Security Control

Security Control endpoints on the External API cover the measures library CRUD, inventory↔measure connections, read-only dashboard, and CIA classification for company inventories.

All paths are under /external. Authenticate with an API key (see Authentication).

Typical workflows

Create a security measure

Resolve deliverable IDs from your framework/compliance context (each entry is { "deliverableId": <integer> })
POST /external/security-measure/new with name, inventoryTypeId, CIA levels, and securityDeliverables
Verify: GET /external/security-measure/{securityMeasureUniqueId}/item

Update a measure

GET /external/security-measure/list or GET /external/security-measure/{securityMeasureUniqueId}/item
PATCH /external/security-measure/{securityMeasureUniqueId}/edit — send only fields to change
Verify with item GET

Delete a measure

DELETE /external/security-measure/{securityMeasureUniqueId}/delete

Connect a measure to an inventory record

Resolve the inventory uniqueId (vendor, asset, or process) and the measure uniqueId from the measures library
Confirm the measure inventoryTypeId matches the inventory type (1 = process, 2 = vendor, 3 = asset)
POST /external/inventory/{inventoryUniqueId}/security-measure/{securityMeasureUniqueId}/connect
Verify: GET /external/inventory/{inventoryUniqueId}/security-measure/list

Update connection status

Use the connection inventorySecurityMeasureUniqueId from the list or item GET:

Action	Endpoint	Resulting status
Mark implemented	`PATCH .../cover`	`implemented`
Mark not implemented	`PATCH .../uncover`	`not_implemented`
Mark not applicable	`PATCH .../irrelevant`	`not_applicable`
Mark pending	`PATCH .../mark-pending`	`pending`

Assign responsible department

PATCH /external/inventory/{inventoryUniqueId}/security-measure/{inventorySecurityMeasureUniqueId}/edit

{
  "departmentUniqueId": "abc123def456"
}

View the security dashboard

GET /external/security-dashboard

Returns company-scoped aggregates only (no write operations). The company is taken from the API key — there is no company path parameter.

Response shape:

overall.processes|vendors|assets — total, secured, atRisk, toAssess, notClassified
exposureAndAction.securityMeasures — counts by status (implemented, notImplemented, notApplicable, pending)
exposureAndAction.topFiveMeasuresCreatingGaps
exposureAndAction.priorityActions

Classify an inventory (CIA questionnaire)

GET /external/classification-questionnaire — fetch company questionnaire
Optionally GET /external/inventory/{inventoryUniqueId}/cia-ai-classification?language=en — GenAI suggestion (not saved)
POST /external/inventory/{inventoryUniqueId}/classification-questionnaire/answers/submit with { "answers": [...] }
Verify: GET /external/inventory/{inventoryUniqueId}/classification-questionnaire/answers

Overwrite CIA levels manually

PATCH /external/inventory/{inventoryUniqueId}/cia-classification

{
  "confidentialityLevel": 3,
  "integrityLevel": 2,
  "availabilityLevel": 2,
  "confidentialityJustification": "Contains personal data",
  "integrityJustification": "Business-critical workflow",
  "availabilityJustification": "Standard uptime requirements"
}

CIA levels are integers 1–4. Present and submit in Confidentiality → Integrity → Availability order.

Field reference

Measures library

Field	Type	Notes
`name`	string	Required on create
`description`	string	Optional
`inventoryTypeId`	integer	`1` = process (ROPA), `2` = vendor, `3` = asset
`confidentialityLevel`	integer	CIA level `1`–`4`
`availabilityLevel`	integer	CIA level `1`–`4`
`integrityLevel`	integer	CIA level `1`–`4`
`securityDeliverables`	array	Required on create. Each item: `{ "deliverableId": <integer> }`
`category`	string	Optional
`type`	string	Optional
`goal`	string	Optional

