API reference

A public, read-only JSON API over the full NIST 800-53 catalog and CSF 2.0 crosswalk. Every endpoint is a GET request; there is no authentication and no query string — filters are expressed as path segments.

All endpoints below are deployed and publicly reachable at https://api.nistcontrols.io/v1. Responses are read-only, cached at the edge, and served with Content-Type: application/json.
Base URL
https://api.nistcontrols.io/v1
Authentication
None — every endpoint is public and read-only
Endpoints
GET/controlsList every control summary
GET/controls/{id}Retrieve a single control by ID (e.g. AC-2; enhancements use AC-2-1)
GET/controls/{id}/crosswalkCSF 2.0 subcategory crosswalk for a control
GET/familiesList the 20 control families
GET/csf/functionsList CSF 2.0 functions with their subcategories
GET/families/{code}/controlsList all controls in a family (e.g. AC)
GET/csf/{functionId}/controlsList controls mapped to a CSF function (e.g. PR)
GET/baselines/{baseline}/controlsList all controls in a baseline (low, moderate, or high)
Example request
curl https://api.nistcontrols.io/v1/families/AC/controls
200 response
{
  "count": 2,
  "results": [
    {
      "id": "AC-2",
      "title": "Account Management",
      "family": "AC",
      "baselines": ["low", "moderate", "high"],
      "csf": ["PR"]
    },
    {
      "id": "AC-3",
      "title": "Access Enforcement",
      "family": "AC",
      "baselines": ["high"],
      "csf": ["ID"]
    }
  ]
}
Errors
404not_foundThe path doesn't match any route, or the {id}/{code}/{functionId}/{baseline} value doesn't exist
Smithy contract

The API is formally defined using Smithy, an interface definition language (IDL) for defining services and their data shapes. Download the contract files below to generate clients, validate requests, or integrate with your own tooling.

nistcontrols.smithyComplete API contract (service, operations, structures, and errors)↓
smithy-build.jsonBuild configuration for Smithy CLI validation↓
Getting started with Smithy

Smithy is an open-source IDL maintained by AWS for defining HTTP services. You can use these contract files to generate typed API clients in TypeScript, Python, Java, Go, and more, or to validate this API's responses against the schema.