Skip to main content
PATCH
/
risk-scenarios
/
{riskScenarioId}
/
controls
/
{controlId}
Change a risk scenario control's controlType
curl --request PATCH \
  --url https://api.vanta.com/v1/risk-scenarios/{riskScenarioId}/controls/{controlId} \
  --header 'Authorization: Bearer <token>' \
  --header 'Content-Type: application/json' \
  --data '{}'
{
  "controlId": "A.12.2.1",
  "controlType": "TREATMENT_PLAN"
}

Authorizations

​
Authorization
string
header
required

Bearer authentication header of the form Bearer <token>, where <token> is your auth token.

Path Parameters

​
riskScenarioId
string
required
​
controlId
string
required

Body

application/json
​
controlType
enum<string>
required

The new relationship state. TREATMENT_PLAN moves the control into the risk's treatment plan; EXISTING removes it from the treatment plan while keeping it linked as an existing control (use DELETE to unlink entirely).

Available options:
EXISTING,
TREATMENT_PLAN

Response

200 - application/json

Ok

A control's association with a risk scenario.

The relationship identity is (riskScenarioId, controlId); controlType is mutable state on that relationship. A given control can have at most one association per risk scenario.

​
controlId
string
required

The control's shorthand identifier (e.g. "A.12.2.1") when it has one, falling back to the canonical Vanta control id (Mongo object id) otherwise.

​
controlType
enum<string>
required

TREATMENT_PLAN for controls that are part of the risk's treatment plan (planned mitigations); EXISTING for controls linked to the risk without a treatment-plan designation.

Available options:
EXISTING,
TREATMENT_PLAN