Inventory connections

Field	Type	Notes
`inventorySecurityMeasureUniqueId`	string	Connection uniqueId
`status`	string	`pending`, `implemented`, `not_implemented`, `not_applicable`
`departmentUniqueId`	string	Responsible department (optional on connect; editable via PATCH edit)
`inventoryUniqueId`	string	Vendor, asset, or process uniqueId
`inventoryTypeId`	integer	`1` = process, `2` = vendor, `3` = asset

CIA classification

Field	Type	Notes
`answers[]`	array	Each item: `question`, `confidentialityLevel`, `integrityLevel`, `availabilityLevel`, `answer` (boolean)
`confidentialityLevel`	integer	Manual overwrite: `1`–`4`
`integrityLevel`	integer	Manual overwrite: `1`–`4`
`availabilityLevel`	integer	Manual overwrite: `1`–`4`
`*Justification`	string	Optional strings for manual overwrite

Endpoint summary

Measures library

Endpoint	Method	Description
`/security-dashboard`	GET	Read-only company security dashboard aggregates
`/security-measure/list`	GET	List measures (supports `filter`, `sort`, `maxResults`, `page`)
`/security-measure/{id}/item`	GET	Measure detail
`/security-measure/new`	POST	Create measure
`/security-measure/{id}/edit`	PATCH	Update measure (partial)
`/security-measure/{id}/delete`	DELETE	Delete measure
`/security-measure/{id}/connected-inventory/list`	GET	Inventories linked to a measure

Inventory connections

Endpoint	Method	Description
`/inventory/{inventoryUniqueId}/security-measure/list`	GET	Measures linked to an inventory
`/inventory/{inventoryUniqueId}/security-measure/{connectionId}/item`	GET	Connection detail
`/inventory/{inventoryUniqueId}/security-measure/{measureId}/connect`	POST	Connect measure to inventory
`/inventory/{inventoryUniqueId}/security-measure/{connectionId}/edit`	PATCH	Update connection (department)
`/inventory/{inventoryUniqueId}/security-measure/{connectionId}/cover`	PATCH	Mark implemented
`/inventory/{inventoryUniqueId}/security-measure/{connectionId}/uncover`	PATCH	Mark not implemented
`/inventory/{inventoryUniqueId}/security-measure/{connectionId}/irrelevant`	PATCH	Mark not applicable
`/inventory/{inventoryUniqueId}/security-measure/{connectionId}/mark-pending`	PATCH	Mark pending

CIA classification

Endpoint	Method	Description
`/classification-questionnaire`	GET	Company classification questionnaire (API key company only)
`/inventory/{inventoryUniqueId}/classification-questionnaire/answers`	GET	Saved answers and CIA result
`/inventory/{inventoryUniqueId}/classification-questionnaire/answers/submit`	POST	Submit questionnaire answers
`/inventory/{inventoryUniqueId}/cia-ai-classification`	GET	GenAI CIA suggestion (optional `language` query)
`/inventory/{inventoryUniqueId}/cia-classification`	PATCH	Manual CIA overwrite

Create example

{
  "name": "Encrypt data at rest",
  "description": "Apply encryption to stored personal data",
  "inventoryTypeId": 3,
  "confidentialityLevel": 4,
  "availabilityLevel": 3,
  "integrityLevel": 3,
  "securityDeliverables": [
    { "deliverableId": 42 }
  ],
  "category": "Technical",
  "type": "Preventive",
  "goal": "Protect confidentiality of stored data"
}

Response:

{
  "uniqueId": "6a054b8b9ae1a"
}

Connect example

POST /external/inventory/abc123/security-measure/6a054b8b9ae1a/connect

No request body required. The measure must have the same inventoryTypeId as the inventory record.

List filters

The measures list endpoint accepts the same advanced filter structure as the internal API. Example name search:

GET /external/security-measure/list?filter[and][name][include]=encrypt&maxResults=25&page=0

Inventory connection lists support pagination via maxResults and page query parameters.

Not included yet

The following remain internal-only (Evertrust admin / not company External API):

Measure templates, packages, and package cast
Package traffic light (cast preview)
Company questionnaire template editor (classification_questionnaire/save)