtype`, `task_type`,
          `taskable_id`, `taskable_type`, `title`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/Task"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of Tasks.
        ### Search parameters

        - `category` — The category of the Task
          - Valid values: `lets_get_started`, `get_audit_ready`, `lets_start`, `account_security`, `integrations`, `compliance`, `go_further`, `personnel`, `launch_trust_center`, `build_knowledge_base`, `process_first_security_questionnaire`, `user_onboarding`
        - `completed` — Flag to indicate if the Task has been completed
          - Valid values: `true`, `false`
        - `completed_at` — The date this Task was completed
        - `created_at` — The date this Task was created
        - `creator_name` — The name of the User that created this Task
        - `description` — The description of the Task
        - `dismissed_at` — The date this Task was dismissed
        - `due_at` — The date this Task is due
        - `id` — The ID of the Task
        - `overdue` — Flag to indicate if the Task was past due and incomplete when it was last indexed
          - Valid values: `true`, `false`
        - `owner_id` — The ID of the User that owns this Task
        - `owner_name` — The name of the User that owns this Task
        - `task_subtype` — The subtype of the Task. Empty for standard Tasks
        - `task_type` — The type of the Task
          - Valid values: `add_cloud_resources`, `add_devices`, `add_metadata_to_vendors`, `add_owners_to_cloud_resources`, `add_owners_to_devices`, `add_owners_to_policies`, `add_owners_to_repositories`, `add_repositories`, `categorize_users`, `complete_risk_questionnaire`, `configure_custom_domain`, `custom`, `employees_accept_policies`, `employees_complete_security_training`, `employees_complete_trainings`, `export_completed_questionnaire`, `identify_ism`, `initiate_background_checks`, `link_terms_of_service_and_privacy_policy`, `process_questionnaire`, `publish_trust_center`, `review_policies`, `schedule_pen_test`, `select_auditor`, `set_company_description`, `set_up_background_check_provider`, `set_up_mdm`, `set_up_password_manager`, `set_up_sso`, `upload_100_security_questions_and_answers`, `upload_company_logo`, `upload_compliance_certification`, `upload_requestable_compliance_document`, `adding_cloud_resources`, `adding_devices`, `setup_domain_filtering`, `add_personnel`, `connect_remaining_integrations`, `finish_profile`, `schedule_call`, `categorize_personnel`, `mark_personnel_scope`, `link_accounts`, `manage_policies`, `setup_bkg_check_provider`, `initiate_bkg_checks`, `create_invite_email`, `invite_personnel`, `setup_sso`, `setup_mdm`, `setup_pw_manager`, `select_ism`, `add_vendors`, `create_recurring_review_schedules`, `complete_questionnaire`, `select_compliance_auditor`, `select_compliance_pentest`, `trust_center`, `secureframe_questionnaire`, `secureframe_training`, `user_accepted_policies`, `user_completed_trainings`, `user_completed_background_check`, `user_secureframe_agent_installed`
        - `taskable_id` — The ID of the resource this Task is associated with
        - `taskable_type` — The type of resource this Task is associated with
          - Valid values: `CompanyTest`, `CompanyRisk`, `UserAccessReviewAccount`, `VendorRiskDetail`
        - `title` — The title of the Task
      summary: List Tasks
      security:
      - header_authorization: &31 []
      x-controller: api/tasks
      x-action: index
  "/tasks/{id}":
    get:
      tags:
      - Task
      operationId: tasksShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - creator
            - owner
        explode: false
        style: form
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/Task"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a single Task by ID
      summary: Get a Task
      security:
      - header_authorization: *31
      x-controller: api/tasks
      x-action: show
  "/test_exports/{id}":
    get:
      tags:
      - Test Export Reading
      operationId: testExportsShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/TestExport"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a single Test Export.
      summary: Get a Test Export
      security:
      - header_authorization: []
      x-controller: api/test_exports
      x-action: show
  "/tprm/vendors":
    get:
      tags:
      - Third Party Risk Management Vendor
      operationId: tprmVendorRiskDetailsIndex
      parameters:
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - vendor_risk_subassessment_responses
        explode: false
        style: form
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the Vendor data using Lucene syntax.
        required: false
        in: query
        schema:
          type: string
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      - name: sort
        description: 'Comma delimited string of fields to sort the results by, applied
          in the order given. Prefix a field with `-` to sort it in descending order,
          for example `?sort=-archived,id`. Sortable fields: `archived`, `id`, `name`,
          `owner_name`, `risk_level`, `updated_at`, `created_at`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/VendorRiskDetail"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of Third Party Risk Management Vendors.
        ### Search parameters

        - `archived` — Flag to indicate if this Vendor is archived
          - Valid values: `true`, `false`
        - `id` — The ID of the Vendor
        - `name` — The name of the Vendor
        - `owner_name` — The name of the User that is the owner for this Vendor
        - `risk_level` — The risk level for this Vendor
        - `updated_at` — The date this Vendor was last updated
        - `created_at` — The date this Vendor was created
      summary: List Third Party Risk Management Vendors
      security:
      - header_authorization: &32 []
      x-controller: api/tprm/vendor_risk_details
      x-action: index
  "/tprm/vendors/{id}":
    get:
      tags:
      - Third Party Risk Management Vendor
      operationId: tprmVendorRiskDetailsShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - vendor_risk_subassessment_responses
        explode: false
        style: form
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/VendorRiskDetail"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a single Vendor by ID
      summary: Get a Third Party Risk Management Vendor.
      security:
      - header_authorization: *32
      x-controller: api/tprm/vendor_risk_details
      x-action: show
  "/tprm/vendors/{id}/archive":
    put:
      tags:
      - Third Party Risk Management Vendor
      operationId: tprmVendorRiskDetailsArchive
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/VendorRiskDetail"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Archives a Vendor by ID.
      summary: Archive a Third Party Risk Management Vendor.
      security:
      - header_authorization: *32
      x-controller: api/tprm/vendor_risk_details
      x-action: archive
  "/trust_center_requests":
    get:
      tags:
      - Trust Center Request
      operationId: trustCenterRequestsIndex
      parameters:
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - trust_center_resource_requests
        explode: false
        style: form
      - name: page
        description: 'Used for pagination of response data (default: page 1). Specifies
          the offset of the next block of data to receive.'
        required: false
        in: query
        schema:
          type: integer
      - name: per_page
        description: 'Used for pagination of response data (default: 100 items per
          response). Specifies the number of results for a given page.'
        required: false
        in: query
        schema:
          type: integer
      - name: q
        description: Search and filter the Trust Center Request data using Lucene
          syntax.
        required: false
        in: query
        schema:
          type: string
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      - name: sort
        description: 'Comma delimited string of fields to sort the results by, applied
          in the order given. Prefix a field with `-` to sort it in descending order,
          for example `?sort=-id,created_at`. Sortable fields: `id`, `created_at`,
          `email`, `requester_name`, `reviewed`.'
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    description: List of resources matching the query
                    items:
                      type: object
                      description: Data envelope for the response
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
                        type:
                          type: string
                          description: The type of resource this object is
                        attributes:
                          "$ref": "#/components/schemas/TrustCenterRequest"
                        relationships:
                          type: object
                          description: Nested objects related to the top level object
                        links:
                          type: object
                          description: Links to related API resources
                  meta:
                    type: object
                    description: Metadata about the list response
                    properties:
                      total:
                        type: integer
                        description: Total number of records matching the query across
                          all pages, independent of page and per_page
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |
        Returns a list of Trust Center Requests
        ### Search parameters

