Changelog#

2026-10-09#

[Breaking] Replace control with controlSnapshot on scoped controls
ScopedControl.control is replaced by controlSnapshot, a digest of the control as it was when it was put in scope: id (the snapshot id), evergreenControlId, controlId and name. The old control.id is now controlSnapshot.evergreenControlId. No endpoint returns a snapshot by its id; use evergreenControlId with the Controls API to fetch the control. evergreenControlId is null when the control was permanently deleted.
[Bug Fix] Report $filter and $orderBy errors on scoped controls by parameter
A bad $filter or $orderBy on the scoped-controls list now returns 400 with code invalidFilter or invalidOrderBy and the parameter as target.

[Breaking] Rename the scoped-controls re-addition operation to restoration
Renamed POST /assuranceProjects/{id}/scopedControls/reAddition to POST /assuranceProjects/{id}/scopedControls/restoration.
[Breaking] Align Project Scope with the service contract
The scoped-controls list now returns in-scope and removed entries by default, and no longer supports filtering on control.controlId. ScopedControl.control is nullable for entries whose control was permanently deleted. Addition returns only the entries it created and skips controls already in the project. Removal and restoration are idempotent: entries already in the target state take the new rationale, unmatched ids are skipped, and the matched entries are returned in request order. The scope operations return 409 with code unsupportedProjectType for projects other than Independent Controls Testing.

[Information] Remove the Wk-Organization request header
Removed the Wk-Organization header parameter. It is no longer required to select the tenant.

[Breaking] Limit the Risk and Control Matrix preview
Removed the process, subprocess, system, and location operations from the public preview. Controls and risks remain available with list, single, and batch retrieval.
[Bug Fix] Align controls and risks with the service contract
Updated the controls and risks schemas, examples, and supported control filters to match the implemented grc-evergreen public API contract.

[Feature] Initial feature preview release
Initial feature preview release of the 2026-09-01.grc.preview API.
[Feature] Paginate the authenticated user’s memberships
- Memberships
Added $maxpagesize, $next, and @nextLink pagination to GET /me/memberships. Pagination is applied after filtering, and next-page cursors preserve the filter and page size.