# riskregister.com

> riskregister.com is a system of record for risk registers. AI assistants read and change registers through its MCP endpoint and REST API, acting as the person whose token they use. A whole register an assistant saves, or starts from a template, lands as a draft, and a change sent as a document as a proposal, for a person to review in the app. A register an assistant has riskregister.com's own AI generate follows its access: a draft with Ask me first, a working register with Make changes; Read only can't generate one. With Make changes, the single-record tools change a register directly too. Every change is in the audit log.

Every page in the sections below is markdown. `https://riskregister.com/llms-full.txt` holds them all in one file.

## Start here

- [API overview](https://riskregister.com/docs/overview.md): What the REST API and the MCP endpoint offer, and where each guide is.
- [Getting started](https://riskregister.com/docs/getting-started.md): A token, a first call, and the first register.
- [MCP endpoint](https://riskregister.com/docs/mcp.md): Connecting an AI assistant: the URL, the tools, and how a tool call behaves (results, errors, idempotency, limits).
- [Connect an AI assistant](https://riskregister.com/docs/connect-assistants.md): Setting up Claude Code, VS Code, Cursor, Gemini CLI and Codex CLI with a token, where each keeps it, and what to do if it does not connect.
- [Drafts and proposals](https://riskregister.com/docs/drafts-and-proposals.md): How saved work waits for a person: drafts, proposals against a revision, adoption in the app, who is emailed, and what writes go straight in.
- [Reviewing a register your assistant wrote](https://riskregister.com/docs/reviewing-a-draft.md): What to check before you adopt a draft: risks that don't belong, scores you can't support, duplicates, controls on paper, owners and categories.

## Using the API

- [Authentication](https://riskregister.com/docs/authentication.md): Personal access tokens and organisation API keys: what each reads and writes, and their limits.
- [Errors](https://riskregister.com/docs/errors.md): The error envelope, its codes and subcodes, and what to do about each.
- [Idempotency](https://riskregister.com/docs/idempotency.md): Retrying a write safely with an Idempotency-Key.
- [ETag concurrency](https://riskregister.com/docs/etag-concurrency.md): Changing a record only if it is as you read it.
- [Pagination](https://riskregister.com/docs/pagination.md): Cursor pages, and how filters travel with them.
- [Rate limits](https://riskregister.com/docs/rate-limits.md): The read and write limits, and what a 429 says.

## Reference

- [The register document (v5)](https://riskregister.com/docs/register-document.md): A whole register as one JSON document: its fields, rules and limits, and how drafts and imports treat it.

## Webhooks

- [Webhooks](https://riskregister.com/docs/webhooks.md): Signed event notifications to your endpoint: delivery, retries and replay protection.
- [Webhook event types](https://riskregister.com/docs/webhook-event-types.md): Every event and its payload.
- [Verifying webhook signatures](https://riskregister.com/docs/webhook-signatures.md): Checking an event came from riskregister.com, in your own code.

## Machine-readable

- [OpenAPI specification](https://riskregister.com/docs/api/openapi.yaml): the REST API's contract, every route and field.
- [Register document JSON Schema](https://riskregister.com/schemas/register/v5.json): the v5 document a save takes and a read returns.