Cancel risk scenario approval request

POST

risk-scenarios

{riskScenarioId}

cancel-approval-request

curl --request POST \
  --url https://api.vanta.com/v1/risk-scenarios/{riskScenarioId}/cancel-approval-request \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://api.vanta.com/v1/risk-scenarios/{riskScenarioId}/cancel-approval-request"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.text)

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.vanta.com/v1/risk-scenarios/{riskScenarioId}/cancel-approval-request', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.vanta.com/v1/risk-scenarios/{riskScenarioId}/cancel-approval-request",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.vanta.com/v1/risk-scenarios/{riskScenarioId}/cancel-approval-request"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.vanta.com/v1/risk-scenarios/{riskScenarioId}/cancel-approval-request")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "riskId": "assets-not-identified-and-protected",
  "description": "Assets are not identified and protected according to company requirements.",
  "detailedDescription": null,
  "isSensitive": false,
  "likelihood": 4,
  "impact": 4,
  "residualLikelihood": 2,
  "residualImpact": 1,
  "categories": [
    "Access control"
  ],
  "ciaCategories": [
    "Confidentiality"
  ],
  "treatment": "Avoid",
  "owner": null,
  "note": null,
  "riskRegister": "Default",
  "customFields": [],
  "isArchived": false,
  "reviewStatus": "DRAFT",
  "requiredApprovers": [],
  "type": "Risk Scenario",
  "identificationDate": "2024-03-07T18:46:05.944Z",
  "scoreBreakdown": [
    {
      "id": "inherent-risk",
      "kind": "SCORE",
      "name": "Inherent risk",
      "score": 16,
      "status": null,
      "scoreLabel": "High",
      "parentId": null
    },
    {
      "id": "impact",
      "kind": "DIMENSION",
      "name": "Impact",
      "score": 4,
      "status": "SCORED",
      "scoreLabel": "High",
      "parentId": "inherent-risk"
    },
    {
      "id": "likelihood",
      "kind": "DIMENSION",
      "name": "Likelihood",
      "score": 4,
      "status": "SCORED",
      "scoreLabel": "High",
      "parentId": "inherent-risk"
    }
  ]
}

Authorizations

Authorization

string

header

required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

riskScenarioId

string

required

Response

200 - application/json

riskId

string

required

The unique ID of the risk specified by the user. Used to reference and update existing risks.

description

string

required

This describes an actual or potential risk to your organization's people, processes, technology, data, and facilities. Document actual issues or likely scenarios based on your specific environment or a potential vulnerability.

Naming note: in the UI, description is labelled "Title" and detailedDescription is labelled "Description". The field names are preserved for backwards compatibility with the public REST API and existing data.

isSensitive

boolean | null

required

deprecated

If set to true this risk can only be seen by its owner or users with Admin, RiskSensitiveManage or RiskSensitiveView permissions.

likelihood

integer<int32> | null

required

Represents the probability of an incident occurring due to this risk or vulnerability, expressed as a numerical score. Defaults to a range of 1-5, where higher values indicate greater likelihood. The range can be customized in the Risk Management settings. A value of null indicates that no score has been assigned.

impact

integer<int32> | null

required

Represents the potential severity of harm to your organization’s operations if this risk is exploited, expressed as a numerical score. Defaults to a range of 1-5, where higher values indicate greater impact. The range can be customized in the Risk Management settings. A value of null indicates that no score has been assigned.

residualLikelihood

integer<int32> | null

required

Represents the adjusted probability of this risk being exploited or affecting operations after implementing risk treatments, such as controls or mitigations. Expressed as a numerical score, defaulting to a range of 1-5. The range can be customized in the Risk Management settings. A value of null indicates that no score has been assigned.

residualImpact

integer<int32> | null

required

Represents the adjusted severity of harm to your organization’s operations if this risk is exploited after implementing risk treatments, such as controls or mitigations. Expressed as a numerical score, defaulting to a range of 1-5. The range can be customized in the Risk Management settings. A value of null indicates that no score has been assigned.

categories

string[]

required

The list of categories this risk scenario belongs to.

ciaCategories

enum<string>[]

required

A list of the following for the type of risk documented:

Confidentiality: Risk to data stores, customer/sensitive information, etc.
Integrity: Risk to accuracy or integrity of system settings and/or data
Availability: Risk to normal service operations and critical system functionality

Available options:

Confidentiality,

Integrity,

Availability

treatment

enum<string> | null

required

Indicate how your leadership team wants to address an identified risk. Please note: not all risks need to be addressed immediately (or at all). Your Risk Treatment decision will depend on multiple factors, such as your organization's risk tolerance and the value of the asset that the risk is associated with. The options are:

Mitigate: Identify controls to put in place or tasks to be done that will reduce the risk score.
Transfer: Move risk outside of your organization's set of responsibilities e.g. get cyber liability insurance.
Avoid: Stop doing the activity which is causing the risk to your organization and its assets.
Accept: Decide to live with the risk and take no further actions. - Accept: decide to live with the risk; this may be because it is highly unlikely, has a low financial or operational impact, or the cost and effort to treat the risk far exceeds the value of the asset

Available options:

Mitigate,

Transfer,

Avoid,

Accept

owner

string | null

required

The email of the person responsible for tracking and mitigating this risk scenario.

note

string | null

required

Additional context about the risk scenario and why it has specific impact and likelihood scores.

riskRegister

string | null

required

Name of the risk register associated with this scenario.

customFields

object[]

required

The list of custom fields. You can reference existing custom fields in the Risk Management settings and/or create new ones. The format is:

{label: "field-name", value: "string-representation"} for text, date, number and currency fields
{label: "field-name", value: ["option1", "option2"]} for picklist fields

Empty if the organization doesn't have custom fields.

