> ## Documentation Index
> Fetch the complete documentation index at: https://developer.vanta.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Change a risk scenario control's controlType

> Change the `controlType` on an existing risk-scenario / control
association.

Body: `{ controlType }`. The server atomically moves the resolved control
between the treatment-plan and existing-control sets in a single update —
there is no intermediate unlinked state. `PATCH { "controlType": "EXISTING" }`
removes the control from the treatment plan but keeps it linked as an
existing control; use `DELETE` to unlink it entirely.

Returns 404 if the control is not currently associated with the scenario.
Setting the `controlType` it already has is a 200 no-op.



## OpenAPI

````yaml /reference/manage-vanta.json patch /risk-scenarios/{riskScenarioId}/controls/{controlId}
openapi: 3.0.0
info:
  title: Manage Vanta
  version: 1.0.0
  description: >-
    The REST API lets customers query and mutate Vanta's data. Use this API to
    automate bulk actions, query data for custom workflows and dashboards, and
    bolster your security operations


    **Note for Vanta Gov (FedRAMP) customers:** Select `Vanta Gov (FedRAMP)`
    from the server dropdown to issue requests against
    `https://api.vanta-gov.com`. The OAuth token URL shown below defaults to the
    commercial host — replace it with `https://api.vanta-gov.com/oauth/token`.
  termsOfService: https://www.vanta.com/terms
  license:
    name: UNLICENSED
  contact:
    name: API Support
    url: https://help.vanta.com/
    email: support@vanta.com
servers:
  - url: https://api.vanta.com/v1
    description: Vanta (Commercial)
  - url: https://api.vanta-gov.com/v1
    description: Vanta Gov (FedRAMP)
security: []
paths:
  /risk-scenarios/{riskScenarioId}/controls/{controlId}:
    patch:
      tags:
        - Risk Scenarios
      summary: Change a risk scenario control's controlType
      description: >-
        Change the `controlType` on an existing risk-scenario / control

        association.


        Body: `{ controlType }`. The server atomically moves the resolved
        control

        between the treatment-plan and existing-control sets in a single update
        —

        there is no intermediate unlinked state. `PATCH { "controlType":
        "EXISTING" }`

        removes the control from the treatment plan but keeps it linked as an

        existing control; use `DELETE` to unlink it entirely.


        Returns 404 if the control is not currently associated with the
        scenario.

        Setting the `controlType` it already has is a 200 no-op.
      operationId: UpdateRiskScenarioControl
      parameters:
        - in: path
          name: riskScenarioId
          required: true
          schema:
            type: string
        - in: path
          name: controlId
          required: true
          schema:
            type: string
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/UpdateRiskScenarioControlInput'
      responses:
        '200':
          description: Ok
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/RiskScenarioControl'
              examples:
                Example 1:
                  value:
                    controlId: A.12.2.1
                    controlType: TREATMENT_PLAN
      security:
        - bearerAuth: []
components:
  schemas:
    UpdateRiskScenarioControlInput:
      properties:
        controlType:
          $ref: '#/components/schemas/RiskScenarioControlType'
          description: >-
            The new relationship state. `TREATMENT_PLAN` moves the control into
            the

            risk's treatment plan; `EXISTING` removes it from the treatment plan
            while

            keeping it linked as an existing control (use DELETE to unlink
            entirely).
      required:
        - controlType
      type: object
      additionalProperties: false
    RiskScenarioControl:
      description: >-
        A control's association with a risk scenario.


        The relationship identity is `(riskScenarioId, controlId)`;
        `controlType`

        is mutable state on that relationship. A given control can have at most
        one

        association per risk scenario.
      properties:
        controlId:
          type: string
          description: >-
            The control's shorthand identifier (e.g. `"A.12.2.1"`) when it has
            one,

            falling back to the canonical Vanta control id (Mongo object id)
            otherwise.
        controlType:
          $ref: '#/components/schemas/RiskScenarioControlType'
          description: >-
            `TREATMENT_PLAN` for controls that are part of the risk's treatment
            plan

            (planned mitigations); `EXISTING` for controls linked to the risk
            without a

            treatment-plan designation.
      required:
        - controlId
        - controlType
      type: object
      additionalProperties: false
    RiskScenarioControlType:
      type: string
      enum:
        - EXISTING
        - TREATMENT_PLAN
  securitySchemes:
    bearerAuth:
      type: http
      scheme: bearer

````