        - `id` — The ID of the Trust Center Request
        - `created_at` — The date when this Trust Center Request was created
        - `email` — The email of the requester for this Trust Center Request
        - `requester_name` — The name of the requester for the Trust Center Request
        - `reviewed` — True if this Trust Center Request has been reviewed, false otherwise
          - Valid values: `true`, `false`
      summary: List Trust Center Requests
      security:
      - header_authorization: &33 []
      x-controller: api/trust_center_requests
      x-action: index
  "/trust_center_requests/{id}":
    get:
      tags:
      - Trust Center Request
      operationId: trustCenterRequestsShow
      parameters:
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: include
        description: Comma delimited string of relationships to include.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            enum:
            - trust_center_resource_requests
        explode: false
        style: form
      - name: relationships
        description: 'Set to true to return the associated relationships data within
          the response. (default: false)'
        required: false
        in: query
        schema:
          type: boolean
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/TrustCenterRequest"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns a single Trust Center Request by ID
      summary: Get a Trust Center Request
      security:
      - header_authorization: *33
      x-controller: api/trust_center_requests
      x-action: show
    put:
      tags:
      - Trust Center Request
      operationId: trustCenterRequestsUpdate
      parameters:
      - name: approve_all_resources
        description: Approve all resources for this trust center request.
        required: false
        in: query
        schema:
          type: boolean
      - name: approved_trust_center_resource_request_ids
        description: The IDs of the trust center resource requests for approval. Empty
          array will reject the request
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            format: uuid
        explode: true
      - name: custom_response
        description: Send custom message in email response
        required: false
        in: query
        schema:
          type: string
      - name: do_not_send_notification
        description: Set this to true prevent email notifications from being sent
        required: false
        in: query
        schema:
          type: boolean
      - name: document_security
        description: The document security level for this trust center request.
        required: false
        in: query
        schema:
          type: string
          enum:
          - clickwrap
          - external
          - waived
      - name: id
        description: Scope response to id
        required: true
        in: path
        schema:
          type: string
      - name: rejected_trust_center_resource_request_ids
        description: The IDs of the trust center resource requests for rejection.
        required: false
        in: query
        schema:
          type: array
          items:
            type: string
            format: uuid
        explode: true
      - name: rejection_reasons
        description: Send custom rejection messages per resource
        required: false
        in: query
        schema:
          type: object
      - name: upload_id
        description: The `id` returned by `POST /file_uploads` — the `create_file_upload`
          tool — whose bytes you have already PUT to storage. The way to attach a
          preloaded signed nda agreement. The alternative to `file`.
        required: false
        in: query
        schema:
          type: string
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/TrustCenterRequest"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '404':
          description: Resource not found
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: |-
        Update a TrustCenterRequest by ID

        Most updates send no file at all. When you are attaching a signed NDA agreement, send it
        one of two ways, and provide at most one of them.

        `upload_id` attaches a file whose bytes you sent straight to storage, which is the right
        choice for anything large and the only workable one for a caller that cannot send
        multipart. Three steps:

        1. Call `POST /file_uploads` with the file's `filename`, `byte_size` and `checksum`. It
           returns a short-lived `url`, the `headers` to send with it, and an `id`.
        2. PUT the file's bytes to that `url`, with exactly the `headers` returned. The request
           body is the file's contents as they are on disk — raw bytes, not base64, not multipart,
           not wrapped in JSON — so there is nothing to encode or convert.
        3. Send the `id` here as `upload_id`.

        `file` is the alternative for a direct REST caller — the file's bytes as a multipart
        upload in this request, with no preloading step.
      summary: Update a Trust Center Request
      security:
      - header_authorization: *33
      x-controller: api/trust_center_requests
      x-action: update
      x-mcp-description: |-
        Update a Trust Center Request: approve or reject the resources it asks for, set its
        document security, or send a custom response. Most calls attach no file at all.

        To attach a signed NDA agreement, the bytes are not sent here. Stage the file first with
        the `create_file_upload` tool, which hands back a `url` and an `id`; PUT the file's raw
        bytes to that `url`; then call this tool with that `id` as `upload_id`. The bytes must
        already be in storage by the time you call this — an `upload_id` whose PUT never
        happened is refused rather than attached empty. `create_file_upload` documents the size
        limit and the two expiry windows.

        Each `upload_id` is redeemable once. Attaching the same file to a second request means
        staging it again.
      requestBody:
        required: false
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                file:
                  type: string
                  format: binary
                  description: The signed trust center nda agreement pdf file's bytes,
                    as a multipart upload in this request. The alternative to `upload_id`,
                    for a direct REST caller.
                  example: Users/Downloads/some_file.png
  "/user_security_settings":
    get:
      tags:
      - User Security Settings
      operationId: userSecuritySettingsIndex
      parameters: []
      responses:
        default:
          description: ''
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: object
                    description: Data envelope for the response
                    properties:
                      id:
                        type: string
                        format: uuid
                        description: The identifier for this resource
                      type:
                        type: string
                        description: The type of resource this object is
                      attributes:
                        "$ref": "#/components/schemas/UserSecuritySetting"
                      relationships:
                        type: object
                        description: Nested objects related to the top level object
                      links:
                        type: object
                        description: Links to related API resources
                  included:
                    type: array
                    items:
                      type: object
                      description: Various objects that have been included via the
                        `include` param
                      properties:
                        id:
                          type: string
                          format: uuid
                          description: The identifier for this resource
        '403':
          description: Forbidden
        '401':
          description: Unauthorized
        '400':
          description: Bad Request
      description: Returns user security settings for the provided API key's company
        and user
      summary: Get user security settings
      security:
      - header_authorization: []
      x-controller: api/user_security_settings
      x-action: index
tags:
- name: Cloud Resource
  description: This document describes the API for reading and updating Cloud Resources.
- name: Cloud Resource Framework Asset Scope
  description: |-
    This document describes the API for reading and creating Framework Asset Scopes.

    A Framework Asset Scope defines the scope of an asset (e.g., a Cloud Resource) within a Framework.

    Framework Asset Scopes are immutable. Once created, they cannot be modified. To update a scope, create a new resource with the updated information.
- name: Comment
  description: This document describes the API for reading, creating, updating, and
    deleting Comments.
- name: Control
  description: This document describes the API for reading Controls.
- name: Custom Integration
  description: This document describes the API for publishing data to a custom integration.
- name: Device
  description: This document describes the API for reading Devices.
- name: Device Framework Asset Scope
  description: |-
    This document describes the API for reading and creating Framework Asset Scopes.

    A Framework Asset Scope defines the scope of an asset (e.g., a Device) within a Framework.

    Framework Asset Scopes are immutable. Once created, they cannot be modified. To update a scope, create a new resource with the updated information.
- name: Evidence
  description: This document describes the API for reading Evidence.
- name: File Upload
  description: This document describes the API for staging a direct-to-storage file
    upload.
- name: Framework
  description: This document describes the API for reading Frameworks.
- name: Framework Requirement
  description: This document describes the API for reading Framework Requirements.
- name: Integration Connection
  description: This document describes the API for reading and archiving Integration
    Connections.
- name: Knowledge Base Answer
  description: This document describes the API for reading, creating, updating, and
    deleting Knowledge Base Answers.
- name: Knowledge Base Question
  description: This document describes the API for reading, creating, updating, and
    deleting Knowledge Base Questions.
- name: POA&M Item
  description: |-
    This document describes the API for reading, creating, updating, and discarding POA&M
    (Plan of Action & Milestones) items.
- name: Policy
  description: |-
    This document describes the API for reading Policies.

    Policies are returned in every status, including drafts and archived ones. Filter with
    `?q=status:published` to narrow.

    Note that `q` free-text search covers a Policy's name and owner, not the content of the Policy
    itself.
- name: Repository
  description: This document describes the API for reading and updating Repositories.
- name: Repository Framework Asset Scope
  description: |-
    This document describes the API for reading Framework Asset Scopes.

    A Framework Asset Scope defines the scope of an asset (e.g., a Repository) within a Framework.

