{"openapi":"3.1.0","info":{"title":"ctrlrslv","version":"0.1.0","description":"HTTP API over APAC cybersecurity framework OSCAL catalogs. Framework content copyright remains with the originating agencies; see /legal for attribution. Code copyright Baden Hughes, Apache-2.0. Unofficial.","license":{"name":"Apache-2.0","url":"https://www.apache.org/licenses/LICENSE-2.0"},"contact":{"url":"https://github.com/badenh/cybersec-multifrwk-api"}},"servers":[{"url":"https://api.ctrlrslv.org"},{"url":"/"}],"tags":[{"name":"discovery"},{"name":"framework"},{"name":"catalog"},{"name":"controls"},{"name":"groups"},{"name":"params"},{"name":"backmatter"},{"name":"profiles"},{"name":"meta"}],"components":{"schemas":{"Envelope":{"type":"object","description":"Standard response envelope.","properties":{"framework":{"type":"string"},"version":{"type":"string"},"country":{"type":"string"},"kind":{"type":"string","enum":["framework","catalog","control","group","param","backmatter","profile"]},"taxonomy":{"type":"string","enum":["oscal-group","id-prefix"]},"canonicalPath":{"type":"string"},"id":{"type":"string"},"flat":{"type":"object","additionalProperties":true},"families":{"type":"object","properties":{"oscalGroup":{"$ref":"#/components/schemas/FamilyPointer"},"idPrefix":{"type":"array","items":{"$ref":"#/components/schemas/FamilyPointer"}}}},"links":{"type":"object","additionalProperties":{"type":"string"}},"oscal":{"type":"object","description":"Raw OSCAL node (pass-through).","additionalProperties":true}},"required":["framework","version","country","kind","canonicalPath","links"]},"FamilyPointer":{"type":"object","properties":{"id":{"type":"string"},"title":{"type":"string"},"class":{"type":["string","null"]},"href":{"type":"string"}},"required":["id","href"]},"FrameworkListItem":{"type":"object","properties":{"fid":{"type":"string","enum":["sg-mas-trmg","sg-ictss-cybersecurity","sg-ictss-im8-reform","sg-ospar-2.0","jp-nco-cmgara-fy23","my-ncsb","th-ncsa-cscs","hk-s17","au-aescsf","au-ism","nz-nzism"]},"country":{"type":"string","enum":["au","hk","jp","my","nz","sg","th"]},"title":{"type":"string"},"shortTitle":{"type":"string"},"oscalVersion":{"type":"string"},"catalogVersion":{"type":"string"},"status":{"type":"string","enum":["current","archived"]},"authoritativeOscal":{"type":"boolean"},"identitySibling":{"type":["string","null"]},"href":{"type":"string"}}},"Error":{"type":"object","properties":{"error":{"type":"string"},"id":{"type":"string"},"pid":{"type":"string"}},"required":["error"]}}},"paths":{"/":{"get":{"tags":["discovery"],"summary":"API landing page","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Envelope"}}}}}}},"/healthz":{"get":{"tags":["meta"],"summary":"Liveness probe","responses":{"200":{"description":"OK"}}}},"/frameworks":{"get":{"tags":["discovery"],"summary":"List all frameworks","responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"type":"object","properties":{"frameworks":{"type":"array","items":{"$ref":"#/components/schemas/FrameworkListItem"}}}}}}}}}},"/countries":{"get":{"tags":["discovery"],"summary":"List countries with framework counts","responses":{"200":{"description":"OK"}}}},"/countries/{iso}":{"get":{"tags":["discovery"],"summary":"Frameworks for a country","parameters":[{"name":"iso","in":"path","required":true,"schema":{"type":"string","enum":["au","hk","jp","my","nz","sg","th"]}}],"responses":{"200":{"description":"OK"},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/frameworks/{fid}":{"get":{"tags":["framework"],"summary":"Framework metadata","parameters":[{"name":"fid","in":"path","required":true,"schema":{"type":"string","enum":["sg-mas-trmg","sg-ictss-cybersecurity","sg-ictss-im8-reform","sg-ospar-2.0","jp-nco-cmgara-fy23","my-ncsb","th-ncsa-cscs","hk-s17","au-aescsf","au-ism","nz-nzism"]}}],"responses":{"200":{"description":"OK"},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/frameworks/{fid}/latest":{"get":{"tags":["framework"],"summary":"Redirect to latest