Update a risk scenario

PUT

/risk-scenarios/{id}

using System.Net.Http.Headers;
var client = new HttpClient();
var request = new HttpRequestMessage
{
    Method = HttpMethod.Put,
    RequestUri = new Uri("https://api.vendorica.com/v1/risk-scenarios/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"),
    Headers =
    {
        { "Authorization", "Bearer <token>" },
    },
    Content = new StringContent("{ \"title\": \"example\", \"description\": \"example\", \"categoryId\": \"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0\", \"riskType\": [ \"confidentiality\" ], \"inherentLikelihood\": 1, \"inherentImpact\": 1, \"residualLikelihood\": 1, \"residualImpact\": 1, \"lifecycleStatus\": \"open\", \"treatment\": \"mitigate\", \"treatmentPlan\": \"example\", \"ownerUserId\": \"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0\", \"targetResolutionDate\": \"2026-04-15\", \"vendorId\": \"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0\", \"businessFunctionId\": \"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0\", \"controlId\": \"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0\", \"businessUnitIds\": [ \"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0\" ], \"expectedUpdatedAt\": \"2026-04-15T12:00:00Z\" }")
    {
        Headers =
        {
            ContentType = new MediaTypeHeaderValue("application/json")
        }
    }
};
using (var response = await client.SendAsync(request))
{
    response.EnsureSuccessStatusCode();
    var body = await response.Content.ReadAsStringAsync();
    Console.WriteLine(body);
}

package main

import (
  "fmt"
  "strings"
  "net/http"
  "io"
)

func main() {

  url := "https://api.vendorica.com/v1/risk-scenarios/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"

  payload := strings.NewReader("{ \"title\": \"example\", \"description\": \"example\", \"categoryId\": \"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0\", \"riskType\": [ \"confidentiality\" ], \"inherentLikelihood\": 1, \"inherentImpact\": 1, \"residualLikelihood\": 1, \"residualImpact\": 1, \"lifecycleStatus\": \"open\", \"treatment\": \"mitigate\", \"treatmentPlan\": \"example\", \"ownerUserId\": \"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0\", \"targetResolutionDate\": \"2026-04-15\", \"vendorId\": \"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0\", \"businessFunctionId\": \"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0\", \"controlId\": \"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0\", \"businessUnitIds\": [ \"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0\" ], \"expectedUpdatedAt\": \"2026-04-15T12:00:00Z\" }")

  req, _ := http.NewRequest("PUT", url, payload)

  req.Header.Add("Authorization", "Bearer <token>")
  req.Header.Add("Content-Type", "application/json")

  res, _ := http.DefaultClient.Do(req)

  defer res.Body.Close()
  body, _ := io.ReadAll(res.Body)

  fmt.Println(res)
  fmt.Println(string(body))

}

OkHttpClient client = new OkHttpClient();

MediaType mediaType = MediaType.parse("application/json");
RequestBody body = RequestBody.create(mediaType, "{ \"title\": \"example\", \"description\": \"example\", \"categoryId\": \"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0\", \"riskType\": [ \"confidentiality\" ], \"inherentLikelihood\": 1, \"inherentImpact\": 1, \"residualLikelihood\": 1, \"residualImpact\": 1, \"lifecycleStatus\": \"open\", \"treatment\": \"mitigate\", \"treatmentPlan\": \"example\", \"ownerUserId\": \"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0\", \"targetResolutionDate\": \"2026-04-15\", \"vendorId\": \"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0\", \"businessFunctionId\": \"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0\", \"controlId\": \"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0\", \"businessUnitIds\": [ \"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0\" ], \"expectedUpdatedAt\": \"2026-04-15T12:00:00Z\" }");
Request request = new Request.Builder()
  .url("https://api.vendorica.com/v1/risk-scenarios/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0")
  .put(body)
  .addHeader("Authorization", "Bearer <token>")
  .addHeader("Content-Type", "application/json")
  .build();