    Framework Asset Scopes are immutable. Once created, they cannot be modified. To update a scope, create a new resource with the updated information.
- name: Risk
  description: This document describes the API for reading Risks.
- name: Security Questionnaire
  description: This document describes the API for creating Security Questionnaires.
- name: SSP Duty
  description: This document describes the API for reading, creating, updating, and
    deleting SSP Duties.
- name: SSP Duty Role
  description: This document describes the API for reading, creating, and deleting
    SSP Duty Roles.
- name: SSP Policy
  description: This document describes the API for reading, creating, updating, and
    deleting SSP Policies.
- name: SSP Report
  description: This document describes the API for reading and creating SSP Reports.
- name: SSP Report Assessment Objective
  description: This document describes the API for reading and updating SSP Report
    Assessment Objectives.
- name: SSP Report Section
  description: This document describes the API for reading and updating SSP Report
    Sections.
- name: SSP Report Section Block
  description: This document describes the API for reading and updating SSP Report
    Section Blocks.
- name: SSP Role
  description: This document describes the API for reading, creating, updating, and
    deleting SSP Roles.
- name: SSP Vendor
  description: This document describes the API for reading, creating, updating, and
    deleting SSP Vendors.
- name: Task
  description: This document describes the API for reading Tasks.
- name: Test
  description: This document describes the API for reading, creating, and updating
    Tests.
- name: Test Evidence
  description: This document describes the API for creating Evidence for a Test.
- name: Test Export
  description: This document describes the API for creating a Test Export for a Test.
- name: Test Export Reading
  description: This document describes the API for reading a Test Export.
- name: Third Party Risk Management Vendor
  description: This document describes the API for reading and archiving Vendors for
    companies using the Third Party Risk Management.
- name: Trust Center Request
  description: |-
    This document describes the API for reading and updating Trust Center Requests.\
    Note: In order to access this API, you need to have paid features enabled for Trust.
- name: User
  description: This document describes the API for reading and updating Users.
- name: User Account
  description: This document describes the API for reading and linking User Accounts.
- name: User Evidence
  description: This document describes the API for creating Evidence for a User.
- name: User Security Settings
  description: This document describes the API for retrieving user security settings
    for the provided API key's company.
- name: Vendor
  description: This document describes the API for reading and archiving Vendors.
components:
  schemas:
    Models_CustomConnections_CreateResourceDataRequest:
      type: object
      properties:
        schema_slug:
          type: string
          description: |-
            The slug identifying the data type this data conforms to. This is used to
            identify the schema to use for processing the data.
          example: users
        vendor_slug:
          type: string
          description: |-
            The slug identifying the vendor this data should be attributed to. This
            must match the vendor configured for the connection.
          example: acme
        resource_data:
          type: array
          items:
            type: object
          description: |-
            An array of objects representing the current state of a set of
            resources provided by this data source.
          example:
          - id: '123'
            name: John Doe
            email: john.doe@example.com
          - id: '456'
            name: Jane Doe
            email: jane.doe@example.com
        partial:
          type: boolean
          description: |-
            If true, the data will be processed as a partial update. If set, only
            the fields that are present in the data will be updated, and any fields that
            are not present will be left unchanged. The primary ID of the resource
            must always be present in the data.
      required:
      - schema_slug
      - vendor_slug
      - resource_data
    CloudResource:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this CloudResource.
        cloud_resource_type:
          type: string
          description: The type of this CloudResource.
        created_at:
          type: string
          format: date-time
          description: The date this CloudResource was created.
        in_audit_scope:
          type: boolean
          description: Flag to indicate if this CloudResource is in scope.
        out_of_audit_scope_reason:
          type: string
          enum:
          - development_asset
          - staging_asset
          - out_of_scope_production_asset
          description: Out of scope reason if the repository is not in scope.
        region:
          type: string
          description: The region this CloudResource belongs to.
        tags:
          type: array
          items:
            type: string
          description: The tags for this CloudResource.
        third_party_id:
          type: string
          description: The identifier for this CloudResource on the vendor side.
        vendor_name:
          type: string
          description: The name of the vendor that this CloudResource is from.
        updated_at:
          type: string
          format: date-time
          description: The date this CloudResource was last updated.
    Comment:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this comment.
        commentable_id:
          type: string
          format: uuid
          description: The identifier for the commentable object.
        commentable_type:
          type: string
          enum:
          - Company
          - CompanyAudit
          - CompanyAuditTest
          - CompanyControlV2
          - CompanyFrameworkRequirement
          - CompanyTest
          - CompanyRisk
          - Evidence
          - PoamItem
          - CompanySspReportAssessmentObjective
          - CompanySspReportRequirement
          - Policy
          - VendorRiskDetail
          - VendorRiskReviewItem
          - VendorRiskDocument
          - VendorRiskReviewAnswer
          description: The type of the commentable object.
        created_at:
          type: string
          format: date-time
          description: The date when this comment was created.
        content:
          type: string
          description: The content of the comment.
        updated_at:
          type: string
          format: date-time
          description: The date when this comment was updated.
    Control:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this control.
        at_risk_test_count:
          type: integer
          description: The number of associated tests currently at risk of failing.
        author_name:
          type: string
          description: The name of the author if custom, Secureframe otherwise.
        created_at:
          type: string
          format: date-time
          description: The date the control was created.
        custom:
          type: boolean
          description: True if the control is custom, false if it's Secureframe-authored.
        description:
          type: string
          description: The control description.
        disabled_justification:
          type: string
          description: The reason the control was disabled if applicable.
        disabled_test_count:
          type: integer
          description: The number of associated tests that are disabled.
        enabled:
          type: boolean
          description: True if the control is currently enabled.
        failing_test_count:
          type: integer
          description: The number of associated tests currently failing.
        first_failed_at:
          type: string
          format: date-time
          description: The date the control first failed.
        framework_ids:
          type: array
          items:
            type: string
            format: uuid
          description: The IDs of the frameworks that the control is associated with.
        framework_keys:
          type: array
          items:
            type: string
          description: The keys of the frameworks that the control is associated with.
        framework_requirement_keys:
          type: array
          items:
            type: string
          description: The keys of the framework requirements that the control is
            associated with.
        health_status:
          type: string
          description: The overall health of the control.
        implementation_date:
          type: string
          format: date-time
          description: The date when the control is/was to be implemented.
        implementation_status:
          type: string
          description: The current implementation status of the control.
        key:
          type: string
          description: The user-friendly identifier used to reference this control.
        name:
          type: string
          description: The control name.
        owner_assigned_at:
          type: string
          format: date-time
          description: The date the control was assigned to its current owner.
        owner_name:
          type: string
          description: The control owner's name.
        passing_test_count:
          type: integer
          description: The number of associated tests currently passing.
        updated_at:
          type: string
          format: date-time
          description: The date when the control was last updated.
    FrameworkAssetScope:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this framework asset scope.
        active:
          type: boolean
          description: Flag to indicate if this asset is in scope for this framework.
        asset_id:
          type: string
          format: uuid
          description: The identifier of the asset.
        asset_type:
          type: string
          enum:
          - CloudResource
          - CompanyUser
          - CompanyUserVendor
          - Device
          - Evidence
          - ProductionBranch
          - PullRequest
          - Repository
          - Ticket
          - DataPlatform::ResourceData
          description: The type of the asset.
        created_at:
          type: string
          format: date-time
          description: The date the framework asset scope was created.
        framework_id:
          type: string
          format: uuid
          description: The identifier of the framework.
        framework_title:
          type: string
          description: The title of the framework.
        manually_scoped:
          type: boolean
          description: Flag to indicate if this asset is manually scoped.
        manually_scoped_reason:
          type: string
          description: Reason if this asset is manually scoped.
        updated_at:
          type: string
          format: date-time
          description: The date when the framework asset scope was last updated.
    FrameworkRequirement:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this Framework Requirement.
        company_id:
          type: string
          format: uuid
          description: The identifier for the Company.
        created_at:
          type: string
          format: date-time
          description: The date this Framework Requirement was created.
        description:
          type: string
          description: The description of the Framework Requirement.
        enabled:
          type: boolean
          description: Whether this Framework Requirement is enabled.
        health_status:
          type: string
          description: The overall health of the Framework Requirement.
        key:
          type: string
          description: The key of the Framework Requirement.
        name:
          type: string
          description: The name of the Framework Requirement.
        updated_at:
          type: string
          format: date-time
          description: The date this Framework Requirement was updated.
    Framework:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this Framework.
        applicable_controls_count:
          type: integer
          description: The number of applicable controls for this Framework.
