List a project’s in-scope controls

Description

Return a paginated collection of the controls in a project’s scope. By default only in-scope controls are returned; filter with $filter=scopeStatus eq 'removedFromScope' to see controls that have been removed from scope.

GET /assuranceProjects/{id}/scopedControls

Required OAuth Scopes

grc:read

Parameters

Parameter	In	Type	Required	Description
X-Version	header	string	true	Version of the API (2026-09-01.grc.preview)
$maxpagesize	query	integer(int32)	false	Maximum number of items to return in a single page. The service applies a default and a maximum; requests above the maximum are clamped.
$next	query	string	false	Opaque cursor identifying the next page of results, taken from the previous page. Omit on the first request.
$filter	query	string	false	Filter expression restricting the collection, of the form field <op> value. Comparison operators are eq, in, and contains, composed with the logical connectives and, or, and not (negation is expressed as not (field eq value) — there is no ne). The set of filterable fields and supported operators varies per resource. Example: significance eq 'key'.
$orderBy	query	string	false	Sort criteria of the form `field [asc
Wk-Workspace	header	string	true	The id of the Workiva workspace to operate in. Authorization is enforced against the authenticated user’s access within this workspace.
id	path	string	true	The unique system identifier of the resource.

Filter Options

Available logical operators: and, or, not

Name	Predicates Supported
control.controlId	eq, contains
id	eq, in
scopeStatus	eq

Sorting Options

Name	Orders Supported
scopeStatus	asc, desc

Code Samples

curl

curl -X GET https://api.app.wdesk.com/assuranceProjects/{id}/scopedControls \
    -H 'Accept: application/json' \
    -H 'Wk-Workspace: 1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d' \
    -H 'Authorization: Bearer {access-token}' \
    -H 'X-Version: 2026-09-01.grc.preview'

httpie

http GET https://api.app.wdesk.com/assuranceProjects/{id}/scopedControls \
    X-Version:2026-09-01.grc.preview \
    Accept:application/json \
    Wk-Workspace:1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d \
    Authorization:"Bearer {access-token}"

wget

wget --method=GET "https://api.app.wdesk.com/assuranceProjects/{id}/scopedControls" \
    --output-document - \
    --header 'Accept: application/json' \
    --header 'Wk-Workspace: 1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d' \
    --header 'Authorization: Bearer {access-token}' \
    --header 'X-Version: 2026-09-01.grc.preview'

python

import requests

headers = {
  'X-Version': '2026-09-01.grc.preview',
  'Accept': 'application/json',
  'Wk-Workspace': '1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d',
  'Authorization': 'Bearer {access-token}'
}

r = requests.get('https://api.app.wdesk.com/assuranceProjects/{id}/scopedControls', headers = headers)

print(r.json())

Returns

200 - A paginated collection of scoped controls.

A collection of a project’s scoped controls.

400 - The request was invalid.

Error response indicating the service could not process the request.

401 - Authentication is missing or invalid.

Error response indicating the service could not process the request.

403 - The caller is not permitted to access this resource.

Error response indicating the service could not process the request.

404 - The requested resource was not found.

Error response indicating the service could not process the request.

429 - The rate limit has been exceeded.

Error response indicating the service could not process the request.

500 - An unexpected error occurred.

Error response indicating the service could not process the request.

Example Responses

A paginated collection of scoped controls.

{
  "@nextLink": "https://api.app.wdesk.com/assuranceProjects/019f14d1-7c8a-7f81-bd63-0677ee3fa6f8/scopedControls?$next=b3BhcXVlLWN1cnNvci10b2tlbi05ZjhlN2Q=",
  "data": [
    {
      "control": {
        "controlId": "COSO-C-001",
        "id": "019cafc7-4901-7181-a53b-b2263115961d",
        "name": "Code of Conduct and Ethics Policy"
      },
      "id": "019cb0a1-2f3e-7c22-9a10-4d5e6f7a8b90",
      "scopeRationale": null,
      "scopeStatus": "inScope"
    }
  ]
}

The request was invalid.

{
  "code": "invalidFilter",
  "message": "The $filter value could not be parsed.",
  "target": "$filter"
}

Authentication is missing or invalid.

{
  "code": "unauthenticated",
  "message": "Authentication credentials were missing or invalid."
}

The caller is not permitted to access this resource.

{
  "code": "permissionDenied",
  "message": "You do not have permission to access this resource."
}

The requested resource was not found.

{
  "code": "notFound",
  "message": "No resource with this id was found."
}

The rate limit has been exceeded.

{
  "code": "rateLimitExceeded",
  "message": "Rate limit exceeded. Retry after the period indicated in the response headers."
}

An unexpected error occurred.

{
  "code": "internalError",
  "message": "An unexpected error occurred. Please try again later."
}