Skip to content
Vendorica Developer Docs

Update a risk scenario

PUT
/risk-scenarios/{id}
curl --request PUT \
  --url https://api.vendorica.com/v1/risk-scenarios/2489E9AD-2EE2-8E00-8EC9-32D5F69181C0 \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{ "title": "example", "description": "example", "categoryId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "riskType": [ "confidentiality" ], "inherentLikelihood": 1, "inherentImpact": 1, "residualLikelihood": 1, "residualImpact": 1, "lifecycleStatus": "open", "treatment": "mitigate", "treatmentPlan": "example", "ownerUserId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "targetResolutionDate": "2026-04-15", "vendorId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "businessFunctionId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "controlId": "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0", "businessUnitIds": [ "2489E9AD-2EE2-8E00-8EC9-32D5F69181C0" ], "expectedUpdatedAt": "2026-04-15T12:00:00Z" }'

Patches a scenario’s content. A submitted value that EQUALS the stored one is not a change: a request in which nothing differs writes no row, bumps no updatedAt and files no audit entry. Pass the optional expectedUpdatedAt precondition (ADR-0022) to be refused 409 RECORD_MODIFIED rather than overwrite an edit that landed since you read the record; omitting it is last-write-wins, unchanged. Editing an approved scenario returns it to needs_review and discards its approvals — a decision describes a record, and the record moved. approvalStatus and isArchived are refused: both are transitions with their own endpoints.

Authorizations

Section titled “Authorizations”

Parameters

Section titled “Parameters”

Path Parameters

Section titled “Path Parameters”
id
required
string format: uuid

Request Bodyrequired

Section titled “Request Bodyrequired”
Media typeapplication/json
object
title
string
>= 1 characters <= 255 characters
description
string
<= 4000 characters
categoryId
string | null format: uuid
riskType
Array<string> | null
<= 3 items
Allowed values: confidentiality integrity availability
inherentLikelihood
integer | null
>= 1 <= 5
inherentImpact
integer | null
>= 1 <= 5
residualLikelihood
integer | null
>= 1 <= 5
residualImpact
integer | null
>= 1 <= 5
lifecycleStatus
string
Allowed values: open mitigating accepted closed
treatment
string | null
Allowed values: mitigate accept transfer avoid
treatmentPlan
string
<= 4000 characters
ownerUserId
string | null format: uuid
targetResolutionDate
string | null format: date
vendorId
string | null format: uuid
businessFunctionId
string | null format: uuid
controlId
string | null format: uuid
businessUnitIds
Array<string>
<= 100 items
expectedUpdatedAt
string format: date-time

Responses

Section titled “Responses”

200

Section titled “200”

Success

Media typeapplication/json
object
success
required
boolean
data
required
object
id
required
string format: uuid
organizationId
required
string format: uuid
registerId
required
string format: uuid
displayId
required
string
title
required
string
description
required
string | null
categoryId
required
string | null format: uuid
riskType
required
Array<string> | null
Allowed values: confidentiality integrity availability
inherentLikelihood
required
integer | null
inherentImpact
required
integer | null
residualLikelihood
required
integer | null
residualImpact
required
integer | null
lifecycleStatus
required
string
Allowed values: open mitigating accepted closed
approvalStatus
required
string
Allowed values: draft needs_review pending_approval approved
isArchived
required
boolean
treatment
required
string | null
Allowed values: mitigate accept transfer avoid
treatmentPlan
required
string | null
ownerUserId
required
string | null format: uuid
targetResolutionDate
required
string | null
vendorId
required
string | null format: uuid
businessFunctionId
required
string | null format: uuid
controlId
required
string | null format: uuid
sourceTemplateId
required
string | null format: uuid
businessUnitIds
required
Array<string>
createdBy
required
string | null format: uuid
createdAt
required
string | null format: date-time
updatedAt
required
string | null format: date-time
inherentScore
required
integer | null
residualScore
required
integer | null
timestamp
required
string format: date-time
requestId
string
message
string
Example
{
  "success": true,
  "data": {
    "id": "21101191-9f4b-4a69-8e1d-44de7213632e",
    "organizationId": "59c6770c-616d-4b0a-883f-7f2b4af536fd",
    "registerId": "bd3bb052-34f6-4df0-8321-75896aac0cf7",
    "displayId": "string",
    "title": "string",
    "description": "string",
    "categoryId": "3d623995-38a0-48b5-8ae9-968223b7f4f2",
    "riskType": [
      "confidentiality"
    ],
    "inherentLikelihood": 1,
    "inherentImpact": 1,
    "residualLikelihood": 1,
    "residualImpact": 1,
    "lifecycleStatus": "open",
    "approvalStatus": "draft",
    "isArchived": true,
    "treatment": "mitigate",
    "treatmentPlan": "string",
    "ownerUserId": "48f20193-65f8-4743-8623-b9c0ae3d6f8c",
    "targetResolutionDate": "string",
    "vendorId": "9b61e63b-d41d-4bbb-8250-92a830d6e4c4",
    "businessFunctionId": "8f883923-1471-4ef3-8f5b-23d0307966bc",
    "controlId": "540c8a1c-6dbd-4d3a-8a32-f0bb9d30fcad",
    "sourceTemplateId": "37896b88-f754-4a3e-86b0-de073b6d7eb9",
    "businessUnitIds": [
      "09f21e56-fc25-4e3c-8e6a-7d2d3aa3078b"
    ],
    "createdBy": "fd7d4923-2d3a-4ef3-827e-b3d0217516bc",
    "createdAt": "2026-08-19T09:41:12.004Z",
    "updatedAt": "2026-08-19T09:41:12.004Z",
    "inherentScore": 1,
    "residualScore": 1
  },
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H",
  "message": "string"
}

400

Section titled “400”

Validation error

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Bad request",
  "code": "BAD_REQUEST",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

401

Section titled “401”

Unauthorized

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Unauthorized",
  "code": "UNAUTHORIZED",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

403

Section titled “403”

Forbidden — missing scope

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Forbidden",
  "code": "FORBIDDEN",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

404

Section titled “404”

No such scenario in this organization

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Resource not found",
  "code": "NOT_FOUND",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

409

Section titled “409”

The record changed since expectedUpdatedAt (RECORD_MODIFIED)

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false
}

422

Section titled “422”

Unrecognised or invalid field — the response names it

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Validation failed",
  "code": "VALIDATION_ERROR",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}

429

Section titled “429”

Rate limit exceeded

Media typeapplication/json
object
success
required
boolean
error
required
string
code
required
string
details
timestamp
required
string format: date-time
requestId
string
Example
{
  "success": false,
  "error": "Too many requests",
  "code": "TOO_MANY_REQUESTS",
  "timestamp": "2026-08-19T09:41:12.004Z",
  "requestId": "req_01J5X8ZC3K4T7Q9M2W6B0N1V4H"
}