        applicable_framework_requirements_count:
          type: integer
          description: The number of applicable framework requirements for this Framework.
        at_risk_test_count:
          type: integer
          description: The number of at risk tests for this Framework.
        created_at:
          type: string
          format: date-time
          description: The date this Framework was created.
        description:
          type: string
          description: The description of the Framework.
        discarded_at:
          type: string
          format: date-time
          description: The date this Framework was discarded.
        disabled_test_count:
          type: integer
          description: The number of non-applicable tests for this Framework.
        failing_test_count:
          type: integer
          description: The number of failing tests for this Framework.
        key:
          type: string
          description: The key of the Framework.
        title:
          type: string
          description: The title of the Framework.
        passing_test_count:
          type: integer
          description: The number of passing tests for this Framework.
        updated_at:
          type: string
          format: date-time
          description: The date this CompanyVendorConnection was updated.
    CompanyRisk:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this CompanyRisk.
        annualized_rate_of_occurrence:
          type: number
          format: float
          description: The annualized rate of occurrence for this CompanyRisk.
        asset_value:
          type: integer
          description: The asset value for this CompanyRisk.
        categories:
          type: array
          items:
            type: string
          description: The categories for this CompanyRisk.
        cia:
          type: array
          items:
            type: string
          description: The CIA for this CompanyRisk.
        departments:
          type: array
          items:
            type: string
          description: The departments for this CompanyRisk.
        description:
          type: string
          description: The description for this CompanyRisk.
        exposure_factor:
          type: number
          format: float
          description: The exposure factor for this CompanyRisk.
        impact_justification:
          type: string
          description: The impact justification for this CompanyRisk.
        likelihood_justification:
          type: string
          description: The likelihood justification for this CompanyRisk.
        notes:
          type: string
          description: The notes for this CompanyRisk.
        reference_url:
          type: string
          description: The reference URL for this CompanyRisk.
        related_tickets:
          type: string
          description: The related tickets for this CompanyRisk.
        reported_by:
          type: string
          description: The reported by for this CompanyRisk.
        residual_impact_justification:
          type: string
          description: The residual impact justification for this CompanyRisk.
        residual_likelihood_justification:
          type: string
          description: The residual likelihood justification for this CompanyRisk.
        responsible_team:
          type: string
          description: The responsible team for this CompanyRisk.
        source:
          type: string
          description: The source for this CompanyRisk.
        status:
          type: string
          description: The status for this CompanyRisk.
        treatment:
          type: string
          description: The treatment for this CompanyRisk.
        treatment_decision_notes:
          type: string
          description: The treatment decision notes for this CompanyRisk.
        uncertainty:
          type: number
          format: float
          description: The uncertainty for this CompanyRisk.
        created_at:
          type: string
          format: date-time
          description: The date this CompanyRisk was created.
        updated_at:
          type: string
          format: date-time
          description: The date this CompanyRisk was updated.
        company_id:
          type: string
          format: uuid
          description: The identifier for the company for this CompanyRisk.
        owner_id:
          type: string
          format: uuid
          description: The identifier for the owner for this CompanyRisk.
        custom_risk_id:
          type: string
          description: The custom risk ID for this CompanyRisk.
    SspDutyRole:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this assignment.
        created_at:
          type: string
          format: date-time
          description: The date this assignment was created.
        ssp_duty_id:
          type: string
          format: uuid
          description: The identifier for the associated SSP duty.
        ssp_report_id:
          type: string
          format: uuid
          description: The identifier for the associated SSP report.
        ssp_role_id:
          type: string
          format: uuid
          description: The identifier for the associated SSP role.
        updated_at:
          type: string
          format: date-time
          description: The date this assignment was last updated.
    SspDuty:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this SSP duty.
        created_at:
          type: string
          format: date-time
          description: The date this duty was created.
        description:
          type: string
          description: The description of the duty.
        duty:
          type: string
          description: The duty name.
        ssp_report_id:
          type: string
          format: uuid
          description: The identifier of the associated SSP report.
        updated_at:
          type: string
          format: date-time
          description: The date this duty was last updated.
    SspRole:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this SSP Role.
        created_at:
          type: string
          format: date-time
          description: The date this role was created.
        description:
          type: string
          description: The description of the role.
        role:
          type: string
          description: The role name.
        ssp_report_id:
          type: string
          format: uuid
          description: The identifier for the associated SSP report.
        updated_at:
          type: string
          format: date-time
          description: The date this role was last updated.
    SspPolicy:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this SSP policy.
        control_id:
          type: string
          format: uuid
          description: The identifier for the associated control.
        created_at:
          type: string
          format: date-time
          description: The date when this SSP policy was created.
        name:
          type: string
          description: The name of the SSP policy.
        owner:
          type: string
          description: The owner of the SSP policy.
        ssp_report_id:
          type: string
          format: uuid
          description: The identifier for the associated SSP report.
        summary:
          type: string
          description: The summary of the SSP policy.
        updated_at:
          type: string
          format: date-time
          description: The date when this SSP policy was updated.
    SspReportAssessmentObjective:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this SSP Report Assessment Objective.
        created_at:
          type: string
          format: date-time
          description: The date this Assessment Objective was created.
        framework_requirement_id:
          type: string
          format: uuid
          description: The identifier for the Framework Requirement.
        implementation_statement:
          type: string
          description: The implementation statement for this Assessment Objective.
        response:
          type: string
          enum:
          - implemented
          - not_applicable
          - no_response
          - partially_implemented
          - poam
          description: The response status for this Assessment Objective.
        ssp_report_id:
          type: string
          format: uuid
          description: The identifier for the associated SSP report.
        ssp_report_requirement_id:
          type: string
          format: uuid
          description: The identifier for the SSP Report Requirement.
        updated_at:
          type: string
          format: date-time
          description: The date this Assessment Objective was last updated.
    SspReportSectionBlock:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this SSP Report Section Block.
        block_key:
          type: string
          description: The semantic key identifying what this block represents.
        block_type:
          type: string
          description: The type of the block (e.g. input, textarea, select, multiselect,
            contacts).
        child_block_ids:
          type: array
          items:
            type: string
          description: The ordered IDs of this block's child blocks.
        required:
          type: boolean
          description: Whether this block is required for section completion.
        ssp_report_id:
          type: string
          format: uuid
          description: The identifier for the associated SSP report.
        ssp_report_section_id:
          type: string
          format: uuid
          description: The identifier for the associated SSP report section.
        value:
          type: object
          description: The current value of the block.
    SspReportSection:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this SSP Report Section.
        created_at:
          type: string
          format: date-time
          description: The date when this SSP Report Section was created.
        description:
          type: string
          description: The description of the SSP Report Section.
        position:
          type: integer
          description: The position of the SSP Report Section.
        section_key:
          type: string
          description: The section key of the SSP Report Section.
        ssp_report_id:
          type: string
          format: uuid
          description: The identifier for the associated SSP report.
        status:
          type: string
          enum:
          - not_started
          - in_progress
          - completed
          description: The status of the SSP Report Section.
        title:
          type: string
          description: The title of the SSP Report Section.
        updated_at:
          type: string
          format: date-time
          description: The date when this SSP Report Section was last updated.
    SspReport:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this SSP Report.
        completion_progress_percentage:
          type: integer
          description: The completion progress percentage of the SSP Report.
        created_at:
          type: string
          format: date-time
          description: The date the SSP Report was created.
        framework_id:
          type: string
          format: uuid
          description: The identifier of the associated Framework.
        name:
          type: string
          description: The name of the SSP Report.
        sprs_score:
          type: integer
          description: The SPRS score of the SSP Report.
        updated_at:
          type: string
          format: date-time
          description: The date the SSP Report was last updated.
    SspVendor:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this SSP vendor.
        categories:
          type: array
          items:
            type: string
            enum:
            - cui_asset
            - security_protection_asset
            - contractor_risk_management_asset
            - specialized_asset
            - out_of_scope_asset
          description: The asset categories for the SSP vendor.
        created_at:
          type: string
          format: date-time
          description: The date the SSP vendor was created.
        name:
          type: string
          description: The name of the SSP vendor.
        purpose:
          type: string
          description: The purpose of the SSP vendor.
        ssp_report_id:
