Changelog

rss_feed Subscribe via RSS

2026-10-19

• [Feature] Add remediation issues to the GRC preview
  Added GET /issues, GET /issues/{id}, PATCH /issues/{id} and POST /issues/batchRetrieval, which takes up to 50 ids. Issues can be filtered and sorted, and the list omits the detail fields (description, rootCause, supplementalInformation, resolutionNote). Issues carry created and modified (dateTime and user), can be sorted by created.dateTime, and return targetRemediationDate as a date (YYYY-MM-DD). An issue has at most 10 collaborators, 5 controls, processes and risks each, and 100 custom fields. PATCH applies a JSON Patch with replace operations only and requires the grc:write scope; status transitions are not supported.

• [Feature] Add action tasks on remediation issues to the GRC preview
  Added GET /issues/{issueId}/actionTasks, GET /issues/{issueId}/actionTasks/{id}, PATCH /issues/{issueId}/actionTasks/{id}, POST /issues/{issueId}/actionTasks/{id}/externalSubmission and POST /issues/{issueId}/actionTasks/{id}/implementation. Action tasks carry created and modified (dateTime and user) and an issue reference ({ id }). An issue has at most 10 action tasks and the list returns all of them in one page; compare each action task’s modified.dateTime with the value from a previous sync to detect changes. A PATCH on an implemented or cancelled action task returns 409. The write operations require the grc:write scope.

• [Feature] Add asynchronous issue export to the GRC preview
  Added POST /issues/export, which starts an export of remediation issues to a CSV or JSONL file and returns 202 with a Location header. Poll the new GET /operations/{operationId} endpoint until the operation completes, then download the file from its resourceUrl. Use updatedAt to export issues created or changed in a window, for incremental sync, and deduplicate by id and modified.dateTime. Requires the grc:read scope.

2026-10-09

• [Breaking] Replace control with controlSnapshot on scoped controls
  ScopedControl.control is replaced by controlSnapshot, a digest of the control as it was when it was put in scope: id (the snapshot id), evergreenControlId, controlId and name. The old control.id is now controlSnapshot.evergreenControlId. No endpoint returns a snapshot by its id; use evergreenControlId with the Controls API to fetch the control. evergreenControlId is null when the control was permanently deleted.

• [Bug Fix] Report $filter and $orderBy errors on scoped controls by parameter
  A bad $filter or $orderBy on the scoped-controls list now returns 400 with code invalidFilter or invalidOrderBy and the parameter as target.

2026-10-05

• [Breaking] Rename the scoped-controls re-addition operation to restoration
  Renamed POST /assuranceProjects/{id}/scopedControls/reAddition to POST /assuranceProjects/{id}/scopedControls/restoration.

• [Breaking] Align Project Scope with the service contract
  The scoped-controls list now returns in-scope and removed entries by default, and no longer supports filtering on control.controlId. ScopedControl.control is nullable for entries whose control was permanently deleted. Addition returns only the entries it created and skips controls already in the project. Removal and restoration are idempotent: entries already in the target state take the new rationale, unmatched ids are skipped, and the matched entries are returned in request order. The scope operations return 409 with code unsupportedProjectType for projects other than Independent Controls Testing.

2026-09-22

• [Information] Remove the Wk-Organization request header
  Removed the Wk-Organization header parameter. It is no longer required to select the tenant.

2026-09-10

• [Breaking] Limit the Risk and Control Matrix preview
  Removed the process, subprocess, system, and location operations from the public preview. Controls and risks remain available with list, single, and batch retrieval.

• [Bug Fix] Align controls and risks with the service contract
  Updated the controls and risks schemas, examples, and supported control filters to match the implemented grc-evergreen public API contract.

2026-09-01

• [Feature] Initial feature preview release
  Initial feature preview release of the 2026-09-01.grc.preview API.

• [Feature] Paginate the authenticated user’s memberships

  • Memberships

  Added $maxpagesize, $next, and @nextLink pagination to GET /me/memberships. Pagination is applied after filtering, and next-page cursors preserve the filter and page size.