--- title: "Approve Risk" method: PUT path: "/api/risk/v2/risks/{riskId}/approve" tags: ["Risk Actions"] --- # Approve Risk `PUT /api/risk/v2/risks/{riskId}/approve` Use this API to approve the specified risk. ## Path parameters - `riskId` string, uuid, required ## Request body - TechRiskComplianceRiskRiskApproveRequest - `result` 'Accepted' | 'Avoided' | 'Reduced' | 'Rejected' | 'Transferred' | 'Ignored', required — Result to set on Risk as part of approval - `resultId` string, uuid — ID of the Risk - `residualRiskLevelId` integer, required — Residual Risk Level Id - `residualProbabilityLevelId` integer — Residual Probability Level Id - `residualImpactLevelId` integer — Residual Impact Level Id - `residualRiskScore` number, required — Residual Risk Score - `comment` string — Comment to Update - `attributeValues` object — Supported Risk Score Attributes Values ## Response `200` OK - TechRiskComplianceRiskRiskInformation - `id` string, uuid — Unique identifier for the risk - `level` string — Level for the risk - `probabilityLevel` string — Probability Level for the risk - `impactLevel` string — Impact Level for the risk - `actionId` integer — ActionId for the Risk - `createdBy` string, uuid — UUId of the user who created the the risk - `state` 'IDENTIFIED' | 'RECOMMENDATION_ADDED' | 'RECOMMENDATION_SENT' | 'REMEDIATION_PROPOSED' | 'EXCEPTION_REQUESTED' | 'REDUCED' | 'RETAINED' | 'ARCHIVED_IN_VERSION' — State of the risk - `previousState` 'IDENTIFIED' | 'RECOMMENDATION_ADDED' | 'RECOMMENDATION_SENT' | 'REMEDIATION_PROPOSED' | 'EXCEPTION_REQUESTED' | 'REDUCED' | 'RETAINED' | 'ARCHIVED_IN_VERSION' — Previous State of the risk - `type` 'ASSESSMENTS' | 'ASSETS' | 'PROCESSING_ACTIVITIES' | 'VENDORS' | 'ENTITIES' | 'INCIDENTS' | 'ESG' | 'GENERAL' — Type of risk - `riskType` TechRiskComplianceRiskEntityTypeInformation - `id` string, required — Entity Type ID. This can be Assets, Entities, PIA, Engagement, Custom Object GUID in form of String. - `label` string — Entity Type Name - `translationKey` string — Translation Key of Entity Type ID - `seeded` boolean — For Base Entity Type Seeded is true and false for Custom Object/Entity Types by default. - `sourceType` boolean — Indicates whether this type can be source type or not in Risk - `riskType` boolean — Indicates whether this type can be risk type or not in Risk - `eligibleForEntityLink` boolean — Indicates whether entity type is eligible for linking/relating with risk or not - `enabled` boolean — Indicates whether the entity type is enabled or not. - `moduleName` string — Name of the module - `typeRefIds` string[] — Type ref Ids for the risk - `sourceType` 'PIA' | 'GRA' | 'INVENTORY' | 'INCIDENT' | 'ENGAGEMENT' | 'GENERIC' — Source Type for the risk - `riskSourceType` TechRiskComplianceRiskEntityTypeInformation - `id` string, required — Entity Type ID. This can be Assets, Entities, PIA, Engagement, Custom Object GUID in form of String. - `label` string — Entity Type Name - `translationKey` string — Translation Key of Entity Type ID - `seeded` boolean — For Base Entity Type Seeded is true and false for Custom Object/Entity Types by default. - `sourceType` boolean — Indicates whether this type can be source type or not in Risk - `riskType` boolean — Indicates whether this type can be risk type or not in Risk - `eligibleForEntityLink` boolean — Indicates whether entity type is eligible for linking/relating with risk or not - `enabled` boolean — Indicates whether the entity type is enabled or not. - `moduleName` string — Name of the module - `source` TechRiskComplianceRiskRiskSourceInformation - `id` string, uuid, required — Source Entity Id - `type` 'PIA' | 'GRA' | 'INVENTORY' | 'INCIDENT' | 'ENGAGEMENT' | 'GENERIC' — Source Type for the risk - `sourceType` TechRiskComplianceRiskEntityTypeInformation - `id` string, required — Entity Type ID. This can be Assets, Entities, PIA, Engagement, Custom Object GUID in form of String. - `label` string — Entity Type Name - `translationKey` string — Translation Key of Entity Type ID - `seeded` boolean — For Base Entity