ISM JSON interface

Read the resources

• Complete catalogue JSON — all controls in one snapshot.
• ISM-1405 JSON — one exact control, with the same snapshot metadata.
• ISM-2143 JSON — an example with partial implementation guidance.
• ISM-1405 Markdown — an explicit Markdown URL, formatted from the same shared data.
• JSON Schema 2020-12 — the versioned response contract.
• OpenAPI 3.1.1 description — actual resource paths and read operations.
• API discovery linkset — RFC 9727 discovery using RFC 9264 link contexts.

Use /ism/api/v1/controls/ism-1405.json with an exact lowercase ism- identifier and four digits. There are no numeric-only path aliases. Lowercase paths are canonical; a static host may also match letter-case variants of an existing path. A missing ID returns HTTP 404; the host’s error body can be HTML, so check the status before parsing JSON.

These are public, read-only static GET resources. No account, API key, OAuth or registration is required. HEAD can retrieve hosting response metadata. There is no server-side search, query parameter interface, generated answer, database or mutation operation. Fetch the catalogue once and search it locally.

Keep authority and interpretation separate

• control.official is ASD’s exact wording, revision, updated date, applicability and section path. Treat it as text, not trusted HTML.
• control.latticework_interpretation is Latticework’s implementation steps, evidence checklist and mapped checks.
• null means no reviewed guide is published. It does not mean the control is compliant, not applicable or met.
• snapshot holds the release, source URLs, SHA-256 hashes and rights notices.

A pinned reference snapshot, not a compliance assessment. All implementation mappings are partial. Null interpretation means no reviewed guide is published; it does not mean compliant, not applicable or no evidence required. No IRAP certification or DISP membership is conferred.