Skip to content
bynhDocs
Log in

List a framework’s requirements

GET/workspaces/{workspace}/evidence/frameworks/{framework}/requirements

Returns every requirement of one framework you follow, met or not, with the evidence and policies behind each and what’s missing.

Authentication

Send an API token as a bearer token. This endpoint needs a read token, made by any member of the workspace. Create one in My account → API tokens; see scopes and roles.

Authorization: Bearer 42|bynh_pat_•••••••Header

Path parameters

  • workspacestringRequired

    Your workspace slug, e.g. dokan.

  • frameworkstringRequired

    Framework slug (route binds {framework:slug}).

Response

200 OK

The framework summary and its requirement rows.

  • frameworkobjectslug, name, short_name, version, in_audit, total, met, gaps, percent.
  • requirements[].idintegerRequirement id (use it in PATCH /evidence/requirements/{requirementId} and in requirement_ids).
  • requirements[].codestringe.g. A.5.15, CC6.1, 8.3.1.
  • requirements[].titlestringLocalized title.
  • requirements[].sectionstring|nullLocalized section.
  • requirements[].metbooleanTrue when mapped evidence is current or due, or a mapped published policy is in force.
  • requirements[].missingstring|nullLocalized sentence on what’s missing (your note wins); null when met.
  • requirements[].notestring|nullYour note on the requirement.
  • requirements[].owner{id, name}|nullAssigned owner, else the owner of mapped evidence.
  • requirements[].reminded_atstring|nullLast reminder.
  • requirements[].evidence[]{id, title, status}Mapped evidence items.
  • requirements[].policies[]{id, title, in_force}Mapped policies.

Rate limits

This endpoint counts toward your general limit of 120 requests a minute. When you go over, wait for the number of seconds in Retry-After.

Errors

401The token is missing, wrong, revoked or expired.
404The token belongs to another workspace, or its owner is no longer a member. Or: Unknown framework slug.
500The framework exists but the workspace doesn’t follow it (the controller passes null to Coverage::summary). Follow the framework first.

Every error is JSON with a message. See Errors.

Next →Export coverage as CSV
curl "https://api.bynh.io/api/v1/workspaces/dokan/evidence/frameworks/iso-27001/requirements" \
  -H "Authorization: Bearer $BYNH_TOKEN" \
  -H "Accept: application/json"

Response200 OK

application/json
{
  "data": {
    "framework": {
      "slug": "iso-27001",
      "name": "ISO/IEC 27001:2022",
      "short_name": "ISO 27001",
      "version": "2022, Annex A",
      "in_audit": false,
      "total": 93,
      "met": 71,
      "gaps": 22,
      "percent": 76
    },
    "requirements": [
      {
        "id": 1204,
        "code": "A.5.15",
        "title": "Access control",
        "section": "Organizational controls",
        "met": true,
        "missing": null,
        "note": null,
        "owner": {
          "id": 21,
          "name": "Faisal Alharbi"
        },
        "reminded_at": null,
        "evidence": [
          {
            "id": 31,
            "title": "Quarterly access review",
            "status": "current"
          }
        ],
        "policies": [
          {
            "id": 6,
            "title": "Access control",
            "in_force": true
          }
        ]
      },
      {
        "id": 1239,
        "code": "A.8.13",
        "title": "Information backup",
        "section": "Technological controls",
        "met": false,
        "missing": "Nightly database backup was due for review on 14 Sep",
        "note": null,
        "owner": {
          "id": 21,
          "name": "Faisal Alharbi"
        },
        "reminded_at": null,
        "evidence": [
          {
            "id": 35,
            "title": "Nightly database backup",
            "status": "overdue"
          }
        ],
        "policies": []
      }
    ]
  }
}

Examples use Dokan, a sample workspace. Responses are shortened where lists are long.