> ## Documentation Index > Fetch the complete documentation index at: https://developer.vanta.com/llms.txt > Use this file to discover all available pages before exploring further. # List audit controls > Returns a paginated list of controls for an audit. Rate limit: 250 requests / minute. ## OpenAPI ````yaml https://spec.speakeasy.com/vanta/vanta/conduct-an-audit-with-code-samples get /audits/{auditId}/controls openapi: 3.0.0 info: title: Conduct an audit version: 1.0.0 description: >- The Auditor API lets audit firms conduct audits from a tool outside of Vanta. Unlock data syncing with Vanta through this API. **Note for Vanta Gov (FedRAMP) customers:** Select `Vanta Gov (FedRAMP)` from the server dropdown to issue requests against `https://api.vanta-gov.com`. The OAuth token URL shown below defaults to the commercial host — replace it with `https://api.vanta-gov.com/oauth/token`. termsOfService: https://www.vanta.com/terms license: name: UNLICENSED contact: name: API Support url: https://help.vanta.com/ email: support@vanta.com servers: - url: https://api.vanta.com/v1 description: Vanta (Commercial) - url: https://api.vanta-gov.com/v1 description: Vanta Gov (FedRAMP) security: [] paths: /audits/{auditId}/controls: get: tags: - Audits summary: List audit controls description: |- Returns a paginated list of controls for an audit. Rate limit: 250 requests / minute. operationId: ListAuditControls parameters: - in: path name: auditId required: true schema: type: string - in: query name: pageSize required: false schema: $ref: '#/components/schemas/PageSize' - in: query name: pageCursor required: false schema: $ref: '#/components/schemas/PageCursor' - description: >- Filter controls whose externalId matches any of the provided values (exact, case-sensitive match). in: query name: externalIdMatchesAny required: false schema: items: type: string type: array responses: '200': description: Ok content: application/json: schema: $ref: '#/components/schemas/PaginatedResponse_AuditorControl_' examples: Example 1: value: results: data: - id: a2f7e1b9d0c3f4e5a6c7b8d9 externalId: CRY-104 name: Data encryption utilized description: >- Access reviews are performed to ensure that access is appropriate for the user's role and responsibilities. source: Vanta domains: - CRYPTOGRAPHIC_PROTECTIONS owner: id: 65e1efde08e8478f143a8ff9 emailAddress: example-person@email.com displayName: Example Owner framework: soc2 role: null customFields: [] sections: - framework: SOC 2 name: CC 1.1 principle: id: CC 1.0 name: Control Environment creationDate: null modificationDate: null pageInfo: hasNextPage: false hasPreviousPage: false startCursor: YXJyYXljb25uZWN0aW9uOjA= endCursor: YXJyYXljb25uZWN0aW9uOjE= security: - bearerAuth: [] x-codeSamples: - lang: typescript label: ListAuditControls source: |- import { Vanta } from "vanta-auditor-api-sdk"; const vanta = new Vanta({ bearerAuth: process.env["VANTA_BEARER_AUTH"] ?? "", }); async function run() { const result = await vanta.audits.listControls({ auditId: "", }); console.log(result); } run(); - lang: java label: ListAuditControls source: >- package hello.world; import com.vanta.vanta_auditor_api.Vanta; import com.vanta.vanta_auditor_api.models.operations.ListAuditControlsResponse; import java.lang.Exception; public class Application { public static void main(String[] args) throws Exception { Vanta sdk = Vanta.builder() .bearerAuth(System.getenv().getOrDefault("BEARER_AUTH", "")) .build(); ListAuditControlsResponse res = sdk.audits().listControls() .auditId("") .pageSize(10) .call(); if (res.paginatedResponseAuditorControl().isPresent()) { System.out.println(res.paginatedResponseAuditorControl().get()); } } } components: schemas: PageSize: type: integer format: int32 default: 10 description: >- Controls the maximum number of items returned in one response from the API. minimum: 1 maximum: 100 PageCursor: type: string description: >- A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor. PaginatedResponse_AuditorControl_: properties: results: properties: data: items: $ref: '#/components/schemas/AuditorControl' type: array pageInfo: $ref: '#/components/schemas/PageInfo' required: - data - pageInfo type: object required: - results type: object additionalProperties: false AuditorControl: properties: id: type: string description: The control's unique ID. externalId: type: string nullable: true description: The control's external ID. name: type: string description: The control's name. description: type: string description: The control's description. source: $ref: '#/components/schemas/ControlSource' description: The control's source, either "VANTA" or "CUSTOM". domains: items: type: string type: array description: The security domains that the control belongs to. owner: allOf: - $ref: '#/components/schemas/Owner' nullable: true description: The control's owner. role: type: string nullable: true description: The control's GDPR role, if the control is a GDPR control. customFields: items: $ref: '#/components/schemas/CustomField' type: array description: >- The control's custom field values, if control custom fields is included in your Vanta instance. creationDate: type: string format: date-time nullable: true description: >- When the control was created. Returns null for Vanta library controls. modificationDate: type: string format: date-time nullable: true description: >- When the control was last modified. Returns null for Vanta library controls. framework: type: string description: The report standard framework fulfilled by the control. sections: items: $ref: '#/components/schemas/Section' type: array description: Sections of a framework that this control satisfies required: - id - externalId - name - description - source - domains - owner - customFields - creationDate - modificationDate - framework - sections type: object additionalProperties: false PageInfo: description: Provides information about the pagination of a dataset. properties: endCursor: type: string nullable: true description: >- The cursor that points to the end of the current page, or null if there is no such cursor. hasNextPage: type: boolean description: Indicates if there is another page after the current page. hasPreviousPage: type: boolean description: Indicates if there is a page before the current page. startCursor: type: string nullable: true description: >- The cursor that points to the start of the current page, or null if there is no such cursor. required: - endCursor - hasNextPage - hasPreviousPage - startCursor type: object additionalProperties: false ControlSource: enum: - Vanta - Custom type: string Owner: properties: id: type: string description: Unique identifier for the person. displayName: type: string description: Name of the person that is shown in product. emailAddress: type: string description: Email address of the person. required: - id - displayName - emailAddress type: object additionalProperties: false CustomField: properties: label: type: string value: anyOf: - type: string - items: type: string type: array required: - label - value type: object additionalProperties: false Section: properties: name: type: string description: The section name framework: type: string description: The section framework principle: allOf: - $ref: '#/components/schemas/SectionPrinciple' nullable: true description: The principle that groups this section, if any. required: - name - framework - principle type: object additionalProperties: false SectionPrinciple: properties: id: type: string description: The principle's unique ID. name: type: string description: The principle's name. required: - id - name type: object additionalProperties: false securitySchemes: bearerAuth: type: http scheme: bearer ````