version","parameters":[{"name":"fid","in":"path","required":true,"schema":{"type":"string","enum":["sg-mas-trmg","sg-ictss-cybersecurity","sg-ictss-im8-reform","sg-ospar-2.0","jp-nco-cmgara-fy23","my-ncsb","th-ncsa-cscs","hk-s17","au-aescsf","au-ism","nz-nzism"]}}],"responses":{"302":{"description":"Redirect to /frameworks/{fid}/{version}"}}}},"/frameworks/{fid}/{version}":{"get":{"tags":["catalog"],"summary":"Catalog metadata","parameters":[{"name":"fid","in":"path","required":true,"schema":{"type":"string","enum":["sg-mas-trmg","sg-ictss-cybersecurity","sg-ictss-im8-reform","sg-ospar-2.0","jp-nco-cmgara-fy23","my-ncsb","th-ncsa-cscs","hk-s17","au-aescsf","au-ism","nz-nzism"]}},{"name":"version","in":"path","required":true,"schema":{"type":"string"},"description":"Framework version slug from metadata.version."}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Envelope"}}}}}}},"/frameworks/{fid}/{version}/controls":{"get":{"tags":["controls"],"summary":"List controls","parameters":[{"name":"fid","in":"path","required":true,"schema":{"type":"string","enum":["sg-mas-trmg","sg-ictss-cybersecurity","sg-ictss-im8-reform","sg-ospar-2.0","jp-nco-cmgara-fy23","my-ncsb","th-ncsa-cscs","hk-s17","au-aescsf","au-ism","nz-nzism"]}},{"name":"version","in":"path","required":true,"schema":{"type":"string"},"description":"Framework version slug from metadata.version."},{"name":"prefix","in":"query","schema":{"type":"string"},"description":"Filter by id prefix (case-insensitive)."},{"name":"group","in":"query","schema":{"type":"string"},"description":"Filter by OSCAL group id (case-insensitive)."},{"name":"offset","in":"query","schema":{"type":"integer","minimum":0,"default":0}},{"name":"limit","in":"query","schema":{"type":"integer","minimum":1,"maximum":500,"default":100}}],"responses":{"200":{"description":"OK"}}}},"/frameworks/{fid}/{version}/controls/{cid}":{"get":{"tags":["controls"],"summary":"Single control (enriched)","parameters":[{"name":"fid","in":"path","required":true,"schema":{"type":"string","enum":["sg-mas-trmg","sg-ictss-cybersecurity","sg-ictss-im8-reform","sg-ospar-2.0","jp-nco-cmgara-fy23","my-ncsb","th-ncsa-cscs","hk-s17","au-aescsf","au-ism","nz-nzism"]}},{"name":"version","in":"path","required":true,"schema":{"type":"string"},"description":"Framework version slug from metadata.version."},{"name":"cid","in":"path","required":true,"schema":{"type":"string"},"description":"Case-insensitive."}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Envelope"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/frameworks/{fid}/{version}/groups":{"get":{"tags":["groups"],"summary":"Group tree","parameters":[{"name":"fid","in":"path","required":true,"schema":{"type":"string","enum":["sg-mas-trmg","sg-ictss-cybersecurity","sg-ictss-im8-reform","sg-ospar-2.0","jp-nco-cmgara-fy23","my-ncsb","th-ncsa-cscs","hk-s17","au-aescsf","au-ism","nz-nzism"]}},{"name":"version","in":"path","required":true,"schema":{"type":"string"},"description":"Framework version slug from metadata.version."}],"responses":{"200":{"description":"OK"}}}},"/frameworks/{fid}/{version}/groups/{gid}":{"get":{"tags":["groups"],"summary":"Group detail","parameters":[{"name":"fid","in":"path","required":true,"schema":{"type":"string","enum":["sg-mas-trmg","sg-ictss-cybersecurity","sg-ictss-im8-reform","sg-ospar-2.0","jp-nco-cmgara-fy23","my-ncsb","th-ncsa-cscs","hk-s17","au-aescsf","au-ism","nz-nzism"]}},{"name":"version","in":"path","required":true,"schema":{"type":"string"},"description":"Framework version slug from metadata.version."},{"name":"gid","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Envelope"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/frameworks/{fid}/{version}/params":{"get":{"tags":["params"],"summary":"List params","parameters":[{"name":"fid","in":"path","required":true,"schema":{"type":"string","enum":["sg-mas-trmg","sg-ictss-cybersecurity","sg-ictss-im8-reform","sg-ospar-2.0","jp-nco-cmgara-fy23","my-ncsb","th-ncsa-cscs","hk-s17","au-aescsf","au-ism","nz-nzism"]}},{"name":"version","in":"path","required":true,"schema":{"type":"string"},"description":"Framework version slug from metadata.version."