Response response = client.newCall(request).execute();

const url = 'https://api.vendorica.com/v1/risk-scenarios/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0';
const options = {
  method: 'PUT',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{"title":"example","description":"example","categoryId":"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0","riskType":["confidentiality"],"inherentLikelihood":1,"inherentImpact":1,"residualLikelihood":1,"residualImpact":1,"lifecycleStatus":"open","treatment":"mitigate","treatmentPlan":"example","ownerUserId":"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0","targetResolutionDate":"2026-04-15","vendorId":"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0","businessFunctionId":"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0","controlId":"2489E9AD-2EE2-8E00-8EC9-32D5F69181C0","businessUnitIds":["2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"],"expectedUpdatedAt":"2026-04-15T12:00:00Z"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}

use std::str::FromStr;
use serde_json::json;
use reqwest;

#[tokio::main]
pub async fn main() {
    let url = "https://api.vendorica.com/v1/risk-scenarios/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0";

    let payload = json!({
        "title": "example",
        "description": "example",
        "categoryId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
        "riskType": ("confidentiality"),
        "inherentLikelihood": 1,
        "inherentImpact": 1,
        "residualLikelihood": 1,
        "residualImpact": 1,
        "lifecycleStatus": "open",
        "treatment": "mitigate",
        "treatmentPlan": "example",
        "ownerUserId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
        "targetResolutionDate": "2026-04-15",
        "vendorId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
        "businessFunctionId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
        "controlId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0",
        "businessUnitIds": ("2489E9AD-2EE2-8E00-8EC9-32D5F69181C0"),
        "expectedUpdatedAt": "2026-04-15T12:00:00Z"
    });

    let mut headers = reqwest::header::HeaderMap::new();
    headers.insert("Authorization", "Bearer <token>".parse().unwrap());
    headers.insert("Content-Type", "application/json".parse().unwrap());

    let client = reqwest::Client::new();
    let response = client.request(reqwest::Method::from_str("PUT").unwrap(), url)
        .headers(headers)
        .json(&payload)
        .send()
        .await;

    let results = response.unwrap()
        .json::<serde_json::Value>()
        .await
        .unwrap();

    dbg!(results);
}

curl --request PUT \
  --url https://api.vendorica.com/v1/risk-scenarios/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0 \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "title": "example", "description": "example", "categoryId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "riskType": [ "confidentiality" ], "inherentLikelihood": 1, "inherentImpact": 1, "residualLikelihood": 1, "residualImpact": 1, "lifecycleStatus": "open", "treatment": "mitigate", "treatmentPlan": "example", "ownerUserId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "targetResolutionDate": "2026-04-15", "vendorId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "businessFunctionId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "controlId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "businessUnitIds": [ "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" ], "expectedUpdatedAt": "2026-04-15T12:00:00Z" }'

Patches a scenario’s content. A submitted value that EQUALS the stored one is not a change: a request in which nothing differs writes no row, bumps no updatedAt and files no audit entry. Pass the optional expectedUpdatedAt precondition (ADR-0022) to be refused 409 RECORD_MODIFIED rather than overwrite an edit that landed since you read the record; omitting it is last-write-wins, unchanged. Editing an approved scenario returns it to needs_review and discards its approvals — a decision describes a record, and the record moved. approvalStatus and isArchived are refused: both are transitions with their own endpoints.

