DevArmor

DevArmor Controls API

The controls API from DevArmor — 4 operation(s) for controls.

Documentation GitHub OpenAPI

Operations 7

GET /projects/{project_id}/threat-models/{threat_model_id}/controls List unique controls across all versions of a threat model #

GET /projects/{project_id}/controls List controls in a project #

GET /projects/{project_id}/threat-models/{threat_model_id}/versions/{version}/controls List control in a project #

POST /projects/{project_id}/threat-models/{threat_model_id}/versions/{version}/controls Create a control in a project #

GET /projects/{project_id}/threat-models/{threat_model_id}/versions/{version}/controls/{resource_id} Get a control from a project #

PUT /projects/{project_id}/threat-models/{threat_model_id}/versions/{version}/controls/{resource_id} Update a threat model control in a project #

DELETE /projects/{project_id}/threat-models/{threat_model_id}/versions/{version}/controls/{resource_id} Delete a threat model control from a project #

Specifications

⚙

OpenAPI

https://artifacts.apis.io/devarmor/openapi/devarmor-controls-api-openapi.yml

Schemas & Data

📊

JSONSchema

https://artifacts.apis.io/devarmor/json-schema/devarmor-task-schema.json

📊

JSONSchema

https://artifacts.apis.io/devarmor/json-schema/devarmor-policy-schema.json

📊

JSONSchema

https://artifacts.apis.io/devarmor/json-schema/devarmor-control-schema.json

📊

JSONSchema

https://artifacts.apis.io/devarmor/json-schema/devarmor-threat-schema.json

📊

JSONSchema

https://artifacts.apis.io/devarmor/json-schema/devarmor-trust-boundary-schema.json

📊

JSONSchema

https://artifacts.apis.io/devarmor/json-schema/devarmor-rule-schema.json

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/devarmor:devarmor-controls-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: DevArmor Security Reviews Controls API
  version: 1.14.0
tags:
- name: Controls
paths:
  /projects/{project_id}/threat-models/{threat_model_id}/controls:
    get:
      tags:
      - Controls
      summary: List unique controls across all versions of a threat model
      operationId: list_project_threat_model_controls
      security:
      - APIGatewayAuth: []
      parameters:
      - name: threat_model_id
        in: path
        required: true
        schema:
          type: string
          title: Threat Model Id
      - name: project_id
        in: path
        required: true
        schema:
          type: string
          title: Project Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Control'
                title: Response List Project Threat Model Controls
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /projects/{project_id}/controls:
    get:
      tags:
      - Controls
      summary: List controls in a project
      operationId: list_project_controls
      security:
      - APIGatewayAuth: []
      parameters:
      - name: project_id
        in: path
        required: true
        schema:
          type: string
          title: Project Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Control'
                title: Response List Project Controls
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /projects/{project_id}/threat-models/{threat_model_id}/versions/{version}/controls:
    get:
      tags:
      - Controls
      summary: List control in a project
      operationId: list_project_threat_model_control
      security:
      - APIGatewayAuth: []
      parameters:
      - name: project_id
        in: path
        required: true
        schema:
          type: string
          title: Project Id
      - name: version
        in: path
        required: true
        schema:
          type: string
          title: Version
      - name: threat_model_id
        in: path
        required: true
        schema:
          type: string
          title: Threat Model Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Control'
                title: Response List Project Threat Model Control
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    post:
      tags:
      - Controls
      summary: Create a control in a project
      operationId: create_project_threat_model_control
      security:
      - APIGatewayAuth: []
      parameters:
      - name: project_id
        in: path
        required: true
        schema:
          type: string
          title: Project Id
      - name: version
        in: path
        required: true