Show child attributes

isArchived

boolean

required

Whether this scenario is archived.

reviewStatus

enum<string>

required

The current review status of this risk scenario

Available options:

APPROVED,

DRAFT,

NOT_REVIEWED,

AWAITING_SUBMISSION,

PENDING_APPROVAL,

REQUESTED_CHANGES

requiredApprovers

string[]

required

The list of required approvers for this risk scenario.

type

enum<string>

required

The type of risk scenario.

"Risk Scenario": Standard risk scenario
"Enterprise Risk": Enterprise-level risk

Available options:

Risk Scenario,

Enterprise Risk

identificationDate

string<date-time>

required

The date this risk was identified. Matches the "Identified Date" field in the Vanta UI. Set by the customer when a risk is created; defaults to the scenario's creation time when not explicitly provided.

scoreBreakdown

object[] | null

required

Overall inherent score, dimensions, and nested factors, ordered parents before children and linked by parentId. null when Flexible Risk Scoring is off or the scenario has no score or matching config. Closed beta.

Show child attributes

detailedDescription

string | null

Optional long-form description providing extended context for the risk scenario. Maximum 10000 characters.

⌘I

Cancel risk scenario approval request

curl --request POST \
  --url https://api.vanta.com/v1/risk-scenarios/{riskScenarioId}/cancel-approval-request \
  --header 'Authorization: Bearer <token>'

import requests

url = "https://api.vanta.com/v1/risk-scenarios/{riskScenarioId}/cancel-approval-request"

headers = {"Authorization": "Bearer <token>"}

response = requests.post(url, headers=headers)

print(response.text)

const options = {method: 'POST', headers: {Authorization: 'Bearer <token>'}};

fetch('https://api.vanta.com/v1/risk-scenarios/{riskScenarioId}/cancel-approval-request', options)
  .then(res => res.json())
  .then(res => console.log(res))
  .catch(err => console.error(err));

<?php

$curl = curl_init();

curl_setopt_array($curl, [
  CURLOPT_URL => "https://api.vanta.com/v1/risk-scenarios/{riskScenarioId}/cancel-approval-request",
  CURLOPT_RETURNTRANSFER => true,
  CURLOPT_ENCODING => "",
  CURLOPT_MAXREDIRS => 10,
  CURLOPT_TIMEOUT => 30,
  CURLOPT_HTTP_VERSION => CURL_HTTP_VERSION_1_1,
  CURLOPT_CUSTOMREQUEST => "POST",
  CURLOPT_HTTPHEADER => [
    "Authorization: Bearer <token>"
  ],
]);

$response = curl_exec($curl);
$err = curl_error($curl);

curl_close($curl);

if ($err) {
  echo "cURL Error #:" . $err;
} else {
  echo $response;
}

package main

import (
	"fmt"
	"net/http"
	"io"
)

func main() {

	url := "https://api.vanta.com/v1/risk-scenarios/{riskScenarioId}/cancel-approval-request"

	req, _ := http.NewRequest("POST", url, nil)

	req.Header.Add("Authorization", "Bearer <token>")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(string(body))

}

require 'uri'
require 'net/http'

url = URI("https://api.vanta.com/v1/risk-scenarios/{riskScenarioId}/cancel-approval-request")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Post.new(url)
request["Authorization"] = 'Bearer <token>'

response = http.request(request)
puts response.read_body

{
  "riskId": "assets-not-identified-and-protected",
  "description": "Assets are not identified and protected according to company requirements.",
  "detailedDescription": null,
  "isSensitive": false,
  "likelihood": 4,
  "impact": 4,
  "residualLikelihood": 2,
  "residualImpact": 1,
  "categories": [
    "Access control"
  ],
  "ciaCategories": [
    "Confidentiality"
  ],
  "treatment": "Avoid",
  "owner": null,
  "note": null,
  "riskRegister": "Default",
  "customFields": [],
  "isArchived": false,
  "reviewStatus": "DRAFT",
  "requiredApprovers": [],
  "type": "Risk Scenario",
  "identificationDate": "2024-03-07T18:46:05.944Z",
  "scoreBreakdown": [
    {
      "id": "inherent-risk",
      "kind": "SCORE",
      "name": "Inherent risk",
      "score": 16,
      "status": null,
      "scoreLabel": "High",
      "parentId": null
    },
    {
      "id": "impact",
      "kind": "DIMENSION",
      "name": "Impact",
      "score": 4,
      "status": "SCORED",
      "scoreLabel": "High",
      "parentId": "inherent-risk"
    },
    {
      "id": "likelihood",
      "kind": "DIMENSION",
      "name": "Likelihood",
      "score": 4,
      "status": "SCORED",
      "scoreLabel": "High",
      "parentId": "inherent-risk"
    }
  ]
}

API Basics

Manage API

Integrations API

Audit API

Webhooks

Cancel risk scenario approval request

Authorizations

Path Parameters

Response