Skip to content
Vendorica Developer Docs

Create a risk scenario

POST
/risk-scenarios
curl --request POST \
  --url https://api.vendorica.com/v1/risk-scenarios \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "registerId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "title": "example", "description": "example", "categoryId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "riskType": [ "confidentiality" ], "inherentLikelihood": 1, "inherentImpact": 1, "residualLikelihood": 1, "residualImpact": 1, "lifecycleStatus": "open", "treatment": "mitigate", "treatmentPlan": "example", "ownerUserId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "targetResolutionDate": "2026-04-15", "vendorId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "businessFunctionId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "businessUnitIds": [ "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" ] }'

Creates a scenario in an existing register, which registerId must name — a register in another organization is refused 400, not 404, because the reference came from the body rather than the URL. The scenario is assigned the next R-N display id under that register and always starts approvalStatus: "draft": approval is a state machine with its own endpoints, and a create that could land approved would be a sign-off nobody gave. created_by is left NULL for an API key — no user created the row — and the audit entry attributes the api_client instead.

Authorizations

Section titled “Authorizations”

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
registerId
required
string format: uuid
title
required
string
>= 1 characters <= 255 characters
description
string
<= 4000 characters
categoryId
string | null format: uuid
riskType
Array<string>
<= 3 items
Allowed values: confidentiality integrity availability
inherentLikelihood
integer
>= 1 <= 5
inherentImpact
integer
>= 1 <= 5
residualLikelihood
integer
>= 1 <= 5
residualImpact
integer
>= 1 <= 5
lifecycleStatus
string
Allowed values: open mitigating accepted closed
treatment
string
Allowed values: mitigate accept transfer avoid
treatmentPlan
string
<= 4000 characters
ownerUserId
string | null format: uuid
targetResolutionDate
string format: date
vendorId
string | null format: uuid
businessFunctionId
string | null format: uuid
businessUnitIds
Array<string>
<= 100 items

Responses

Section titled “Responses”

201

Section titled “201”

Success

Media typeapplication/json
object
success
required
boolean
data
required
object
id
required
string format: uuid
organizationId
required
string format: uuid
registerId
required
string format: uuid
displayId
required
string
title
required
string
description
required
string | null
categoryId
required
string | null format: uuid
riskType
required
Array<string> | null
Allowed values: confidentiality integrity availability
inherentLikelihood
required
integer | null
inherentImpact
required
integer | null
residualLikelihood
required
integer | null
residualImpact
required
integer | null
lifecycleStatus
required
string
Allowed values: open mitigating accepted closed
approvalStatus
required
string
Allowed values: draft needs_review pending_approval approved
isArchived
required
boolean
treatment
required
string | null
Allowed values: mitigate accept transfer avoid
treatmentPlan
required
string | null
ownerUserId
required
string | null format: uuid
targetResolutionDate
required
string | null
vendorId
required
string | null format: uuid
businessFunctionId
required
string | null format: uuid
controlId
required
string | null format: uuid
sourceTemplateId
required
string | null format: uuid
businessUnitIds
required
Array<string>
createdBy
required
string | null format: uuid
createdAt
required
string | null format: date-time
updatedAt
required
string | null format: date-time
inherentScore
required
integer | null
residualScore
required
integer | null
timestamp
required
string format: date-time
requestId
string
message
string
Example
{
  "success": true,
  "data": {
    "id": "a75196b5-1c70-4215-8ab8-08a2f5b59d52",
    "organizationId": "836fb6d0-badc-4c96-8e96-0e8f9138e4d1",
    "registerId": "e9369746-64f0-400c-8502-779d4be245db",
    "displayId": "string",
    "title": "string",
    "description": "string",
    "categoryId": "e36dbbe9-f0be-42f1-8e66-12f63cafd2f6",
    "riskType": [
      "confidentiality"
    ],
    "inherentLikelihood": 1,
    "inherentImpact": 1,
    "residualLikelihood": 1,
    "residualImpact": 1,
    "lifecycleStatus": "open",
    "approvalStatus": "draft",
    "isArchived": true,
    "treatment": "mitigate",
    "treatmentPlan": "string",
    "ownerUserId": "5b3b4fdf-7b5e-48e7-8a1d-0eec03be7738",
    "targetResolutionDate": "string",
    "vendorId": "f7e40fe7-2105-457f-86e7-a2345ea45190",
    "businessFunctionId": "9d8e6eff-0438-4847-894a-130c479bf598",
    "controlId": "6ca5eea0-ab36-4906-8c0c-12df5201aec1",
    "sourceTemplateId": "d25a7da4-ca73-4c52-854a-a383db7f6d85",
    "businessUnitIds": [
      "ffada0aa-2653-4878-8116-f9a1cc2afebf"
    ],
    "createdBy": "14c317a7-541e-48bf-8793-4ff43ce6d6d0",
    "createdAt": "2026-08-19T09:41:12.004Z",
    "updatedAt": "2026-08-19T09:41:12.004Z",
    "inherentScore": 1,
    "residualScore": 1
  },
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H",
  "message": "string"
}

400

Section titled “400”

A body reference (registerId, categoryId, ownerUserId, vendorId, businessUnitIds) names a row outside this organization

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Bad request",
  "code": "BAD_REQUEST",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

401

Section titled “401”

Unauthorized

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Unauthorized",
  "code": "UNAUTHORIZED",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

403

Section titled “403”

Forbidden — missing scope

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Forbidden",
  "code": "FORBIDDEN",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

404

Section titled “404”

Not found

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Resource not found",
  "code": "NOT_FOUND",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

422

Section titled “422”

Unrecognised or invalid field — the response names it

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Validation failed",
  "code": "VALIDATION_ERROR",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

429

Section titled “429”

Rate limit exceeded

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Too many requests",
  "code": "TOO_MANY_REQUESTS",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}