riskregister.com Public REST API

This page is an interactive reference that needs JavaScript. The same reference as text: the OpenAPI document at /docs/api/openapi.yaml. The guides, as Markdown: /llms.txt lists them, and /llms-full.txt has them all.

Workspace

Who is calling, and what the workspace allows

• GET /api/v1/me: Who is calling, and what they can do here
• GET /api/v1/me/work: What is waiting for the person a token acts as
• GET /api/v1/members: The people in the workspace

Templates

Framework templates a register can start from

• GET /api/v1/templates: The templates a register can start from
• GET /api/v1/templates/{template}: One template, with its guide and the register document it makes

Registers

Risk registers and the risks within them

• POST /api/v1/registers/from-template: Start a draft register from a template
• GET /api/v1/registers: List registers
• POST /api/v1/registers: Create a register
• POST /api/v1/registers/from-context: Create a register from a free-form business-context paragraph (AI)
• POST /api/v1/registers/from-document: Save a whole register as a draft, from a register document
• GET /api/v1/registers/{registerId}/document: Read a register as its register document
• GET /api/v1/registers/{registerId}/changes: List what changed in a register after a revision
• GET /api/v1/registers/{registerId}/revisions: List a register's retained revisions
• GET /api/v1/registers/{registerId}/revisions/{revision}: Read one retained revision and what made it
• GET /api/v1/registers/export: Export every register of the workspace
• GET /api/v1/registers/{registerId}/export: Export a register as a file
• GET /api/v1/registers/{registerId}/treatment-plan: The register's treatment plan
• GET /api/v1/registers/{registerId}/applicability: The register's Statement of Applicability position, with the recorded decisions
• GET /api/v1/registers/{registerId}/review-queue: What in this register is waiting for a person
• GET /api/v1/registers/{registerId}: Fetch a register
• PATCH /api/v1/registers/{registerId}: Update register
• DELETE /api/v1/registers/{registerId}: Not supported — use POST /archive
• POST /api/v1/registers/{registerId}/archive: Archive (soft-delete) a register
• PUT /api/v1/registers/{registerId}/appetite: Set or clear the register's risk-appetite line
• GET /api/v1/registers/{registerId}/coverage: Register risk↔control coverage

Proposals

An agent's proposed changes to an accepted register, adopted by a person

• GET /api/v1/registers/{registerId}/proposals: List a register's proposals
• POST /api/v1/registers/{registerId}/proposals: Propose a change to an accepted register
• GET /api/v1/registers/{registerId}/proposals/{proposalId}: Read one proposal

Risks

Individual risk records

• GET /api/v1/registers/{registerId}/risks: List risks in a register
• POST /api/v1/registers/{registerId}/risks: Create a risk in a register
• GET /api/v1/risks: Search risks across registers
• GET /api/v1/risks/{riskId}: Fetch a risk
• PATCH /api/v1/risks/{riskId}: Update a risk
• DELETE /api/v1/risks/{riskId}: Delete a risk
• POST /api/v1/risks/{riskId}/assess: Assess a risk
• POST /api/v1/risks/{riskId}/treat: Record a treatment decision
• POST /api/v1/risks/{riskId}/accept: Formally accept a risk
• POST /api/v1/risks/{riskId}/revoke-acceptance: Revoke a risk's active acceptance
• GET /api/v1/risks/{riskId}/acceptances: List a risk's acceptance history
• GET /api/v1/acceptances/{acceptanceId}: Fetch a single acceptance
• PUT /api/v1/risks/{riskId}/controls/{controlId}: Link a control to a risk
• DELETE /api/v1/risks/{riskId}/controls/{controlId}: Unlink a control from a risk

Controls

Org-wide control library

• GET /api/v1/controls: List controls
• POST /api/v1/controls: Create a control
• GET /api/v1/controls/{controlId}: Fetch a control
• PATCH /api/v1/controls/{controlId}: Update a control
• DELETE /api/v1/controls/{controlId}: Delete a control

Implementations

Per-scope control implementations (Business+ only)

• GET /api/v1/controls/{controlId}/implementations: List implementations of a control
• POST /api/v1/control-implementations: Create a control implementation
• GET /api/v1/control-implementations/{implId}: Fetch a control implementation
• PATCH /api/v1/control-implementations/{implId}: Update a control implementation
• DELETE /api/v1/control-implementations/{implId}: Delete a control implementation
• POST /api/v1/control-implementations/{implId}/review: Mark an implementation as reviewed

Scopes

Sites, systems, processes, suppliers (Business+ only)

• GET /api/v1/scopes: List scopes
• POST /api/v1/scopes: Create a scope
• GET /api/v1/scopes/{scopeId}: Fetch a scope
• PATCH /api/v1/scopes/{scopeId}: Update a scope
• DELETE /api/v1/scopes/{scopeId}: Delete a scope

Reference data

Categories and other shared metadata

• GET /api/v1/risk-categories: List risk categories

Audit log

Immutable record of every state change

• GET /api/v1/audit-log: List audit log entries
• GET /api/v1/audit-log/export: Export the audit log (streaming)
• GET /api/v1/audit-retention: Get the audit-log retention policy
• PUT /api/v1/audit-retention: Set the audit-log retention policy
• DELETE /api/v1/audit-retention: Clear the audit-log retention policy
• GET /api/v1/siem-endpoints: List SIEM streaming endpoints
• GET /api/v1/siem-endpoints/{endpointId}: Get a SIEM streaming endpoint

Webhooks

Outbound HMAC-signed event delivery (Business+ only)

• GET /api/v1/webhook-endpoints: List webhook endpoints
• GET /api/v1/webhook-endpoints/{endpointId}: Get a webhook endpoint
• GET /api/v1/webhook-endpoints/{endpointId}/deliveries: List delivery attempts for an endpoint

Reviews

• POST /api/v1/risks/{riskId}/request-review: Request a review on a risk
• POST /api/v1/risks/{riskId}/complete-review: Complete a pending review
• POST /api/v1/risks/{riskId}/record-review: Record a review just done ("Mark reviewed")
• POST /api/v1/risks/{riskId}/cancel-review: Cancel a pending review
• GET /api/v1/risks/{riskId}/reviews: List reviews for a risk
• GET /api/v1/reviews/{reviewId}: Fetch a single review

Treatment actions

• GET /api/v1/risks/{riskId}/treatment-actions: List a risk's treatment plan
• POST /api/v1/risks/{riskId}/treatment-actions: Add an item to a risk's treatment plan
• GET /api/v1/treatment-actions/{actionId}: Fetch a single treatment action
• PATCH /api/v1/treatment-actions/{actionId}: Edit a treatment action's fields
• DELETE /api/v1/treatment-actions/{actionId}: Delete a treatment action
• POST /api/v1/treatment-actions/{actionId}/status: Change a treatment action's status