          type: string
          format: uuid
          description: The identifier for the associated SSP report.
        updated_at:
          type: string
          format: date-time
          description: The date the SSP vendor was last updated.
        vendor_risk_detail_id:
          type: string
          format: uuid
          description: The identifier of the linked Vendor Risk Detail.
        vendor_type:
          type: string
          enum:
          - on_prem
          - csp
          - msp_mspp
          - other
          description: The vendor type for the SSP vendor.
        website:
          type: string
          description: The website of the SSP vendor.
    Test:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this test.
        control_ids:
          type: array
          items:
            type: string
            format: uuid
          description: The IDs of the controls that the test is associated with.
        control_keys:
          type: array
          items:
            type: string
          description: The keys of the controls that the test is associated with.
        created_at:
          type: string
          format: date-time
          description: The date when this test was created.
        custom:
          type: boolean
          description: True if the test is custom (user generated), false if it's
            Secureframe-authored.
        description:
          type: string
          description: The description for the test.
        detailed_remediation_steps:
          type: string
          description: Guidance for remediating this test in the event it fails.
        disabled_justification:
          type: string
          description: Reason for disabling the test.
        enabled:
          type: boolean
          description: True if the test is currently enabled.
        enabled_field_updated_by_user_name:
          type: string
          description: The name of the user who enabled the test, null if wasn't enabled
            by a user.
        failure_message:
          type: string
          description: The message to be displayed if the test fails.
        first_failed_at:
          type: string
          format: date-time
          description: The date the test first failed.
        framework_ids:
          type: array
          items:
            type: string
            format: uuid
          description: The IDs of the frameworks that the test is associated with.
        framework_keys:
          type: array
          items:
            type: string
          description: The keys of the frameworks that the test is associated with.
        health_status:
          type: string
          description: The overall health of the test.
        key:
          type: string
          description: The user-friendly identifier used to reference this test.
        last_evaluated:
          type: string
          format: date-time
          description: The date the test was last evaluated at.
        last_passed_at:
          type: string
          format: date-time
          description: The date the test last had a passing evaluation.
        next_due_date:
          type: string
          format: date-time
          description: The date new test evidence is needed by if applicable.
        owner_assigned_at:
          type: string
          format: date-time
          description: The date the test owner was assigned.
        owner_name:
          type: string
          description: The test owner's name.
        pass:
          type: boolean
          description: True if the test is passing, false otherwise.
        passed_with_upload:
          type: boolean
          description: True if the test passed from the existence of an upload, false
            otherwise.
        passed_with_upload_justification:
          type: string
          description: The justification used on evidence upload to pass the test
            if applicable.
        promote_at:
          type: string
          format: date-time
          description: The current date set for implementation of the test.
        promoted_by_name:
          type: string
          description: The name of the user who set the implementation date.
        recommended_action:
          type: string
          description: Actions for completing the test.
        required_implementation_date:
          type: string
          format: date-time
          description: The pre-configured date the test must be implemented by.
        resource_category:
          type: string
          description: The category the test resource belongs to.
        test_domain:
          type: string
          description: The domain the test belongs to.
        test_function:
          type: string
          description: The purpose of the test.
        test_interval_seconds:
          type: integer
          description: The interval in which test evidence should be collected if
            applicable.
        test_type:
          type: string
          enum:
          - upload
          - integration
          - platform
          description: The type of test.
        title:
          type: string
          description: The test title.
        tolerance_window_seconds:
          type: integer
          description: The time between the test interval elapsing and evidence becoming
            stale and test failing if applicable.
        updated_at:
          type: string
          format: date-time
          description: The date the test was last updated.
        vendor_name:
          type: string
          description: The vendor name associated with the test if applicable.
    User:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this user.
        access_role:
          type: string
          description: The user's access role in the system.
        active:
          type: boolean
          description: True if the user's account is active, false if it has been
            deactivated.
        active_source:
          type: string
          description: The integration the active status was sourced from.
        created_at:
          type: string
          format: date-time
          description: The date when this user account was created.
        department_id:
          type: string
          description: The identifier of the department the user belongs to.
        email:
          type: string
          description: The user's email.
        employee_type:
          type: string
          enum:
          - contractor
          - employee
          - non_employee
          - auditor
          - external
          - workspace
          description: The type of employee (contractor, employee, non-employee etc).
        end_date:
          type: string
          format: date-time
          description: The date of the user's termination if applicable.
        first_name:
          type: string
          description: The user's first name.
        image_url:
          type: string
          description: The user's icon image URL.
        in_audit_scope:
          type: boolean
          description: True if this user is in scope for being audited, false if they
            are exempt.
        invited:
          type: boolean
          description: True if an invitation to Secureframe has been sent to the user's
            email, false otherwise.
        invited_at:
          type: string
          format: date-time
          description: The date the user was invited.
        last_name:
          type: string
          description: The user's last name.
        manager_name:
          type: string
          description: The name of the user's manager if applicable, null otherwise.
        middle_name:
          type: string
          description: The user's middle name.
        name:
          type: string
          description: The first and last name of the user separated by a space.
        onboarding_status:
          type: string
          description: The current onboarding status of the user.
        personnel_status:
          type: string
          description: The current personnel status of the user.
        preferred_first_name:
          type: string
          description: The user's preferred first name if applicable, null otherwise.
        role:
          type: string
          description: The user's role at the company.
        secureframe_agent_acknowledged_at:
          type: string
          format: date-time
          description: The date the user completed installation of the Secureframe
            device agent.
        start_date:
          type: string
          format: date-time
          description: The date the user started employment at the company.
        title:
          type: string
          description: The user's job title.
        updated_at:
          type: string
          format: date-time
          description: The date this user account was last updated.
    UserAccount:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this UserAccount.
        active:
          type: boolean
          description: Flag to indicate if this is an active user account on the vendor
            side. Defaults to true if the vendor does not support or provide this
            value.
        created_at:
          type: string
          format: date-time
          description: The date this UserAccount was created.
        email:
          type: string
          description: The email received from the connection.
        first_name:
          type: string
          description: The first name of the user received from the connection.
        has_user:
          type: boolean
          description: Flag to indicate if this UserAccount has a User. False indicates
            that it's an unlinked account.
        last_name:
          type: string
          description: The last name of the user received from the connection.
        third_party_id:
          type: string
          description: The identifier for this UserAccount on the vendor side.
        username:
          type: string
          description: The user name of the UserAccount on the vendor side.
        vendor_name:
          type: string
          description: The name of the vendor that this UserAccount is from.
        updated_at:
          type: string
          format: date-time
          description: The date this UserAccount was last updated.
    IntegrationConnection:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this IntegrationConnection.
        name:
          type: string
          description: The name of the IntegrationConnection if applicable.
        status:
          type: string
          enum:
          - connected
          - disabled
          - not_connected
          - pending
          description: The status of the IntegrationConnection.
        vendor_name:
          type: string
          description: The name of the vendor for this IntegrationConnection.
        updated_at:
          type: string
          format: date-time
          description: The date this IntegrationConnection was last updated.
    Vendor:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this Vendor.
        archived:
          type: boolean
          description: Flag to indicate if this Vendor is archived.
        archived_at:
          type: string
          format: date-time
          description: The date this Vendor was archived (if it is archived).
        archived_by:
          type: string
          format: uuid
          description: The identifier of the User that archived this Vendor (if it
            is archived).
        audit_scopes:
          type: array
          items:
            type: string
          description: The audit scopes for this Vendor.
        authentication_type:
          type: string
          enum:
          - password
          - single_sign_on
          description: The authentication type for this Vendor.
        data_collected:
          type: string
          description: The data collected for this Vendor.
        date_of_engagement:
          type: string
          format: date-time
          description: The date of engagement for this Vendor.
        domain:
          type: string
          description: The domain of the Vendor.
        environment_types:
          type: array
          items:
            type: string
            enum:
            - production
            - development
          description: The environment types for this Vendor.
        last_reviewed_at:
          type: string
          format: date-time
