Skip to main content
POST
/
risk-scenarios
/
{riskScenarioId}
/
controls
Add a control to a risk scenario
curl --request POST \
  --url https://api.vanta.com/v1/risk-scenarios/{riskScenarioId}/controls \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '
{
  "controlId": "<string>"
}
'
{
  "controlId": "A.12.2.1",
  "controlType": "TREATMENT_PLAN"
}

Authorizations

​
Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

​
riskScenarioId
string
required

Body

application/json
​
controlId
string
required

Control to associate with the risk scenario. Accepts Vanta control shorthands (e.g. "A.12.2.1"), custom-control shorthand names, or object IDs.

​
controlType
enum<string>

TREATMENT_PLAN for a control that is part of the risk's treatment plan. Omit (or pass "EXISTING") to associate the control without a treatment-plan designation — the default "existing control" relationship.

Available options:
EXISTING,
TREATMENT_PLAN

Response

200 - application/json

Ok

A control's association with a risk scenario.

The relationship identity is (riskScenarioId, controlId); controlType is mutable state on that relationship. A given control can have at most one association per risk scenario.

​
controlId
string
required

The control's shorthand identifier (e.g. "A.12.2.1") when it has one, falling back to the canonical Vanta control id (Mongo object id) otherwise.

​
controlType
enum<string>
required

TREATMENT_PLAN for controls that are part of the risk's treatment plan (planned mitigations); EXISTING for controls linked to the risk without a treatment-plan designation.

Available options:
EXISTING,
TREATMENT_PLAN