Drata

Drata Control Owners API

Control Owners are the Users responsible for Controls. They ensure the right evidence is associated, that any automated tests are passing, and help prepare for an audit.

GitHub OpenAPI

Operations 4

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

GET /workspaces/{workspaceId}/controls/{controlId}/owners List a control's owners · List Control Owners #
Ask an LLM
“Who owns a given control?”
“Can I check whether a particular user is among a control's owners?”
Tell an agent
List owners of control {control} in workspace {workspace}.
Show who is responsible for control {control}.
POST /workspaces/{workspaceId}/controls/{controlId}/owners Add an owner to a control · Add Control Owner #
Ask an LLM
“How do I add one more owner to a control?”
“Can a control have several owners?”
Tell an agent
Add user {owner} as an owner of control {control} in workspace {workspace}.
Make {owner} an additional owner on control {control}.
PUT /workspaces/{workspaceId}/controls/{controlId}/owners Replace all owners of a control · Modify Control Owners #
Ask an LLM
“Can I set the full list of owners for a control in one go?”
“What happens to existing owners when I replace a control's owner list?”
Tell an agent
Set the owners of control {control} in workspace {workspace} to {owners}.
Replace every owner on control {control} with users {owners}.
DELETE /workspaces/{workspaceId}/controls/{controlId}/owners/{ownerId} Remove an owner from a control · Delete Control Owner #
Ask an LLM
“Can I take someone off as owner of a control?”
“What if a control owner leaves the company?”
Tell an agent destructive · confirm first
Remove owner {owner} from control {control} in workspace {workspace}.
Drop {owner} as an owner of control {control}.

Documentation

📖
Documentation
https://developers.drata.com/openapi/reference/v2/overview/
📖
APIReference
https://developers.drata.com/openapi/reference/v2/overview/
📖
GettingStarted
https://developers.drata.com/developer-portal/v2/recipes/create-an-api-key/
📖
Authentication
https://raw.githubusercontent.com/api-evangelist/drata/refs/heads/main/authentication/drata-authentication.yml
📖
Documentation
https://developers.drata.com/openapi/reference/v2/tag/Custom-Connections/
📖
GettingStarted
https://developers.drata.com/developer-portal/v2/recipes/custom-connections/
📖
Documentation
https://docs.safebase.io/reference/getaccounts
📖
APIReference
https://docs.safebase.io/reference/getaccounts

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/drata/refs/heads/main/openapi/drata-control-owners-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/drata:drata-control-owners-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

drata-control-owners-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Drata Control Owners API
  description: '### What''s New in V2

    - Support for Custom Fields

    - Get and acknowledge user''s assigned policies

    - Payloads are streamlined to include only the essential information.'
  version: V2
  contact: {}
servers:
- url: https://public-api.drata.com/public/v2
- url: https://public-api.eu.drata.com/public/v2
- url: https://public-api.apac.drata.com/public/v2
tags:
- name: Control Owners
  description: Control Owners are the Users responsible for Controls. They ensure the right evidence is associated, that any automated tests are passing, and help prepare for an audit.
paths:
  /workspaces/{workspaceId}/controls/{controlId}/owners:
    get:
      description: 'Find Control Owners matching the provided filters.


        🔒 Requires **Controls: Get Control** permission.'
      operationId: ControlOwnersPublicV2Controller_getControlOwnersForAControl
      parameters:
      - name: controlId
        required: true
        in: path
        schema:
          type: number
      - name: workspaceId
        required: true
        in: path
        description: The Workspace ID associated to the Account
        schema:
          type: number
      - name: cursor
        required: false
        in: query
        description: This parameter is used to paginate through results. No value is needed for the first request. If there are additional results, the response will contain a `pagination.cursor` value that can be used in the subsequent request to retrieve the next page of results
        schema:
          type: string
      - name: size
        required: false
        in: query
        description: Number of results to return
        schema:
          minimum: 1
          maximum: 500
          default: 50
          type: number
      - name: sort
        required: false
        in: query
        description: Which field to sort by
        schema:
          $ref: '#/components/schemas/SortTypeLimitedEnum'
      - name: sortDir
        required: false
        in: query
        description: The direction to sort the data
        schema:
          $ref: '#/components/schemas/SortDirectionEnum'
      - name: includeTotalCount
        required: false
        in: query
        description: Include total count of all matching records in response. Only honored on first page (when cursor is null).
        schema:
          default: false
          example: false
          type: boolean
      - name: frameworkSlug
        required: false
        in: query
        description: Filter data by Users associated with this Control Requirement Framework slug
        schema:
          example: soc2
          type: string
      - name: includeUserIds[]
        required: false
        in: query
        description: User IDs of the Control Owners to return
        schema:
          minItems: 1
          maxItems: 300
          example:
          - 1
          - 2
          - 3
          type:
          - array
          - 'null'
          items:
            type: number
      - name: excludeUserIds
        required: false
        in: query
        description: User IDs of the Control Owners to exclude
        schema:
          example: []
          type: array
          items:
            type: number
      responses:
        '200':
          description: Successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ControlOwnersResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: List Control Owners
      tags:
      - Control Owners
      x-drata-permissions:
      - controls-get-control
      x-product-area:
      - REQUIREMENTS_FRAMEWORKS
    post:
      operationId: ControlOwnersPublicV2Controller_createControlOwner
      parameters:
      - name: workspaceId
        required: true
        in: path
        description: The Workspace ID associated to the Account
        schema:
          type: number
      - name: controlId
        required: true
        in: path
        schema:
          type: number
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ControlOwnerCreateRequestPublicV2Dto'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserCompactResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: Add Control Owner
      tags:
      - Control Owners
      x-drata-permissions:
      - controls-put-owners
      x-product-area:
      - REQUIREMENTS_FRAMEWORKS
      description: '🔒 Requires **Controls: Manage Control Owners** permission.'
    put:
      description: 'Modify all Owners for a given Control