          description: The date this Vendor was last reviewed.
        name:
          type: string
          description: The name of the Vendor.
        operational_reliance:
          type: string
          description: The operational reliance for this Vendor.
        other_information:
          type: string
          description: Other information for this Vendor.
        owner_id:
          type: string
          format: uuid
          description: The identifier of the User that is the owner for this Vendor.
        risk_level:
          type: string
          enum:
          - high
          - medium
          - low
          description: The risk level for this Vendor.
        security_url:
          type: string
          description: The security URL for this Vendor.
        services:
          type: string
          description: The services provided by this Vendor.
        terminated_at:
          type: string
          format: date-time
          description: The date this Vendor was terminated (if it is archived).
        third_party_audit_report_concerns:
          type: string
          description: The third party audit report concerns for this Vendor.
        two_factor_enabled:
          type: boolean
          description: Flag to indicate if two factor is enabled for this Vendor.
        updated_at:
          type: string
          format: date-time
          description: The date this Vendor was last updated.
    Device:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this Device.
        created_at:
          type: string
          format: date-time
          description: The date this Device object was created.
        cpu:
          type: string
          description: The cpu info available for this Device.
        device_name:
          type: string
          description: The name of the Device.
        hard_drive_encrypted:
          type: boolean
          description: Flag to indicate if the hard drive is encrypted.
        in_audit_scope:
          type: boolean
          description: Flag to indicate if this Device is in scope.
        last_checkin_at:
          type: string
          format: date-time
          description: The date this Device last checked in.
        local_firewall_enabled:
          type: boolean
          description: Flag to indicate if the local firewall is enabled.
        mac_address:
          type: string
          description: The MAC address of the Device.
        make:
          type: string
          description: The make of the Device.
        memory:
          type: string
          description: The memory of the Device.
        model:
          type: string
          description: The model of the Device.
        native_anti_virus_enabled:
          type: boolean
          description: Flag to indicate if the native antivirus is enabled.
        os:
          type: string
          description: The operating system of the Device.
        out_of_audit_scope_reason:
          type: string
          enum:
          - development_asset
          - staging_asset
          - out_of_scope_production_asset
          description: Out of scope reason if the Device is not in scope.
        password_enforcement_enabled:
          type: boolean
          description: Flag to indicate if password enforcement is enabled.
        remote_ip:
          type: string
          description: The remote IP of the Device.
        serial_number:
          type: string
          description: The serial number of the Device.
        session_timeout_enabled:
          type: boolean
          description: Flag to indicate if session timeout is enabled.
        updated_at:
          type: string
          format: date-time
          description: The date this Device was last updated.
    Evidence:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this Evidence.
        accepted:
          type: boolean
          description: Flag to indicate if this Evidence has been accepted.
        activity_completion:
          type: string
          format: date
          description: The date the activity was completed
        created_at:
          type: string
          format: date-time
          description: The date this Evidence was created.
        document_id:
          type: string
          format: uuid
          description: The identifier of the Document this Evidence was uploaded from.
        evidence_type:
          type: string
          enum:
          - accepted_policies
          - access_change_ticket
          - access_key_management_cloud_service_provider
          - access_request_forms
          - access_review
          - access_termination_forms
          - access_termination_ticket
          - account_lockout_cloud_services
          - account_lockout_duration_cloud_services
          - administrative_access_encryption
          - alerting_cloud_infrastructure
          - alerting_web_application
          - anti_malware
          - anti_malware_scans
          - anti_malware_server_endpoints
          - anti_spoofing
          - approved_scanning_vendor
          - architecture_diagram
          - asset_inventory_cloud_service_provider
          - asset_inventory_cloud_service_provider_owners
          - asset_inventory_removable_media
          - asset_inventory_user_endpoint_owners
          - asset_inventory_user_endpoint_screenshot
          - asset_inventory_user_endpoints
          - asset_inventory_version_control_repositories
          - asset_inventory_version_control_repository_owners
          - asset_inventory_wireless_access_points
          - asset_review
          - audit_evidence
          - authentication_and_encryption_configurations
          - authentication_credentials
          - autoscaling_cloud_service_providers
          - availability_zones_cloud_service_providers
          - background_check_report
          - background_check_report_unassigned
          - backup_restoration_template
          - backup_restoration_test_cloud_datastores
          - backup_retention_cloud_datastores
          - backup_schedule_cloud_datastores
          - baseline_configurations_cloud_service_providers
          - board_of_directors_bylaws
          - board_of_directors_meeting_minutes
          - board_of_directors_members
          - branch_access_restriction
          - bug_ticket_resolved
          - business_continuity_and_disaster_recovery_tabletop_exercise
          - business_impact_analysis
          - business_objective_document
          - card_reading_devices_inspection
          - card_reading_devices_inventory
          - card_reading_devices_training
          - career_page
          - ccpa_training_screenshot
          - centralized_repository_cryptographic_keys
          - cloud_infrastructure_users_export
          - cloud_report
          - cloud_resources_export
          - cloud_resource_inventory_export
          - cloud_services_screenshot
          - code_change_ticket
          - common_vulnerability_scan_result
          - company_ssp_report_section_block_attachment
          - company_ssp_report_assessment_objecttive
          - company_updates_page
          - compliance_and_regulation_inventory
          - compliance_report_hipaa
          - confidentiality_agreement
          - confidentiality_agreement_customers
          - confidentiality_agreement_vendors
          - configuration_change_ticket
          - configurations_for_obfuscating_sensitive_data
          - continuous_integration
          - contract_business_associate_agreement
          - contract_business_associate_subcontractor_agreement
          - contractors_export
          - controls_export
          - corrective_action_report
          - critical_change_communication
          - current_employees_export
          - custom
          - customer_notice_pci_dss
          - cybersecurity_insurance
          - data_disposal_log
          - data_flow_diagram
          - data_loss_prevention_alert_business_suite
          - data_disposal_prevention_business_suite
          - data_retention_requirements
          - database_backups
          - default_config_removal_cloud_services
          - default_config_removal_wireless_networks
          - detected_applications_export
          - development_dummy_data
          - devices_export
          - device_inventory_export
          - device_management_screenshot
          - devices_management_report
          - dast_scan
          - dynamic_application_security_testing_post_change
          - encryption_at_rest_cloud_datastores
          - encryption_at_rest_user_endpoints
          - encryption_in_transit_datastores
          - encryption_in_transit_web_application
          - encryption_keys
          - environment_segregation
          - file_integrity_monitoring_software
          - firewall_and_router_configuration_changes
          - firewall_cloud_service_provider
          - firewall_ruleset_cloud_service_provider
          - firewall_user_endpoints
          - firewall_web_application
          - framework_controls_export
          - framework_test_evidence_export
          - framework_tests_export
          - framework_isms_statement_of_applicability_export
          - gdpr_training_screenshot
          - generic_evidence
          - handling_cui_training_screenshot
          - help_desk_customers
          - hipaa_training_screenshot
          - ids_ips_configurations
          - incident_24_7_personnel
          - incident_response_tabletop_exercise
          - industry_membership
          - information_security_certification
          - intellectual_property_rights_inventory
          - internal_audit
          - internal_communications
          - internal_control_matrix_owners
          - interview_notes
          - isms_scope
          - isms_statement_of_applicability
          - job_descriptions
          - kpi_document
          - lessons_learned
          - log_retention_cloud_infrastructure
          - logging_cloud_infrastructure
          - logging_web_application
          - logical_access
          - master_service_agreement
          - mfa_business_suite
          - mfa_cloud_service_provider
          - mfa_human_resources_system
          - mfa_sso
          - mfa_version_control
          - minimum_password_age_cloud_services
          - monitoring_cloud_infrastructure
          - monitoring_web_application
          - nat_translation
          - network_configuration_changes
          - network_configurations_cloud_service_provider
          - network_configurations_wireless_settings
          - onboarding_ticket
          - organization_chart
          - organization_chart_distribution
          - oscal_diff
          - other
          - pan_details
          - password_age
          - password_complexity_business_suite
          - password_complexity_cloud_service_provider
          - password_complexity_human_resources_system
          - password_complexity_sso
          - password_complexity_version_control
          - password_creation
          - password_manager_screenshot
          - password_policy_screenshot
          - password_reuse_prevention_cloud_services
          - password_validation
          - patching_cloud_service_provider
          - pci_secure_code_training_screenshot
          - pci_training_screenshot
          - penetration_test_and_asv_scan
          - penetration_test_report
          - penetration_test_report_post_change
          - performance_review
          - personnel_export
          - poam_attachments
          - poam_items_export
          - policy_export
          - policy_review_calendar_invite
          - policy_review_meeting_minutes
          - privacy_policy
          - privacy_policy_last_updated
          - proprietary_software_products_inventory
          - rbac_matrix
          - recent_logging_activity
          - repositories_export
          - resume
          - review_findings_export
          - review_firewall_rules
          - review_verification_pci_dss
          - risk
          - risk_assessment
          - risk_assessment_answers_export
          - risk_assessment_vendors
          - risk_export
          - risk_register
          - risk_register_export
          - risk_register_snapshot_export
          - risk_treatment_plan
          - roles_and_responsibilities
          - route_table_screenshot
          - secure_certificate_and_trusted_keys
          - security_awareness_training
          - security_committee_meeting_minutes
          - security_control_failures
          - security_email
          - security_feature