Type Seeded is true and false for Custom Object/Entity Types by default. - `sourceType` boolean — Indicates whether this type can be source type or not in Risk - `riskType` boolean — Indicates whether this type can be risk type or not in Risk - `eligibleForEntityLink` boolean — Indicates whether entity type is eligible for linking/relating with risk or not - `enabled` boolean — Indicates whether the entity type is enabled or not. - `moduleName` string — Name of the module - `name` string, required — Source Entity Name - `additionalAttributes` object — Additional information about the Source Entity. This will be a Map of String Key and Object value. 'inventoryType' key is mandatory to be passed when sourceType is 'Inventory', and it can have one of the following values, 20 - Assets, 30 - Processing Activities, 50 - Vendors, 60 - Entities - `description` string — Description for the risk - `recommendation` string — Recommendation for the risk - `remediationProposal` string — Remediation Proposal for the risk - `riskOwnerId` string, uuid — Unique identifier of the risk owner - `riskOwner` string — Name of the risk owner - `riskOwnersId` string[] — List of unique identifiers of the risk owners - `riskOwnersName` string — Name of the risk owner - `orgGroup` TechRiskComplianceRiskBasicEntityDetail - `id` string, uuid — Unique Identifier for the Entity - `name` string — Name for the Entity - `riskApproversId` string[] — List of unique identifiers of the risk Approvers - `requestedException` string — Requested Exception of the risk - `mitigation` string — Mitigation of the risk - `justification` string — Justification of the risk - `deadline` string, date-time — deadline for the risk - `mitigatedDate` string, date-time — Mitigated date for the risk - `references` TechRiskComplianceRiskRiskReferenceInformation[] — References for the risk - `id` string, uuid - `type` 'ASSESSMENT' | 'INVENTORY' | 'INCIDENT' | 'ENGAGEMENT' | 'GENERIC' - `referenceType` TechRiskComplianceRiskEntityTypeInformation - `id` string, required — Entity Type ID. This can be Assets, Entities, PIA, Engagement, Custom Object GUID in form of String. - `label` string — Entity Type Name - `translationKey` string — Translation Key of Entity Type ID - `seeded` boolean — For Base Entity Type Seeded is true and false for Custom Object/Entity Types by default. - `sourceType` boolean — Indicates whether this type can be source type or not in Risk - `riskType` boolean — Indicates whether this type can be risk type or not in Risk - `eligibleForEntityLink` boolean — Indicates whether entity type is eligible for linking/relating with risk or not - `enabled` boolean — Indicates whether the entity type is enabled or not. - `moduleName` string — Name of the module - `name` string - `additionalAttributes` object - `createdUTCDateTime` string, date-time — created timestamp for the risk - `lastModifiedUTCDateTime` string, date-time — last updated timestamp for the risk - `updatedBy` TechRiskComplianceRiskBasicEntityDetail - `id` string, uuid — Unique Identifier for the Entity - `name` string — Name for the Entity - `probabilityLevelId` integer — Probability Level Id of the risk - `impactLevelId` integer — Impact Level Id of the risk - `riskScore` number — Risk score - `levelId` integer — Level Id of the risk - `levelDisplayName` string — Level Name of the risk - `viewOnly` boolean - `number` integer — Number of the risk, autogenerated - `controlsIdentifier` string[] — List of Controls associated with the risk - `creationType` string — Creation Type of the risk - `categories` TechRiskComplianceRiskRiskCategoryInformation[] — Categories associated with the risk - `id` string, uuid — Risk Category unique identifier - `name` string — Risk Category name - `nameKey` string — Risk Category nameKey for localization support - `seeded` boolean — Seeded category - `associatedInventories` TechRiskComplianceRiskInventoryInformation[] — Inventories associated with the risk - `inventoryId` string, uuid — Unique Identifier of the Inventory - `inventoryName` string — Name of the Inventory - `inventoryType` 'ASSETS' | 'PROCESSING_ACTIVITIES' | 'VENDORS' | 'ENTITIES' — Type of the Inventory - `sourceType` TechRiskComplianceRiskEntityTypeInformation - `id` string, required — Entity Type ID. This can be Assets, Entities, PIA, Engagement, Custom Object GUID in form of String. - `label` string — Entity Type Name - `translationKey` string — Translation Key of Entity Type ID - `seeded` boolean — For Base Entity Type Seeded is true and false for Custom Object/Entity Types by default. - `sourceType` boolean — Indicates whether this type can be source type or not in Risk - `riskType` boolean — Indicates whether this type can be risk type or not in Risk - `eligibleForEntityLink` boolean — Indicates whether entity type is eligible for linking/relating with risk or not - `enabled` boolean — Indicates whether the entity type is enabled or not. - `moduleName` string — Name of the module - `softInherited` boolean — Soft Inherited flag - `organizationId` string, uuid — Unique Identifier of the organization - `riskApprovers` string — Name of the risk approver - `inherentRiskLevel` TechRiskComplianceRiskRiskLevelDetails - `levelId` integer — Risk level identifier - `level` string — Risk level name - `impactLevelId` integer — Impact level identifier - `impactLevel` string — Impact level name - `probabilityLevelId` integer — Probability level identifier - `probabilityLevel` string — Probability level name - `riskScore` number — Calculated risk score - `levelGuid` string, uuid — Risk level unique identifier - `levelKey` string — Risk level key - `colorCode` string — Risk level color code - `impactLevelGuid` string, uuid — Impact level unique identifier - `impactLevelKey` string — Impact level key - `probabilityLevelGuid` string, uuid — Probability level unique identifier - `probabilityLevelKey` string — Probability level key - `targetRiskLevel` TechRiskComplianceRiskRiskLevelDetails - `levelId` integer — Risk level identifier - `level` string — Risk level name - `impactLevelId` integer — Impact level identifier - `impactLevel` string — Impact level name - `probabilityLevelId` integer — Probability level identifier - `probabilityLevel` string — Probability level name - `riskScore` number — Calculated risk score - `levelGuid` string, uuid — Risk level unique identifier - `levelKey` string — Risk level key - `colorCode` string — Risk level color code - `impactLevelGuid` string, uuid — Impact level unique identifier - `impactLevelKey` string — Impact level key - `probabilityLevelGuid` string, uuid — Probability level unique identifier - `probabilityLevelKey` string — Probability level key - `treatment` string — Treatment of the risk - `result` string — Result of the risk - `treatmentStatus` string — Treatment Status of the risk - `resultDetails` TechRiskComplianceRiskAttributeValueInformation - `id` string, uuid — Unique identifier for the attribute option - `value` string, required — Attribute value - `valueKey` string — Translation key used for localizing the value - `colorCode` string — Color code associated with the option. Used for score-based attributes. - `optionSelectionValue` string — Selection score value linked to the option. Used for score-based or numerical-based attributes. - `displayLabel` string — Display name for the option, used for external attributes managed by other systems - `associatedAttributeValueInformation` TechRiskComplianceRiskAssociatedAttributeValueInformation[] — Associated attribute option information - `id` string, uuid — Unique identifier for the attribute option - `value` string, required — Attribute value - `valueKey` string — Translation key used for localizing the value - `colorCode` string — Color code associated with the option. Used for score-based attributes. - `disabled` boolean — Indicates whether this attribute option is currently disabled. - `treatmentStatusDetails` TechRiskComplianceRiskAttributeValueInformation - `id` string, uuid — Unique identifier for the attribute option - `value` string, required — Attribute value - `valueKey` string — Translation key used for localizing the value - `colorCode` string — Color code associated with the option. Used for score-based attributes. - `optionSelectionValue` string — Selection score value linked to the option. Used for score-based or numerical-based attributes. - `displayLabel` string — Display name for the option, used for external attributes managed by other systems - `associatedAttributeValueInformation` TechRiskComplianceRiskAssociatedAttributeValueInformation[] — Associated attribute option information - `id` string, uuid — Unique identifier for the attribute option - `value` string, required — Attribute value - `valueKey` string — Translation key used for localizing the value - `colorCode` string — Color code associated with the option. Used for score-based attributes. - `disabled` boolean — Indicates whether this attribute option is currently disabled. - `workflow` TechRiskComplianceRiskBasicEntityDetailTranslation - `id` string, uuid — Unique Identifier for the Entity - `name` string — Name for the Entity - `nameKey` string — Name key for entity detail translation - `badgeColor` string — Badge Color of the Entity - `stage` TechRiskComplianceRiskBasicStageDetailTranslation - `id` string, uuid — Unique Identifier for the Entity - `name` string — Name for the Entity - `currentStageApprovers` TechRiskComplianceRiskBasicStageApproverDetails[] - `id` string, uuid — UUID of the user - `firstName` string — first Name of the user - `lastName` string — last name of the user - `approvedTimeStamp` string, date-time — time stamp when the stage was approved - `status` string — status of the review - `nameKey` string — Name key for entity detail translation - `badgeColor` string — Badge Color of the Stage - `deleteType` 'SOFT' | 'ARCHIVE' | 'MIGRATED' — Delete type of the risk - `dateClosed` string, date-time — Date closed for the risk - `threat` TechRiskComplianceRiskThreatInformation - `id` string, uuid — Threat Id - `name` string — Threat Name - `identifier` string — Threat Identifier - `vulnerabilities` TechRiskComplianceRiskVulnerabilityInformation[] — list of vulnerabilities for the risk - `id` string, uuid — Vulnerability Id - `name` string — Vulnerability Name - `identifier` string — Vulnerability Identifier - `attributeValues` object — Custom Attributes - `typeRefId` string, uuid — Type ref Id for the risk, deprecated in favour of typeRefIds - `reminderDays` integer — Duration in days after which a reminder will be sent - `ruleRootVersionId` string, uuid — Unique identifier for the rule root version - `riskTemplate` TechRiskComplianceRiskBasicEntityDetail - `id` string, uuid — Unique Identifier for the Entity - `name` string — Name for the Entity - `owners` TechRiskComplianceRiskBasicEntityDetail[] — Risk Owners details of the risk - `id` string, uuid — Unique Identifier for the Entity - `name` string — Name for the Entity - `approvers` TechRiskComplianceRiskBasicEntityDetail[] — Risk Approvers details of the risk - `id` string, uuid — Unique Identifier for the Entity - `name` string — Name for the Entity - `name` string — Name of the risk - `closed` boolean — Indicates if the risk is closed - `currentStageApproversCount` integer — The count of approvers of the current stage - `migrationStatus` 'PENDING' | 'IN_PROGRESS' | 'IN_COMPLETE' | 'SUCCESS' | 'FAILED' — Migration status of the risk - `ownersId` string[] - `riskManager` TechRiskComplianceRiskBasicEntityDetail[] — List of Risk Managers associated with the risk - `id` string, uuid — Unique Identifier for the Entity - `name` string — Name for the Entity ## Other responses - `400` — Bad Request - `401` — Unauthorized - `403` — Forbidden - `429` — Too Many Requests. For more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview). - `500` — Internal Server Error --- [API](https://skmtc.net/onetrust/apis/platform-access-management.md) · [All operations](https://skmtc.net/onetrust/apis/platform-access-management/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/onetrust/platform-access-management/versions/21de3aa0b170/schema)