Skip to main content

​
Endpoint

PATCH /api/v1/controls/sub-controls/{sub_control_id}

​
Description

Updates the Test of Design (ToD) and Test of Effectiveness (ToE) ratings for a sub-control. The system automatically calculates the Total Effectiveness.

​
Path Parameters

ParameterTypeRequiredDescription
sub_control_idUUIDYesSub-control identifier

​
Request Body

{
  "tod": "B",
  "toe": "2",
  "testing_date": "2026-01-15",
  "tested_by": "John Smith",
  "evidence_notes": "Sample testing of 100 transactions completed",
  "tod_justification": "Control design is well-structured with documented procedures",
  "toe_justification": "93% effectiveness rate observed in testing"
}
FieldTypeRequiredDescription
todstringNoTest of Design: A (Excellent) to E (Inadequate)
toestringNoTest of Effectiveness: 1 (Highly Effective) to 5 (Ineffective)
testing_datedateNoDate control was tested
tested_bystringNoName of tester
evidence_notesstringNoTesting evidence documentation
tod_justificationstringNoJustification for ToD rating
toe_justificationstringNoJustification for ToE rating

​
Response

{
  "data": {
    "id": "sc-uuid-001",
    "key_control_id": "kc-uuid-001",
    "name": "Bureau Data Verification",
    "tod": "B",
    "toe": "2",
    "total_effectiveness": "Effective",
    "testing_date": "2026-01-15",
    "tested_by": "John Smith",
    "evidence_notes": "Sample testing of 100 transactions completed",
    "updated_at": "2026-01-16T10:00:00Z"
  },
  "message": "Sub-control updated successfully"
}

​
Total Effectiveness Calculation

The system calculates total effectiveness based on the ToD/ToE matrix:
ToD \ ToE12345
AHighly EffectiveHighly EffectiveEffectiveModerately EffectiveLess Effective
BHighly EffectiveEffectiveEffectiveModerately EffectiveLess Effective
CEffectiveEffectiveModerately EffectiveLess EffectiveNot Effective
DModerately EffectiveModerately EffectiveLess EffectiveNot EffectiveNot Effective
ELess EffectiveLess EffectiveNot EffectiveNot EffectiveNot Effective

​
Example Request

curl -X PATCH "https://api.risklegion.com/api/v1/controls/sub-controls/sc-uuid-001" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "tod": "B",
    "toe": "2",
    "testing_date": "2026-01-15",
    "tested_by": "John Smith"
  }'