          - security_incident_log
          - security_incident_ticket
          - security_incident_ticket_resolved
          - security_objective_document
          - security_review
          - security_training_screenshot
          - security_training_new_hire_screenshot
          - security_training_export
          - security_update_user_endpoints
          - security_web_page
          - sensitive_authentication_data_deleted
          - sensitive_authentication_data_not_stored
          - server_primary_function
          - service_contract
          - service_contract_pci_dss
          - session_timeout_cloud_services
          - session_timeout_user_endpoints
          - shared_accounts
          - sla
          - special_interest_group
          - ssh_key_management_cloud_service_provider
          - ssl_certificate
          - ssp_policy
          - system_description
          - system_installation
          - system_service
          - system_software_test
          - table_view
          - tabletop_exercise_bcdr
          - terminated_employees_export
          - terms_of_service
          - terms_of_service_last_updated
          - test_data_and_accounts
          - test_export
          - testing_wireless_access_points
          - third_party_accounts
          - third_party_anti_malware_endpoints
          - third_party_anti_malware_updates_endpoints
          - threat_detection_cloud_infrastructure
          - tickets_export
          - unique_password_authentication
          - unreadable_pan
          - user_access_review_accounts_export
          - user_identification
          - users_business_suite
          - users_cloud_service_provider
          - users_communication_tool
          - users_human_resources_system
          - users_mdm
          - users_password_manager
          - users_sso
          - users_version_control
          - vendor_access_list_export
          - vendor_risk
          - vendors_approved
          - vendors_export
          - vendor_risk_register_export
          - vendor_risk_register_snapshot_export
          - vendor_risk_review_answers_export
          - version_control_code_change_ticket
          - version_control_code_dependency_testing
          - version_control_code_pull_request_independent_approval_ticket
          - version_control_code_pull_request_template
          - version_control_code_static_application_security_testing
          - version_control_users_export
          - version_control_vendor
          - vulnerability_scanning_cloud_infrastructure
          - vulnerability_scanning_cloud_infrastructure_post_change
          - vulnerability_ticket
          - wireless_encryption
          - trust_center_nda_acceptances
          - editor_image
          description: The type of this Evidence.
        evidenceable_id:
          type: string
          format: uuid
          description: The identifier of the resource this Evidence is associated
            with.
        evidenceable_type:
          type: string
          enum:
          - Company
          - CompanyUser
          - CompanySspPolicy
          description: The type of resource this Evidence is associated with.
        updated_at:
          type: string
          format: date-time
          description: The date this Evidence was updated.
        vendor_id:
          type: string
          format: uuid
          description: The identifier of the Vendor associated with this Evidence.
    FileUpload:
      type: object
      properties:
        id:
          type: string
          description: The identifier to redeem at an endpoint that accepts an upload.
        url:
          type: string
          description: The URL to PUT the file's raw bytes to.
        headers:
          type: object
          description: Headers that must be sent verbatim on the PUT.
        url_expires_at:
          type: string
          format: date-time
          description: 'The deadline for the PUT: after this, `url` stops being accepted.'
        id_expires_at:
          type: string
          format: date-time
          description: The deadline for redeeming `id` as an `upload_id` at an attaching
            endpoint. Later than `url_expires_at`, so an upload whose bytes have already
            landed stays attachable after the URL is dead.
        created_at:
          type: string
          format: date-time
          description: The date this File Upload was created.
        updated_at:
          type: string
          format: date-time
          description: The date this File Upload was last updated. File Uploads are
            immutable, so this always equals `created_at`.
      description: |-
        A File Upload is write-only and single-use: it is returned once, redeemed once, and there is
        no endpoint to fetch one back.
    KnowledgeBaseAnswer:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this knowledge base answer.
        content:
          type: string
          description: The content of the knowledge base answer.
        created_at:
          type: string
          format: date-time
          description: The date this knowledge base answer was created.
        primary_answer:
          type: boolean
          description: Flag to indicate if this is the primary answer.
        type:
          type: string
          enum:
          - KnowledgeBaseAnswerFreeForm
          - KnowledgeBaseAnswerYesOrNo
          - KnowledgeBaseAnswerTrueOrFalse
          description: The type of the knowledge base answer.
        updated_at:
          type: string
          format: date-time
          description: The date this knowledge base answer was updated.
    KnowledgeBaseQuestion:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this knowledge base question.
        content:
          type: string
          description: The content of the knowledge base question.
        created_at:
          type: string
          format: date-time
          description: The date this knowledge base question was created.
        manual_review_requested:
          type: boolean
          description: Flag to indicate if a manual review of the knowledge base question
            is requested.
        review_frequency:
          type: number
          description: The frequency of the review of the knowledge base question.
        reviewed_at:
          type: string
          format: date-time
          description: The date this knowledge base question was reviewed.
        updated_at:
          type: string
          format: date-time
          description: The date this knowledge base question was updated.
    PoamItem:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this POAM item.
        created_at:
          type: string
          format: date-time
          description: The date when this POAM item was created.
        discarded_at:
          type: string
          format: date-time
          description: The date when this POAM item was discarded, if any.
        due_date:
          type: string
          format: date
          description: The due date of the POAM item.
        estimated_completion_date:
          type: string
          format: date
          description: The estimated completion date of the POAM item.
        identifier:
          type: string
          description: The identifier of the POAM item.
        issue:
          type: string
          description: The issue describing the POAM item.
        owner_id:
          type: string
          format: uuid
          description: The ID of the user who owns this POAM item.
        remediation_plan:
          type: string
          description: The remediation plan for the POAM item.
        risk_level:
          type: string
          enum:
          - low
          - medium
          - high
          description: The risk level of the POAM item.
        status:
          type: string
          enum:
          - draft
          - in_progress
          - closed
          description: The status of the POAM item.
        updated_at:
          type: string
          format: date-time
          description: The date when this POAM item was last updated.
    PolicyDetail:
      allOf:
      - "$ref": "#/components/schemas/Policy"
      - type: object
        properties:
          content:
            type: string
            description: The body of this Policy, with tokens such as {{company_name}}
              left unresolved.
          has_content:
            type: boolean
            description: Whether this Policy has body content. False for Policies
              supplied only as an uploaded document.
          interpolated_content:
            type: string
            description: The body of this Policy with every token resolved. This is
              what the Secureframe app displays.
          documents:
            type: array
            items:
              type: object
              properties:
                id:
                  type: string
                  format: uuid
                filename:
                  type: string
                content_type:
                  type: string
                byte_size:
                  type: integer
                download_url:
                  type: string
            description: The files attached to this Policy. Each download_url is signed
              and expires five minutes after the response is generated.
    Policy:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this Policy.
        acceptance_rate:
          type: number
          format: float
          description: The percentage of eligible personnel who have accepted this
            Policy.
        acceptance_status:
          type: string
          enum:
          - pending
          - completed
          description: Whether every eligible person has accepted this Policy. Null
            when nobody is eligible.
        acceptances_count:
          type: integer
          description: The number of eligible personnel who have accepted this Policy.
        addendum:
          type: boolean
          description: Whether this Policy is an addendum to another Policy.
        company_id:
          type: string
          format: uuid
          description: The identifier for the company for this Policy.
        created_at:
          type: string
          format: date-time
          description: The date this Policy was created.
        eligible_company_users_count:
          type: integer
          description: The number of personnel required to accept this Policy.
        framework_names:
          type: array
          items:
            type: string
          description: The frameworks this Policy was authored for.
        groups:
          type: array
          items:
            type: string
          description: The personnel groups this Policy is assigned to.
        name:
          type: string
          description: The name of this Policy.
        owner_id:
          type: string
          format: uuid
          description: The identifier for the owner for this Policy.
        parent_policy_id:
          type: string
          format: uuid
          description: The identifier of the Policy this Policy is an addendum to.
        published_at:
          type: string
          format: date-time
          description: The date this Policy was published.
        read_only:
          type: boolean
          description: Whether this Policy is informational and requires no acceptance.
        status:
          type: string
          description: The status of this Policy.
        tags:
          type: array
          items:
            type: string
          description: The categories this Policy belongs to.
        updated_at:
          type: string
          format: date-time
          description: The date this Policy was updated.
    Repository:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this Repository.
        created_at:
          type: string
          format: date-time
          description: The date this Repository object was created.
        name:
          type: string
          description: The name of the Repository.
        in_audit_scope:
          type: boolean
          description: Flag to indicate if this Repository is in scope.
        out_of_audit_scope_reason:
          type: string
          enum:
          - development_asset
          - staging_asset
          - out_of_scope_production_asset
          description: Out of scope reason if the repository is not in scope.
        private:
          type: boolean