        schema:
          type: string
          title: Version
      - name: threat_model_id
        in: path
        required: true
        schema:
          type: string
          title: Threat Model Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ControlCreate'
      responses:
        '201':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Control'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
  /projects/{project_id}/threat-models/{threat_model_id}/versions/{version}/controls/{resource_id}:
    get:
      tags:
      - Controls
      summary: Get a control from a project
      operationId: get_project_threat_model_control
      security:
      - APIGatewayAuth: []
      parameters:
      - name: resource_id
        in: path
        required: true
        schema:
          type: string
          title: Resource Id
      - name: project_id
        in: path
        required: true
        schema:
          type: string
          title: Project Id
      - name: version
        in: path
        required: true
        schema:
          type: string
          title: Version
      - name: threat_model_id
        in: path
        required: true
        schema:
          type: string
          title: Threat Model Id
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Control'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    put:
      tags:
      - Controls
      summary: Update a threat model control in a project
      operationId: update_project_threat_model_control
      security:
      - APIGatewayAuth: []
      parameters:
      - name: resource_id
        in: path
        required: true
        schema:
          type: string
          title: Resource Id
      - name: project_id
        in: path
        required: true
        schema:
          type: string
          title: Project Id
      - name: version
        in: path
        required: true
        schema:
          type: string
          title: Version
      - name: threat_model_id
        in: path
        required: true
        schema:
          type: string
          title: Threat Model Id
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ControlUpdate'
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Control'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
    delete:
      tags:
      - Controls
      summary: Delete a threat model control from a project
      operationId: delete_project_threat_model_control
      security:
      - APIGatewayAuth: []
      parameters:
      - name: resource_id
        in: path
        required: true
        schema:
          type: string
          title: Resource Id
      - name: project_id
        in: path
        required: true
        schema:
          type: string
          title: Project Id
      - name: version
        in: path
        required: true
        schema:
          type: string
          title: Version
      - name: threat_model_id
        in: path
        required: true
        schema:
          type: string
          title: Threat Model Id
      - name: force
        in: query
        required: false
        schema:
          type: boolean
          default: false
          title: Force
      responses:
        '200':
          description: Successful Response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ControlDelete'
        '422':
          description: Validation Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/HTTPValidationError'
components:
  schemas:
    ValidationError:
      properties:
        loc:
          items:
            anyOf:
            - type: string
            - type: integer
          type: array
          title: Location
        msg:
          type: string
          title: Message
        type:
          type: string
          title: Error Type
        input:
          title: Input
        ctx:
          type: object
          title: Context
      type: object
      required:
      - loc
      - msg
      - type
      title: ValidationError
    ControlDelete:
      properties:
        symbolic_name:
          type: string
          pattern: ^[0-9a-z-]+$
          title: Symbolic Name
        title:
          type: string
          title: Title
        description:
          type: string
          title: Description
          description: 'Three labeled paragraphs describing the security requirement, implementation and enforcement