}],"responses":{"200":{"description":"OK"}}}},"/frameworks/{fid}/{version}/params/{pid}":{"get":{"tags":["params"],"summary":"Param detail","parameters":[{"name":"fid","in":"path","required":true,"schema":{"type":"string","enum":["sg-mas-trmg","sg-ictss-cybersecurity","sg-ictss-im8-reform","sg-ospar-2.0","jp-nco-cmgara-fy23","my-ncsb","th-ncsa-cscs","hk-s17","au-aescsf","au-ism","nz-nzism"]}},{"name":"version","in":"path","required":true,"schema":{"type":"string"},"description":"Framework version slug from metadata.version."},{"name":"pid","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Envelope"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/frameworks/{fid}/{version}/backmatter":{"get":{"tags":["backmatter"],"summary":"List back-matter resources","parameters":[{"name":"fid","in":"path","required":true,"schema":{"type":"string","enum":["sg-mas-trmg","sg-ictss-cybersecurity","sg-ictss-im8-reform","sg-ospar-2.0","jp-nco-cmgara-fy23","my-ncsb","th-ncsa-cscs","hk-s17","au-aescsf","au-ism","nz-nzism"]}},{"name":"version","in":"path","required":true,"schema":{"type":"string"},"description":"Framework version slug from metadata.version."}],"responses":{"200":{"description":"OK"}}}},"/frameworks/{fid}/{version}/backmatter/{rid}":{"get":{"tags":["backmatter"],"summary":"Back-matter resource","parameters":[{"name":"fid","in":"path","required":true,"schema":{"type":"string","enum":["sg-mas-trmg","sg-ictss-cybersecurity","sg-ictss-im8-reform","sg-ospar-2.0","jp-nco-cmgara-fy23","my-ncsb","th-ncsa-cscs","hk-s17","au-aescsf","au-ism","nz-nzism"]}},{"name":"version","in":"path","required":true,"schema":{"type":"string"},"description":"Framework version slug from metadata.version."},{"name":"rid","in":"path","required":true,"schema":{"type":"string"},"description":"UUID, case-insensitive."}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Envelope"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/frameworks/{fid}/{version}/profiles":{"get":{"tags":["profiles"],"summary":"List profiles","parameters":[{"name":"fid","in":"path","required":true,"schema":{"type":"string","enum":["sg-mas-trmg","sg-ictss-cybersecurity","sg-ictss-im8-reform","sg-ospar-2.0","jp-nco-cmgara-fy23","my-ncsb","th-ncsa-cscs","hk-s17","au-aescsf","au-ism","nz-nzism"]}},{"name":"version","in":"path","required":true,"schema":{"type":"string"},"description":"Framework version slug from metadata.version."}],"responses":{"200":{"description":"OK"}}}},"/frameworks/{fid}/{version}/profiles/{pid}":{"get":{"tags":["profiles"],"summary":"Profile selection doc","parameters":[{"name":"fid","in":"path","required":true,"schema":{"type":"string","enum":["sg-mas-trmg","sg-ictss-cybersecurity","sg-ictss-im8-reform","sg-ospar-2.0","jp-nco-cmgara-fy23","my-ncsb","th-ncsa-cscs","hk-s17","au-aescsf","au-ism","nz-nzism"]}},{"name":"version","in":"path","required":true,"schema":{"type":"string"},"description":"Framework version slug from metadata.version."},{"name":"pid","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Envelope"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/frameworks/{fid}/{version}/profiles/{pid}/resolved":{"get":{"tags":["profiles"],"summary":"Resolved profile catalog","description":"May return 503 for heavy frameworks pending R2 offload (au-aescsf, au-ism, nz-nzism).","parameters":[{"name":"fid","in":"path","required":true,"schema":{"type":"string","enum":["sg-mas-trmg","sg-ictss-cybersecurity","sg-ictss-im8-reform","sg-ospar-2.0","jp-nco-cmgara-fy23","my-ncsb","th-ncsa-cscs","hk-s17","au-aescsf","au-ism","nz-nzism"]}},{"name":"version","in":"path","required":true,"schema":{"type":"string"},"description":"Framework version slug from metadata.version."},{"name":"pid","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Envelope"}}}},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Not available in bundle (pending R2 offload)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/frameworks/{fid}/{version}/profiles/{pid}/controls":{"get":{"tags":["profiles"],"summary":"Flat list of resolved profile controls","description":"May return 503 for heavy frameworks pending R2 offload.","parameters":[{"name":"fid","in":"path","required":true,"schema":{"type":"string","enum":["sg-mas-trmg","sg-ictss-cybersecurity","sg-ictss-im8-reform","sg-ospar-2.0","jp-nco-cmgara-fy23","my-ncsb","th-ncsa-cscs","hk-s17","au-aescsf","au-ism","nz-nzism"]}},{"name":"version","in":"path","required":true,"schema":{"type":"string"},"description":"Framework version slug from metadata.version."