          description: Flag to indicate if this Repository is private.
        third_party_id:
          type: string
          description: The identifier for this Repository on the vendor side.
        vendor_name:
          type: string
          description: The name of the vendor that this Repository is from.
        updated_at:
          type: string
          format: date-time
          description: The date this Repository was last updated.
    SecurityQuestionnaire:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this Security Questionnaire.
        company_name:
          type: string
          description: The name of the client who is requesting the questionnaire
        company_url:
          type: string
          description: The URL of the client who is requesting the questionnaire
        contact_email_at_company:
          type: string
          description: The email of the contact at the client who is requesting the
            questionnaire
        contact_name_at_company:
          type: string
          description: The name of the contact at the client who is requesting the
            questionnaire
        created_at:
          type: string
          format: date-time
          description: The date when this Security Questionnaire was created.
        due_date:
          type: string
          format: date-time
          description: The due date of the questionnaire
        questionnaire_template:
          type: string
          enum:
          - custom
          - caiq
          - hecvat
          - hecvat_lite
          - sig
          - sig_lite
          - ccpa
          - cis
          - nist
          - vsa
          - pci_dss
          description: The template of the questionnaire
        questionnaire_type:
          type: string
          enum:
          - pending
          - complete
          - training
          description: The type of questionnaire
        state:
          type: string
          description: The state of the Security Questionnaire
        updated_at:
          type: string
          format: date-time
          description: The date this Security Questionnaire was last updated
    Task:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this Task.
        auto_close:
          type: boolean
          description: Whether this Task closes itself once its underlying work is
            done.
        category:
          type: string
          description: The category this Task belongs to.
        completed_at:
          type: string
          format: date-time
          description: The date this Task was completed.
        created_at:
          type: string
          format: date-time
          description: The date this Task was created.
        creator_id:
          type: string
          format: uuid
          description: The identifier for the creator for this Task.
        description:
          type: string
          description: The description of this Task.
        dismissed_at:
          type: string
          format: date-time
          description: The date this Task was dismissed.
        due_at:
          type: string
          format: date-time
          description: The date this Task is due.
        optional:
          type: boolean
          description: Whether this Task is optional.
        overdue:
          type: boolean
          description: Whether this Task is past its due date and not yet completed.
        owner_id:
          type: string
          format: uuid
          description: The identifier for the owner for this Task.
        task_subtype:
          type: string
          description: The subtype of this Task. Empty for standard Tasks.
        task_type:
          type: string
          description: The type of this Task.
        taskable_id:
          type: string
          format: uuid
          description: The identifier for the taskable for this Task.
        taskable_type:
          type: string
          enum:
          - CompanyTest
          - CompanyRisk
          - UserAccessReviewAccount
          - VendorRiskDetail
          description: The type of resource this Task is associated with.
        title:
          type: string
          description: The title of this Task.
        updated_at:
          type: string
          format: date-time
          description: The date this Task was updated.
    TestExport:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this Text Export.
        created_at:
          type: string
          format: date-time
          description: The date when this Test Export was created.
        status:
          type: string
          enum:
          - pending
          - complete
          - failed
          description: The progress status of the Test export.
        url:
          type: string
          description: The URL to download the file.
        updated_at:
          type: string
          format: date-time
          description: The date this Text Export was last updated
    TrustCenterRequest:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this trust center request.
        company_name:
          type: string
          description: The company name of the requester.
        created_at:
          type: string
          format: date-time
          description: The date this trust center request was created.
        document_security:
          type: string
          enum:
          - clickwrap
          - external
          - waived
          description: The document security level for this trust center request.
        requester_name:
          type: string
          description: The full name of the requester.
        job_title:
          type: string
          description: The job title of the requester.
        reason:
          type: string
          description: The reason for this trust center request.
        resources:
          type: array
          items:
            type: string
          description: The names of the resources requested.
        reviewed:
          type: boolean
          description: True if this trust center request was reviewed.
        updated_at:
          type: string
          format: date-time
          description: The date this trust center request was updated.
        email:
          type: string
          description: The email address of the requester.
        trust_center_resource_requests:
          type: array
          items:
            "$ref": "#/components/schemas/TrustCenterResourceRequest"
          description: The trust center resource requests associated with this trust
            center request.
    TrustCenterResourceRequest:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this trust center resource request.
        approved_at:
          type: string
          format: date-time
          description: The date this trust center resource request was approved.
        trust_center_resource:
          "$ref": "#/components/schemas/TrustCenterResource"
    TrustCenterResource:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this trust center resource.
        description:
          type: string
          description: The description of the resource.
        name:
          type: string
          description: The name of the resource.
        nda_required:
          type: boolean
          description: Whether an NDA is required to access this resource.
        resource_type:
          type: string
          enum:
          - compliance_item
          - other_document
          - link
          description: The type of resource.
    UserSecuritySetting:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this User Security Setting.
        company:
          type: object
          description: The company associated with this User Security Setting. Fields
            include id, name.
        created_at:
          type: string
          format: date-time
          description: The date this User Security Setting object was created.
        schema_version:
          type: integer
          description: The schema version of the User Security Setting.
        settings:
          type: object
          description: JSON representation of the settings for this User Security
            Setting. Fields include user_session_timeout_ms, user_session_timeout,
            roles.
        updated_at:
          type: string
          format: date-time
          description: The date this User Security Setting object was updated.
    VendorRiskDetail:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: The identifier for this Vendor.
        archived:
          type: boolean
          description: Flag to indicate if this Vendor is archived.
        archived_at:
          type: string
          format: date-time
          description: The date this Vendor was archived.
        authentication_type:
          type: string
          enum:
          - password
          - sso
          - n_a
          description: The authentication type for this Vendor.
        created_at:
          type: string
          format: date-time
          description: The date this Vendor was created.
        data_collected:
          type: string
          description: The data collected for this Vendor.
        environment_types:
          type: array
          items:
            type: string
          description: The environments for this Vendor.
        last_reviewed_at:
          type: string
          format: date-time
          description: The date this Vendor was last reviewed.
        name:
          type: string
          description: The name of the Vendor.
        other_information:
          type: string
          description: Other information for this Vendor.
        owner_id:
          type: string
          format: uuid
          description: The identifier of the User that is the owner for this Vendor.
        risk_level:
          type: string
          description: The risk level for this Vendor.
        security_url:
          type: string
          description: The security URL for this Vendor.
        services_provided:
          type: string
          description: The services provided by this Vendor.
        third_party_audit_report_concerns:
          type: string
          description: The third party audit report concerns for this Vendor.
        two_factor_enabled:
          type: boolean
          description: Flag to indicate if two factor is enabled for this Vendor.
        updated_at:
          type: string
          format: date-time
          description: The date this Vendor was last updated.
        vendor_status:
          type: string
          enum:
          - accepted
          - rejected
          - pending
          description: The status of the Vendor.
        vendor_risk_subassessment_responses:
          type: array
          items:
            "$ref": "#/components/schemas/VendorRiskSubassessmentResponse"
          description: The assesments for each risk subcategory.
        website:
          type: string
          description: The website of the Vendor.
    VendorRiskSubassessmentResponse:
      type: object
      properties:
        id:
          type: string
          format: uuid
          description: Subassesment response id.
        name:
          type: string
          description: The name for the subassessment.
        description:
          type: string
          description: The description for the subassessment.
        risk_level:
          type: string
          description: The risk level assigned to this subassessment.
        tprm_vendor_id:
          type: string
          format: uuid
          description: The vendor risk details id.
  securitySchemes:
    header_authorization:
      type: apiKey
      name: Authorization
      in: header
x-tagGroups:
- name: Endpoints
  tags:
  - Cloud Resource
  - Cloud Resource Framework Asset Scope
  - Comment
  - Control
  - Custom Integration
  - Device
  - Device Framework Asset Scope
  - Evidence
  - File Upload
  - Framework
  - Framework Requirement
  - Integration Connection
  - Knowledge Base Answer
  - Knowledge Base Question
  - POA&M Item
  - Policy
  - Repository
  - Repository Framework Asset Scope
  - Risk
  - SSP Duty
  - SSP Duty Role
  - SSP Policy
  - SSP Report
  - SSP Report Assessment Objective
  - SSP Report Section
  - SSP Report Section Block
  - SSP Role
  - SSP Vendor
  - Security Questionnaire
  - Task
  - Test
  - Test Evidence
  - Test Export
  - Test Export Reading
  - Third Party Risk Management Vendor
  - Trust Center Request
  - User
  - User Account
  - User Evidence
  - User Security Settings
  - Vendor