            details, and do''s and don''ts.'
        status:
          $ref: '#/components/schemas/ControlStatus'
        priority:
          $ref: '#/components/schemas/Priority'
        include_in_mitigation_plan:
          type: boolean
          title: Include In Mitigation Plan
          description: Whether to generate tasks from this control.
        enforce_via_policy:
          type: boolean
          title: Enforce Via Policy
          description: Whether this control should be included in an enforcement policy.
      type: object
      required:
      - symbolic_name
      - title
      - description
      - status
      - priority
      - include_in_mitigation_plan
      - enforce_via_policy
      title: ControlDelete
    Project:
      properties:
        symbolic_name:
          type: string
          pattern: ^[0-9a-z-]+$
          title: Symbolic Name
        title:
          type: string
          title: Title
        default:
          type: boolean
          title: Default
          default: false
        description:
          anyOf:
          - type: string
          - type: 'null'
          title: Description
        use_memory:
          type: boolean
          title: Use Memory
          default: true
        created_at:
          type: string
          format: date-time
          title: Created At
        updated_at:
          type: string
          format: date-time
          title: Updated At
        id:
          type: integer
          title: Id
        owner_user:
          $ref: '#/components/schemas/User'
        memory_effective:
          anyOf:
          - type: boolean
          - type: 'null'
          title: Memory Effective
        memory_effective_reason:
          anyOf:
          - type: string
          - type: 'null'
          title: Memory Effective Reason
      type: object
      required:
      - symbolic_name
      - title
      - id
      - owner_user
      title: Project
    Threat:
      properties:
        symbolic_name:
          type: string
          pattern: ^[0-9a-z-]+$
          title: Symbolic Name
        title:
          type: string
          title: Title
        description:
          type: string
          title: Description
        event:
          type: string
          title: Event
        sources:
          items:
            $ref: '#/components/schemas/ThreatSource'
          type: array
          title: Sources
        capec_attack_mechanism:
          anyOf:
          - type: integer
          - type: 'null'
          title: Capec Attack Mechanism
        cwe_vulnerabilities:
          anyOf:
          - items:
              type: integer
            type: array
          - type: 'null'
          title: Cwe Vulnerabilities
        stride_category:
          anyOf:
          - $ref: '#/components/schemas/ThreatSTRIDECategory'
          - type: 'null'
        scope_specific:
          type: boolean
          title: Scope Specific
          default: true
          deprecated: true
        created_at:
          type: string
          format: date-time
          title: Created At
        updated_at:
          type: string
          format: date-time
          title: Updated At
        id:
          type: integer
          title: Id
        project:
          $ref: '#/components/schemas/Project'
        threat_model_versions:
          items:
            type: string
            pattern: ^\d+(\.\d+)*$
          type: array
          title: Threat Model Versions
        threat_persona:
          anyOf:
          - $ref: '#/components/schemas/ThreatPersona'
          - type: 'null'
        components_affected:
          anyOf:
          - items:
              $ref: '#/components/schemas/Component'
            type: array
          - type: 'null'
          title: Components Affected
        mitre_attack_techniques:
          anyOf:
          - items:
              $ref: '#/components/schemas/RefMitreAttackTechnique'
            type: array
          - type: 'null'
          title: Mitre Attack Techniques
      type: object
      required:
      - symbolic_name
      - title
      - description
      - event
      - sources
      - id
      - project
      - threat_model_versions
      - threat_persona
      - components_affected
      title: Threat
    ThreatSTRIDECategory:
      type: string
      enum:
      - spoofing
      - tampering
      - repudiation
      - information_disclosure
      - denial_of_service
      - elevation_of_privilege
      title: ThreatSTRIDECategory
    Component:
      properties:
        symbolic_name:
          type: string
          pattern: ^[0-9a-z-]+$
          title: Symbolic Name
        title:
          type: string
          title: Title
        description:
          type: string
          title: Description
        repo_link:
          anyOf:
          - type: string
            maxLength: 2083
            minLength: 1
            format: uri
          - type: 'null'
          title: Repo Link
        created_at:
          type: string
          format: date-time
          title: Created At
        updated_at:
          type: string
          format: date-time
          title: Updated At
        id:
          type: integer
          title: Id
        project:
          $ref: '#/components/schemas/Project'
        threat_model_versions:
          items:
            type: string
            pattern: ^\d+(\.\d+)*$
          type: array
          title: Threat Model Versions
        parent_component:
          anyOf:
          - $ref: '#/components/schemas/Component'
          - type: 'null'
        trust_zone:
          anyOf:
          - $ref: '#/components/schemas/TrustZone'
          - type: 'null'
      type: object
      required:
      - symbolic_name
      - title
      - description
      - repo_link
      - id
      - project
      - threat_model_versions
      - trust_zone
      title: Component
    Degree:
      type: string
      enum:
      - minimal
      - low
      - moderate
      - high
      - maximal
      title: Degree
    UserState:
      type: string
      enum:
      - active
      - inactive
      - pending_org_approval
      title: UserState
    ControlStatus:
      type: string
      enum:
      - active
      - suggested
      - under_review
      - approved
      - scheduled
      - retired
      title: ControlStatus
    AuthenticationMethod:
      type: string
      enum:
      - password
      - otp
      - challenge_response
      - public_key
      - token
      - biometrics
      - sso
      - social
      title: AuthenticationMethod
    RefMitreAttackTechnique:
      properties:
        id:
          type: string
          title: Id
        name:
          type: string
          title: Name
        tactics:
          items:
            $ref: '#/components/schemas/RefMitreAttackTactic'
          type: array
          title: Tactics
      type: object
      required:
      - id
      - name
      - tactics
      title: RefMitreAttackTechnique
    User:
      properties:
        email:
          type: string
          title: Email
        name:
          type: string
          title: Name
        state:
          $ref: '#/components/schemas/UserState'
          default: active
        roles:
          items:
            $ref: '#/components/schemas/UserRole'
          type: array
          title: Roles
          default: []
        created_at:
          type: string
          format: date-time
          title: Created At
        updated_at:
          type: string
          format: date-time
          title: Updated At
        id:
          type: integer
          title: Id
      type: object
      required:
      - email
      - name
      - id
      title: User
    ControlCreate:
      properties:
        symbolic_name:
          type: 'null'
          title: Symbolic Name
        title:
          type: string
          title: Title
        description:
          type: string
          title: Description
          description: 'Three labeled paragraphs describing the security requirement, implementation and enforcement

