> ## Documentation Index
> Fetch the complete documentation index at: https://developer.vanta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Add a control to a risk scenario

> Associate a control with a risk scenario.

Body: `{ controlId, controlType? }`. `controlType` is `TREATMENT_PLAN`
for a control that is part of the risk's treatment plan; omit it (or pass
`EXISTING`) to associate the control as a plain existing control.

`controlId` may be a Vanta control shorthand, custom-control shorthand,
or object ID; it resolves to a single canonical control before any write.

Behavior on conflict with an existing association:
- Same resolved control already associated with the same `controlType`:

  the request is a no-op and the existing relationship is returned (200).
- Same resolved control associated with the other `controlType`: the

  request is rejected with a hint to use `PATCH` instead (422).



## OpenAPI

````yaml /reference/manage-vanta.json post /risk-scenarios/{riskScenarioId}/controls
openapi: 3.0.0
info:
  title: Manage Vanta
  version: 1.0.0
  description: >-
    The REST API lets customers query and mutate Vanta's data. Use this API to
    automate bulk actions, query data for custom workflows and dashboards, and
    bolster your security operations


    **Note for Vanta Gov (FedRAMP) customers:** Select `Vanta Gov (FedRAMP)`
    from the server dropdown to issue requests against
    `https://api.vanta-gov.com`. The OAuth token URL shown below defaults to the
    commercial host — replace it with `https://api.vanta-gov.com/oauth/token`.
  termsOfService: https://www.vanta.com/terms
  license:
    name: UNLICENSED
  contact:
    name: API Support
    url: https://help.vanta.com/
    email: support@vanta.com
servers:
  - url: https://api.vanta.com/v1
    description: Vanta (Commercial)
  - url: https://api.vanta-gov.com/v1
    description: Vanta Gov (FedRAMP)
security: []
paths:
  /risk-scenarios/{riskScenarioId}/controls:
    post:
      tags:
        - Risk Scenarios
      summary: Add a control to a risk scenario
      description: >-
        Associate a control with a risk scenario.


        Body: `{ controlId, controlType? }`. `controlType` is `TREATMENT_PLAN`

        for a control that is part of the risk's treatment plan; omit it (or
        pass

        `EXISTING`) to associate the control as a plain existing control.


        `controlId` may be a Vanta control shorthand, custom-control shorthand,

        or object ID; it resolves to a single canonical control before any
        write.


        Behavior on conflict with an existing association:

        - Same resolved control already associated with the same `controlType`:

          the request is a no-op and the existing relationship is returned (200).
        - Same resolved control associated with the other `controlType`: the

          request is rejected with a hint to use `PATCH` instead (422).
      operationId: CreateRiskScenarioControl
      parameters:
        - in: path
          name: riskScenarioId
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/CreateRiskScenarioControlInput'
      responses:
        '200':
          description: Ok
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RiskScenarioControl'
              examples:
                Example 1:
                  value:
                    controlId: A.12.2.1
                    controlType: TREATMENT_PLAN
      security:
        - bearerAuth: []
components:
  schemas:
    CreateRiskScenarioControlInput:
      properties:
        controlId:
          type: string
          description: |-
            Control to associate with the risk scenario. Accepts Vanta control
            shorthands (e.g. `"A.12.2.1"`), custom-control shorthand names, or
            object IDs.
        controlType:
          $ref: '#/components/schemas/RiskScenarioControlType'
          description: >-
            `TREATMENT_PLAN` for a control that is part of the risk's treatment
            plan.

            Omit (or pass `"EXISTING"`) to associate the control without a

            treatment-plan designation — the default "existing control"
            relationship.
      required:
        - controlId
      type: object
      additionalProperties: false
    RiskScenarioControl:
      description: >-
        A control's association with a risk scenario.


        The relationship identity is `(riskScenarioId, controlId)`;
        `controlType`

        is mutable state on that relationship. A given control can have at most
        one

        association per risk scenario.
      properties:
        controlId:
          type: string
          description: >-
            The control's shorthand identifier (e.g. `"A.12.2.1"`) when it has
            one,

            falling back to the canonical Vanta control id (Mongo object id)
            otherwise.
        controlType:
          $ref: '#/components/schemas/RiskScenarioControlType'
          description: >-
            `TREATMENT_PLAN` for controls that are part of the risk's treatment
            plan

            (planned mitigations); `EXISTING` for controls linked to the risk
            without a

            treatment-plan designation.
      required:
        - controlId
        - controlType
      type: object
      additionalProperties: false
    RiskScenarioControlType:
      type: string
      enum:
        - EXISTING
        - TREATMENT_PLAN
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer

````