API reference

A public, read-only JSON API over the full NIST 800-53 catalog and CSF 2.0 crosswalk. Every endpoint is a GET request; there is no authentication and no query string — filters are expressed as path segments.

All endpoints below are deployed and publicly reachable at https://api.nistcontrols.com/v1. Responses are read-only, cached at the edge, and served with Content-Type: application/json.

Base URL

https://api.nistcontrols.com/v1

Authentication

None — every endpoint is public and read-only

Endpoints

GET/controlsList every control summary

GET/controls/{id}Retrieve a single control by ID (e.g. AC-2; enhancements use AC-2-1)

GET/controls/{id}/crosswalkCSF 2.0 subcategory crosswalk for a control

GET/familiesList the 20 control families

GET/csf/functionsList CSF 2.0 functions with their subcategories

GET/families/{code}/controlsList all controls in a family (e.g. AC)

GET/csf/{functionId}/controlsList controls mapped to a CSF function (e.g. PR)

GET/baselines/{baseline}/controlsList all controls in a baseline (low, moderate, or high)

Example request

curl https://api.nistcontrols.com/v1/families/AC/controls

200 response

{
  "count": 2,
  "results": [
    {
      "id": "AC-2",
      "title": "Account Management",
      "family": "AC",
      "baselines": ["low", "moderate", "high"],
      "csf": ["PR"]
    },
    {
      "id": "AC-3",
      "title": "Access Enforcement",
      "family": "AC",
      "baselines": ["high"],
      "csf": ["ID"]
    }
  ]
}

Errors

404not_foundThe path doesn't match any route, or the {id}/{code}/{functionId}/{baseline} value doesn't exist

Smithy contract

The API is formally defined using Smithy, an interface definition language (IDL) for defining services and their data shapes. Download the contract files below to generate clients, validate requests, or integrate with your own tooling.

nistcontrols.smithyComplete API contract (service, operations, structures, and errors)↓

smithy-build.jsonBuild configuration for Smithy CLI validation↓

Getting started with Smithy

Smithy is an open-source IDL maintained by AWS for defining HTTP services. You can use these contract files to generate typed API clients in TypeScript, Python, Java, Go, and more, or to validate this API's responses against the schema.

Smithy Quick Start Guide — Install the CLI and validate a model in minutes
Smithy IDL Specification — Full language reference for reading .smithy files
Smithy CLI Installation — Install the Smithy CLI to validate and build models
Code Generation Guide — Generate typed clients from Smithy models

Markdown corpus

The Markdown Corpus is an alternative to the live v1 API for LLM consumption: the same catalog and CSF 2.0 crosswalk, published as plain text/markdown documents you can fetch or paste straight into a prompt instead of parsing JSON responses.

Browse the Markdown Corpus