---
title: "Create Risk"
method: POST
path: "/api/risk/v3/risks"
tags: ["Risks"]
---

# Create Risk

`POST /api/risk/v3/risks`

Use this API to create a new risk in the Risk Register. The response will include details of the created risk.
> 🗒 Things to Know
>
> - This API will create a new risk with the specified details.
> - The risk will be created in the default state.
> - This is a standalone risk creation endpoint.

## Request body

- TechRiskComplianceRiskRiskRequest
  - `description` string — description
  - `treatmentPlan` string — treatment plan
  - `orgGroupId` string, uuid, required — organization group id
  - `riskApproversId` string[] — list of approver ids
  - `inherentRiskLevel` TechRiskComplianceRiskRiskLevelDetails
    - `levelId` integer — Risk level identifier
    - `level` string — Risk level name
    - `impactLevelId` integer — Impact level identifier
    - `impactLevel` string — Impact level name
    - `probabilityLevelId` integer — Probability level identifier
    - `probabilityLevel` string — Probability level name
    - `riskScore` number — Calculated risk score
    - `levelGuid` string, uuid — Risk level unique identifier
    - `levelKey` string — Risk level key
    - `colorCode` string — Risk level color code
    - `impactLevelGuid` string, uuid — Impact level unique identifier
    - `impactLevelKey` string — Impact level key
    - `probabilityLevelGuid` string, uuid — Probability level unique identifier
    - `probabilityLevelKey` string — Probability level key
  - `residualRiskLevel` TechRiskComplianceRiskRiskLevelDetails
    - `levelId` integer — Risk level identifier
    - `level` string — Risk level name
    - `impactLevelId` integer — Impact level identifier
    - `impactLevel` string — Impact level name
    - `probabilityLevelId` integer — Probability level identifier
    - `probabilityLevel` string — Probability level name
    - `riskScore` number — Calculated risk score
    - `levelGuid` string, uuid — Risk level unique identifier
    - `levelKey` string — Risk level key
    - `colorCode` string — Risk level color code
    - `impactLevelGuid` string, uuid — Impact level unique identifier
    - `impactLevelKey` string — Impact level key
    - `probabilityLevelGuid` string, uuid — Probability level unique identifier
    - `probabilityLevelKey` string — Probability level key
  - `categoryIds` string[] — risk categories' Ids
  - `threatId` string, uuid — risk threat' Id
  - `vulnerabilityIds` string[] — risk vulnerability' Ids
  - `attributeValues` object — Custom Attributes
  - `targetRiskLevel` TechRiskComplianceRiskRiskLevelDetails
    - `levelId` integer — Risk level identifier
    - `level` string — Risk level name
    - `impactLevelId` integer — Impact level identifier
    - `impactLevel` string — Impact level name
    - `probabilityLevelId` integer — Probability level identifier
    - `probabilityLevel` string — Probability level name
    - `riskScore` number — Calculated risk score
    - `levelGuid` string, uuid — Risk level unique identifier
    - `levelKey` string — Risk level key
    - `colorCode` string — Risk level color code
    - `impactLevelGuid` string, uuid — Impact level unique identifier
    - `impactLevelKey` string — Impact level key
    - `probabilityLevelGuid` string, uuid — Probability level unique identifier
    - `probabilityLevelKey` string — Probability level key
  - `deadline` string, date-time — deadline, format - YYYY-MM-DDTHH:MM:SS.FFFZ
  - `reminderDays` integer — number of days before the deadline when the reminder will be sent
  - `riskOwners` TechRiskComplianceRiskBasicEntityDetail[] — list of risk owners
    - `id` string, uuid — Unique Identifier for the Entity
    - `name` string — Name for the Entity
  - `relatedEntities` TechRiskComplianceRiskRiskSourceInformation[] — list of linked entities
    - `id` string, uuid, required — Source Entity Id
    - `type` 'PIA' | 'GRA' | 'INVENTORY' | 'INCIDENT' | 'ENGAGEMENT' | 'GENERIC' — Source Type for the risk
    - `sourceType` TechRiskComplianceRiskEntityTypeInformation
      - `id` string, required — Entity Type ID. This can be Assets, Entities, PIA, Engagement, Custom Object GUID in form of String.
      - `label` string — Entity Type Name
      - `translationKey` string — Translation Key of Entity Type ID
      - `seeded` boolean — For Base Entity Type Seeded is true and false for Custom Object/Entity Types by default.
      - `sourceType` boolean — Indicates whether this type can be source type or not in Risk
      - `riskType` boolean — Indicates whether this type can be risk type or not in Risk
      - `eligibleForEntityLink` boolean — Indicates whether entity type is eligible for linking/relating with risk or not
      - `enabled` boolean — Indicates whether the entity type is enabled or not.
      - `moduleName` string — Name of the module
    - `name` string, required — Source Entity Name
    - `additionalAttributes` object — Additional information about the Source Entity. This will be a Map of String Key and Object value. 'inventoryType' key is mandatory to be passed when sourceType is 'Inventory', and it can have one of the following values, 20 - Assets, 30 - Processing Activities, 50 - Vendors, 60 - Entities
  - `entityIdToControlIds` object — Map of control and related entities
  - `controlIds` string[] — Set of Control Ids
  - `controlRequestDtos` TechRiskComplianceRiskControlRequestDto[] — Ad Hoc control creation requests
    - `identifier` string, required — The identifier of the control.
    - `name` string, required — The name of the control.
    - `orgGroupId` string, uuid, required — The identifier of the organization the master control is linked to. In general, this is top organization in the org hierarchy.
    - `description` string — Description of the control.
    - `recommendation` string — The recommendation status of this control based on Athena logic.
    - `frameworkId` string, uuid — Identifier of the framework the control is tied to.
    - `frameworkName` string — Name of the framework the control is tied to.
    - `frameworkNameKey` string — Identifier used for translation of Framework Name.
    - `status` 'Active' | 'Archived' | 'Pending' — The new status of the control. This can be Active, Archived, or Pending.
    - `categoryId` string, uuid — The identifier of the category tied to the control. Optional if no category is needed or if category name is provided.
    - `categoryName` string — The name of the category tied to the control. Optional if category Id is provided.
    - `categoryNameKey` string — Identifier used for translation of category name. Optional if category Id is provided.
    - `attributes` object — Custom Attributes
    - `implementationGuidance` string — Implementation guidance of control.
  - `controlIdToCreateParameter` object — Map of controlId to create parameter
  - `riskTemplate` TechRiskComplianceRiskRiskTemplateIdentifier
    - `id` string, uuid
  - `name` string — name
  - `ignoreControlAutoInheritanceConfiguration` boolean
  - `treatment` string — AKA remediation in current workflow
  - `riskManager` string[] — list of manager ids

## Response `201`

Created

- string, uuid

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `429` — Too Many Requests. For more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview).
- `500` — Internal Server Error

---

[API](https://skmtc.net/onetrust/apis/platform-access-management.md) · [All operations](https://skmtc.net/onetrust/apis/platform-access-management/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/onetrust/platform-access-management/versions/21de3aa0b170/schema)