            details, and do''s and don''ts.'
        status:
          $ref: '#/components/schemas/ControlStatus'
          default: suggested
        priority:
          $ref: '#/components/schemas/Priority'
          default: medium
        include_in_mitigation_plan:
          type: boolean
          title: Include In Mitigation Plan
          default: true
        enforce_via_policy:
          type: boolean
          title: Enforce Via Policy
          default: true
        threat_ids:
          items:
            type: integer
          type: array
          title: Threat Ids
        trust_boundary_id:
          anyOf:
          - type: integer
          - type: 'null'
          title: Trust Boundary Id
        compliance_control_ids:
          anyOf:
          - items:
              type: integer
            type: array
          - type: 'null'
          title: Compliance Control Ids
      type: object
      required:
      - title
      - description
      - threat_ids
      title: ControlCreate
    RefMitreAttackTactic:
      properties:
        id:
          type: string
          title: Id
        name:
          type: string
          title: Name
      type: object
      required:
      - id
      - name
      title: RefMitreAttackTactic
    RefComplianceControl:
      properties:
        id:
          type: integer
          title: Id
        scheme_id:
          type: integer
          title: Scheme Id
        code:
          type: string
          title: Code
        category:
          type: string
          title: Category
        title:
          type: string
          title: Title
        description:
          type: string
          title: Description
        notes:
          anyOf:
          - type: string
          - type: 'null'
          title: Notes
      type: object
      required:
      - id
      - scheme_id
      - code
      - category
      - title
      - description
      - notes
      title: RefComplianceControl
    TrustBoundary:
      properties:
        access_control_methods:
          anyOf:
          - items:
              $ref: '#/components/schemas/AccessControlMethod'
            type: array
          - type: 'null'
          title: Access Control Methods
        authentication_methods:
          anyOf:
          - items:
              $ref: '#/components/schemas/AuthenticationMethod'
            type: array
          - type: 'null'
          title: Authentication Methods
        access_token_expires:
          type: boolean
          title: Access Token Expires
        access_token_ttl:
          anyOf:
          - type: integer
          - type: 'null'
          title: Access Token Ttl
        has_refresh_token:
          type: boolean
          title: Has Refresh Token
        refresh_token_expires:
          type: boolean
          title: Refresh Token Expires
        refresh_token_ttl:
          anyOf:
          - type: integer
          - type: 'null'
          title: Refresh Token Ttl
        can_user_logout:
          type: boolean
          title: Can User Logout
        can_system_logout:
          type: boolean
          title: Can System Logout
        created_at:
          type: string
          format: date-time
          title: Created At
        updated_at:
          type: string
          format: date-time
          title: Updated At
        id:
          type: integer
          title: Id
        project:
          $ref: '#/components/schemas/Project'
        threat_model_versions:
          items:
            type: string
            pattern: ^\d+(\.\d+)*$
          type: array
          title: Threat Model Versions
        trust_zone_a:
          $ref: '#/components/schemas/TrustZone'
        trust_zone_b:
          $ref: '#/components/schemas/TrustZone'
      type: object
      required:
      - access_control_methods
      - authentication_methods
      - access_token_expires
      - access_token_ttl
      - has_refresh_token
      - refresh_token_expires
      - refresh_token_ttl
      - can_user_logout
      - can_system_logout
      - id
      - project
      - threat_model_versions
      - trust_zone_a
      - trust_zone_b
      title: TrustBoundary
    Control:
      properties:
        symbolic_name:
          type: string
          pattern: ^[0-9a-z-]+$
          title: Symbolic Name
        title:
          type: string
          title: Title
        description:
          type: string
          title: Description
          description: 'Three labeled paragraphs describing the security requirement, implementation and enforcement