        🔒 Requires **Controls: Manage Control Owners** permission.'
      operationId: ControlOwnersPublicV2Controller_modifyControlOwners
      parameters:
      - name: workspaceId
        required: true
        in: path
        description: The Workspace ID associated to the Account
        schema:
          type: number
      - name: controlId
        required: true
        in: path
        schema:
          type: number
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/ControlOwnerModifyRequestPublicV2Dto'
      responses:
        '200':
          description: Successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ControlOwnersModifyResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: Modify Control Owners
      tags:
      - Control Owners
      x-drata-permissions:
      - controls-put-owners
      x-product-area:
      - REQUIREMENTS_FRAMEWORKS
  /workspaces/{workspaceId}/controls/{controlId}/owners/{ownerId}:
    delete:
      operationId: ControlOwnersPublicV2Controller_deleteControlOwner
      parameters:
      - name: workspaceId
        required: true
        in: path
        description: The Workspace ID associated to the Account
        schema:
          type: number
      - name: controlId
        required: true
        in: path
        schema:
          type: number
      - name: ownerId
        required: true
        in: path
        schema:
          type: number
      responses:
        '200':
          description: Successful
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ControlOwnersResponsePublicV2Dto'
        '400':
          description: Malformed data and/or validation errors
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '401':
          description: Invalid Authorization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '403':
          description: You are not allowed to perform this action
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponsePublicV2Dto'
        '412':
          description: You must accept the Drata terms and conditions to use the API
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/ExceptionResponseDto'
      security:
      - bearer: []
      summary: Delete Control Owner
      tags:
      - Control Owners
      x-drata-permissions:
      - controls-delete-owners
      x-product-area:
      - REQUIREMENTS_FRAMEWORKS
      description: '🔒 Requires **Controls: Manage Control Owners** permission.'
components:
  schemas:
    UserCompactResponsePublicV2Dto:
      type: object
      properties:
        id:
          type: number
          example: 1
          description: User ID
        email:
          type: string
          example: email@example.com
          description: User email
        firstName:
          type:
          - string
          - 'null'
          example: Sally
          description: User first name
        lastName:
          type:
          - string
          - 'null'
          example: Smith
          description: User last name
        createdAt:
          type: string
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: User created at
        updatedAt:
          type: string
          format: date-time
          example: '2025-07-01T16:45:55.246Z'
          description: User last updated at
      required:
      - id
      - email
      - firstName
      - lastName
      - createdAt
      - updatedAt
    ControlOwnerCreateRequestPublicV2Dto:
      type: object
      properties:
        ownerId:
          type: number
          example: 56
          description: Owner ID
      required:
      - ownerId
    ControlOwnerModifyRequestPublicV2Dto:
      type: object
      properties:
        ownerUserIds:
          example:
          - 1
          - 2
          - 3
          description: User IDs of the Control's owners
          type: array
          items:
            type: number
      required:
      - ownerUserIds
    ControlOwnersResponsePublicV2Dto:
      type: object
      properties:
        data:
          description: Data set based on the pagination limits
          type: array
          items:
            $ref: '#/components/schemas/UserCompactResponsePublicV2Dto'
        pagination:
          $ref: '#/components/schemas/PaginationTotalCountResponsePublicV2Dto'
      required:
      - data
      - pagination
    ControlOwnersModifyResponsePublicV2Dto:
      type: object
      properties:
        ownerIds:
          description: User IDs of the Control's owners
          type: array
          items:
            type: number
      required:
      - ownerIds
    PaginationTotalCountResponsePublicV2Dto:
      type: object
      properties:
        cursor:
          type:
          - string
          - 'null'
          description: When this is not null, it indicates there is additional data. Pass this value in to the `cursor` parameter to fetch the next page of data.
        totalCount:
          type:
          - number
          - 'null'
          description: Total count of all matching items (not limited by page size). Only included when `includeTotalCount=true` is passed on the first page (no cursor).
      required:
      - cursor
    SortDirectionEnum:
      type: string
      enum:
      - ASC
      - DESC
    SortTypeLimitedEnum:
      type: string
      enum:
      - createdAt
      - updatedAt
    ExceptionResponsePublicV2Dto:
      type: object
      properties:
        name:
          type: string
        statusCode:
          type: number
        message:
          type: string
        code:
          type: number
        debugInfo:
          type: object
          properties:
            name:
              type: string
            message:
              type: string
            stack:
              type: string
          required:
          - name
          - message
      required:
      - name
      - statusCode
      - message
      - code
    ExceptionResponseDto:
      type: object
      properties:
        statusCode:
          type: number
        message:
          type: string
        code:
          type: number
        debugInfo:
          type: object
          properties:
            name:
              type: string
            message:
              type: string
            stack:
              type: string
          required:
          - name
          - message
      required:
      - statusCode
      - message
      - code
  securitySchemes:
    bearer:
      scheme: bearer
      bearerFormat: API_KEY
      type: http