},{"name":"pid","in":"path","required":true,"schema":{"type":"string"}}],"responses":{"200":{"description":"OK"},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}},"503":{"description":"Not available in bundle (pending R2 offload)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/frameworks/{fid}/{version}/raw/catalog.{ext}":{"get":{"tags":["catalog"],"summary":"Raw OSCAL catalog (JSON, XML, or YAML)","description":"Byte-identical passthrough from the upstream source repo at the pinned SHA recorded in /provenance/{fid}. Served with immutable cache headers since content is SHA-pinned.","parameters":[{"name":"fid","in":"path","required":true,"schema":{"type":"string","enum":["sg-mas-trmg","sg-ictss-cybersecurity","sg-ictss-im8-reform","sg-ospar-2.0","jp-nco-cmgara-fy23","my-ncsb","th-ncsa-cscs","hk-s17","au-aescsf","au-ism","nz-nzism"]}},{"name":"version","in":"path","required":true,"schema":{"type":"string"},"description":"Framework version slug from metadata.version."},{"name":"ext","in":"path","required":true,"schema":{"type":"string","enum":["json","xml","yaml"]}}],"responses":{"200":{"description":"OK"}}}},"/frameworks/{fid}/{version}/raw/profiles/{pid}.{ext}":{"get":{"tags":["profiles"],"summary":"Raw OSCAL profile selection document","parameters":[{"name":"fid","in":"path","required":true,"schema":{"type":"string","enum":["sg-mas-trmg","sg-ictss-cybersecurity","sg-ictss-im8-reform","sg-ospar-2.0","jp-nco-cmgara-fy23","my-ncsb","th-ncsa-cscs","hk-s17","au-aescsf","au-ism","nz-nzism"]}},{"name":"version","in":"path","required":true,"schema":{"type":"string"},"description":"Framework version slug from metadata.version."},{"name":"pid","in":"path","required":true,"schema":{"type":"string"}},{"name":"ext","in":"path","required":true,"schema":{"type":"string","enum":["json","xml","yaml"]}}],"responses":{"200":{"description":"OK"},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/frameworks/{fid}/{version}/raw/resolved/{pid}.{ext}":{"get":{"tags":["profiles"],"summary":"Raw OSCAL resolved profile catalog","description":"Byte-identical passthrough. Available for heavy frameworks (au-aescsf, au-ism, nz-nzism) even though the enriched /profiles/{pid}/resolved endpoint returns 503 for those frameworks.","parameters":[{"name":"fid","in":"path","required":true,"schema":{"type":"string","enum":["sg-mas-trmg","sg-ictss-cybersecurity","sg-ictss-im8-reform","sg-ospar-2.0","jp-nco-cmgara-fy23","my-ncsb","th-ncsa-cscs","hk-s17","au-aescsf","au-ism","nz-nzism"]}},{"name":"version","in":"path","required":true,"schema":{"type":"string"},"description":"Framework version slug from metadata.version."},{"name":"pid","in":"path","required":true,"schema":{"type":"string"}},{"name":"ext","in":"path","required":true,"schema":{"type":"string","enum":["json","xml","yaml"]}}],"responses":{"200":{"description":"OK"},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/legal":{"get":{"tags":["meta"],"summary":"Copyright and per-framework attribution","responses":{"200":{"description":"OK"}}}},"/provenance":{"get":{"tags":["meta"],"summary":"Provenance pointer index","responses":{"200":{"description":"OK"}}}},"/provenance/{fid}":{"get":{"tags":["meta"],"summary":"Framework provenance (pinned SHAs, synced_at)","parameters":[{"name":"fid","in":"path","required":true,"schema":{"type":"string","enum":["sg-mas-trmg","sg-ictss-cybersecurity","sg-ictss-im8-reform","sg-ospar-2.0","jp-nco-cmgara-fy23","my-ncsb","th-ncsa-cscs","hk-s17","au-aescsf","au-ism","nz-nzism"]}}],"responses":{"200":{"description":"OK"},"404":{"description":"Not Found","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Error"}}}}}}},"/openapi.json":{"get":{"tags":["meta"],"summary":"This document","responses":{"200":{"description":"OK"}}}},"/docs":{"get":{"tags":["meta"],"summary":"Swagger UI","responses":{"200":{"description":"OK"}}}}}}