Authorizations

bearerAuth
risks:write

Parameters

Path Parameters

required

string format: uuid

Request Body^required

application/json

object

title

string

>= 1 characters <= 255 characters

description

string

<= 4000 characters

categoryId

string | null format: uuid

riskType

Array<string> | null

<= 3 items

Allowed values: confidentiality integrity availability

inherentLikelihood

integer | null

>= 1 <= 5

inherentImpact

integer | null

>= 1 <= 5

residualLikelihood

integer | null

>= 1 <= 5

residualImpact

integer | null

>= 1 <= 5

lifecycleStatus

string

Allowed values: open mitigating accepted closed

treatment

string | null

Allowed values: mitigate accept transfer avoid

treatmentPlan

string

<= 4000 characters

ownerUserId

string | null format: uuid

targetResolutionDate

string | null format: date

vendorId

string | null format: uuid

businessFunctionId

string | null format: uuid

controlId

string | null format: uuid

businessUnitIds

Array<string>

<= 100 items

expectedUpdatedAt

string format: date-time

Responses

200

Success

application/json

object

success

required

boolean

data

required

object

required

string format: uuid

organizationId

required

string format: uuid

registerId

required

string format: uuid

displayId

required

string

title

required

string

description

required

string | null

categoryId

required

string | null format: uuid

riskType

required

Array<string> | null

Allowed values: confidentiality integrity availability

inherentLikelihood

required

integer | null

inherentImpact

required

integer | null

residualLikelihood

required

integer | null

residualImpact

required

integer | null

lifecycleStatus

required

string

Allowed values: open mitigating accepted closed

approvalStatus

required

string

Allowed values: draft needs_review pending_approval approved

isArchived

required

boolean

treatment

required

string | null

Allowed values: mitigate accept transfer avoid

treatmentPlan

required

string | null

ownerUserId

required

string | null format: uuid

targetResolutionDate

required

string | null

vendorId

required

string | null format: uuid

businessFunctionId

required

string | null format: uuid

controlId

required

string | null format: uuid

sourceTemplateId

required

string | null format: uuid

businessUnitIds

required

Array<string>

createdBy

required

string | null format: uuid

createdAt

required

string | null format: date-time

updatedAt

required

string | null format: date-time

inherentScore

required

number | null

residualScore

required

number | null

timestamp

required

string format: date-time

requestId

string

message

string

Example

{
  "success": true,
  "data": {
    "id": "21101191-9f4b-4a69-8e1d-44de7213632e",
    "organizationId": "59c6770c-616d-4b0a-883f-7f2b4af536fd",
    "registerId": "bd3bb052-34f6-4df0-8321-75896aac0cf7",
    "displayId": "string",
    "title": "string",
    "description": "string",
    "categoryId": "3d623995-38a0-48b5-8ae9-968223b7f4f2",
    "riskType": [
      "confidentiality"
    ],
    "inherentLikelihood": 1,
    "inherentImpact": 1,
    "residualLikelihood": 1,
    "residualImpact": 1,
    "lifecycleStatus": "open",
    "approvalStatus": "draft",
    "isArchived": true,
    "treatment": "mitigate",
    "treatmentPlan": "string",
    "ownerUserId": "48f20193-65f8-4743-8623-b9c0ae3d6f8c",
    "targetResolutionDate": "string",
    "vendorId": "9b61e63b-d41d-4bbb-8250-92a830d6e4c4",
    "businessFunctionId": "8f883923-1471-4ef3-8f5b-23d0307966bc",
    "controlId": "540c8a1c-6dbd-4d3a-8a32-f0bb9d30fcad",
    "sourceTemplateId": "37896b88-f754-4a3e-86b0-de073b6d7eb9",
    "businessUnitIds": [
      "09f21e56-fc25-4e3c-8e6a-7d2d3aa3078b"
    ],
    "createdBy": "fd7d4923-2d3a-4ef3-827e-b3d0217516bc",
    "createdAt": "2026-08-19T09:41:12.004Z",
    "updatedAt": "2026-08-19T09:41:12.004Z",
    "inherentScore": 1,
    "residualScore": 1
  },
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H",
  "message": "string"
}

400

Validation error

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Bad request",
  "code": "BAD_REQUEST",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

401

Unauthorized

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Unauthorized",
  "code": "UNAUTHORIZED",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

403

Forbidden — missing scope

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Forbidden",
  "code": "FORBIDDEN",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

404

No such scenario in this organization

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Resource not found",
  "code": "NOT_FOUND",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

409

The record changed since expectedUpdatedAt (RECORD_MODIFIED)

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false
}

422

Unrecognised or invalid field — the response names it

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Validation failed",
  "code": "VALIDATION_ERROR",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

429

Rate limit exceeded

application/json

object

success

required

boolean

error

required

string

code

required

string

details

timestamp

required

string format: date-time

requestId

string

Example

{
  "success": false,
  "error": "Too many requests",
  "code": "TOO_MANY_REQUESTS",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

Update a risk scenario

Authorizations

Parameters

Path Parameters

Request Bodyrequired

Responses

200

Example

400

Example

401

Example

403

Example

404

Example

409

Example

422

Example

429

Example

Request Body^required