            details, and do''s and don''ts.'
        status:
          $ref: '#/components/schemas/ControlStatus'
        priority:
          $ref: '#/components/schemas/Priority'
        include_in_mitigation_plan:
          type: boolean
          title: Include In Mitigation Plan
          description: Whether to generate tasks from this control.
        enforce_via_policy:
          type: boolean
          title: Enforce Via Policy
          description: Whether this control should be included in an enforcement policy.
        created_at:
          type: string
          format: date-time
          title: Created At
        updated_at:
          type: string
          format: date-time
          title: Updated At
        id:
          type: integer
          title: Id
        project_id:
          type: integer
          title: Project Id
        threat_model_versions:
          items:
            type: string
            pattern: ^\d+(\.\d+)*$
          type: array
          title: Threat Model Versions
        threats:
          items:
            $ref: '#/components/schemas/Threat'
          type: array
          title: Threats
        components_affected:
          items:
            $ref: '#/components/schemas/Component'
          type: array
          title: Components Affected
        trust_boundary:
          anyOf:
          - $ref: '#/components/schemas/TrustBoundary'
          - type: 'null'
        compliance_controls:
          items:
            $ref: '#/components/schemas/RefComplianceControl'
          type: array
          title: Compliance Controls
      type: object
      required:
      - symbolic_name
      - title
      - description
      - status
      - priority
      - include_in_mitigation_plan
      - enforce_via_policy
      - id
      - project_id
      - threat_model_versions
      - threats
      - components_affected
      - compliance_controls
      title: Control
    HTTPValidationError:
      properties:
        detail:
          items:
            $ref: '#/components/schemas/ValidationError'
          type: array
          title: Detail
      type: object
      title: HTTPValidationError
    TrustZone:
      properties:
        symbolic_name:
          type: string
          pattern: ^[0-9a-z-]+$
          title: Symbolic Name
        title:
          type: string
          title: Title
        description:
          type: string
          title: Description
        created_at:
          type: string
          format: date-time
          title: Created At
        updated_at:
          type: string
          format: date-time
          title: Updated At
        id:
          type: integer
          title: Id
        project:
          $ref: '#/components/schemas/Project'
        threat_model_versions:
          items:
            type: string
            pattern: ^\d+(\.\d+)*$
          type: array
          title: Threat Model Versions
      type: object
      required:
      - symbolic_name
      - title
      - description
      - id
      - project
      - threat_model_versions
      title: TrustZone
    AttackerSkillAndKnowledge:
      type: string
      enum:
      - script_kid
      - insider
      - engineer
      - expert_engineer
      - oc_sponsored
      - state_sponsored
      title: AttackerSkillAndKnowledge
    UserRole:
      type: string
      enum:
      - admin
      - customer_support
      title: UserRole
    AccessControlMethod:
      type: string
      enum:
      - acl
      - rbac
      - mac
      - dac
      - abac
      title: AccessControlMethod
    ThreatPersona:
      properties:
        symbolic_name:
          type: string
          pattern: ^[0-9a-z-]+$
          title: Symbolic Name
        title:
          type: string
          title: Title
        description:
          type: string
          title: Description
        is_person:
          type: boolean
          title: Is Person
        skill_level:
          $ref: '#/components/schemas/AttackerSkillAndKnowledge'
        access_level:
          $ref: '#/components/schemas/AccessLevel'
        malicious_intent:
          type: boolean
          title: Malicious Intent
        applicability_to_org:
          $ref: '#/components/schemas/Degree'
        created_at:
          type: string
          format: date-time
          title: Created At
        updated_at:
          type: string
          format: date-time
          title: Updated At
        id:
          type: integer
          title: Id
        project:
          $ref: '#/components/schemas/Project'
        threat_model_versions:
          items:
            type: string
            pattern: ^\d+(\.\d+)*$
          type: array
          title: Threat Model Versions
      type: object
      required:
      - symbolic_name
      - title
      - description
      - is_person
      - skill_level
      - access_level
      - malicious_intent
      - applicability_to_org
      - id
      - project
      - threat_model_versions
      title: ThreatPersona
    ControlUpdate:
      properties:
        symbolic_name:
          type: 'null'
          title: Symbolic Name
        title:
          anyOf:
          - type: string
          - type: 'null'
          title: Title
        description:
          anyOf:
          - type: string
          - type: 'null'
          title: Description
        status:
          anyOf:
          - $ref: '#/components/schemas/ControlStatus'
          - type: 'null'
        priority:
          anyOf:
          - $ref: '#/components/schemas/Priority'
          - type: 'null'
        include_in_mitigation_plan:
          anyOf:
          - type: boolean
          - type: 'null'
          title: Include In Mitigation Plan
        enforce_via_policy:
          anyOf:
          - type: boolean
          - type: 'null'
          title: Enforce Via Policy
        threat_ids:
          anyOf:
          - items:
              type: integer
            type: array
          - type: 'null'
          title: Threat Ids
        trust_boundary_id:
          anyOf:
          - type: integer
          - type: 'null'
          title: Trust Boundary Id
        compliance_control_ids:
          anyOf:
          - items:
              type: integer
            type: array
          - type: 'null'
          title: Compliance Control Ids
      type: object
      title: ControlUpdate
    AccessLevel:
      type: string
      enum:
      - anonymous
      - user
      - admin
      title: AccessLevel
    Priority:
      type: string
      enum:
      - highest
      - high
      - medium
      - low
      - lowest
      title: Priority
    ThreatSource:
      type: string
      enum:
      - adversary
      - human_error
      - failure
      - events_beyond_org_control
      title: ThreatSource
  securitySchemes:
    APIGatewayAuth:
      type: http
      scheme: bearer