Ctrl+K

Workiva GRC API Preview

Workiva GRC API Preview#

The Workiva GRC API provides programmatic access to your Governance, Risk, and Compliance data. The initial preview exposes Risk & Control Matrix (RCM) controls and risks as read-only resources, including digest context for the processes, subprocesses, systems, and locations that organize them. It also exposes assurance projects, where you can read a project and read and manage the set of controls in its scope. Additional GRC resource types will be added under the same API over time.

Key concepts:

  • Control: A safeguard or activity that mitigates one or more risks. A control may be standalone, a definition (a template), or an instance (a definition applied to a specific location or system). All three are returned in one unified shape. A workspace is in either standalone mode or multi-instance mode, and unfiltered lists return the types that belong to that mode.

  • Risk: A potential event that controls are designed to mitigate.

  • Process / SubProcess: Digest context for the business-process hierarchy that groups risks and controls.

  • System / Location: Digest context for the application and place dimensions a control applies to.

  • Assurance Project: A governance or audit project, such as an independent controls-testing engagement. You can list and read projects, and read and manage which controls are in a project’s scope.

Relationships between resources are returned as lightweight digests (an id plus a few display fields). Controls and risks can be retrieved in full by their digest id. Processes, subprocesses, systems, and locations remain digest-only in this preview. See Digests.

Using This Preview#

The GRC API is released as a new version of the Workiva API (see Versioning). To use this feature preview, include an X-Version header with the value 2026-09-01.grc.preview on every request, along with the Wk-Workspace header that selects the workspace to operate in. Authenticate with an OAuth 2.0 bearer token obtained through the flow described in Authentication. You can then call any of the endpoints documented in this preview.

Preview Status#

Important

This API is in preview status. Always include X-Version: 2026-09-01.grc.preview on all requests. The API may change before general availability — do not rely on it for business-critical production workflows until GA.

For preview terms, expectations, and lifecycle details, see API Previews at Workiva.