---
title: "Create Assessment Risk"
method: POST
path: "/api/assessment/v2/assessments/{assessmentId}/risks"
tags: ["Assessment Actions"]
---

# Create Assessment Risk

`POST /api/assessment/v2/assessments/{assessmentId}/risks`

Use this API to create a risk on an assessment. This API will return the risk owner, risk approver and target risk level in the response. The risk will be flagged on the assessment and assigned to the respective risk owners with the details defined in the API request body. 

> 🗒 Things to Know
> 
> - This API can be used for assessments in Under Review and Completed stage.
> - Risks must have an assigned risk owner before you can send a recommendation. Once an approver has identified a risk, they can send the risk owner a recommendation that helps to rectify and minimize the risk.
> - If risk heatmaps are used by your organization, the available risk level options will be based on the heatmap set up for your organization. If risk heatmaps are not used, the available risk level options will be Low, Medium, High, and Very High.

## Path parameters

- `assessmentId` string, uuid, required

## Request body

- PrivacyAutomationAssessmentAutomationAssessmentRiskCreateRequest
  - `sectionId` string, uuid, required — Section identifier for the assessment with which risk is associated
  - `questionId` string, uuid, required — Question identifier for the assessment with which risk is associated
  - `parentQuestionResponseDetailId` string, uuid — Parent question response identifier
  - `riskCreateRequest` PrivacyAutomationAssessmentAutomationRiskCreateRequest, required
    - `levelId` integer — Risk level identifier
    - `typeId` integer, required — Risk type identifier
    - `sourceTypeId` integer, required — Risk source type identifier
    - `name` string — Name of the risk
    - `description` string — Detailed description of the risk
    - `recommendation` string — Recommendation to mitigate the risk
    - `mitigation` string — Mitigation strategy for the risk
    - `requestedException` string — Requested exception details
    - `riskOwnerId` string, uuid
    - `riskOwner` string
    - `riskApproversId` string[]
    - `riskOwners` PrivacyAutomationAssessmentAutomationBasicEntityDetail[]
      - `id` string, uuid — Unique identifier of the entity (organization group, user, etc.)
      - `name` string — Display name of the entity (organization name or user's full name)
      - `nameKey` string — Translation key for the name, used for internationalization
    - `deadline` string, date-time — Deadline for risk mitigation
    - `reminderDays` integer — Number of days for reminder before deadline
    - `action` 'RISK_CREATED' | 'RECOMMENDATION_ADDED' | 'RECOMMENDATION_REMOVED' | 'RECOMMENDATION_SEND' | 'REMEDIATION_PROPOSED' | 'REMEDIATION_APPROVED' | 'REMEDIATION_REJECTED' | 'REMEDIATION_REMOVED' | 'EXCEPTION_REQUESTED' | 'EXCEPTION_GRANTED' | 'EXCEPTION_REJECTED' | 'EXCEPTION_REMOVED' | 'DEFAULT' — Action to be taken for the risk
    - `probabilityLevelId` integer — Probability level identifier
    - `probabilityLevel` string — Probability level description
    - `impactLevelId` integer — Impact level identifier
    - `impactLevel` string — Impact level description
    - `riskScore` number — Calculated risk score
    - `systemCreated` boolean — Flag indicating if the risk was created by the system
    - `categoryIds` string[]
    - `controlIds` string[]
    - `threatId` string, uuid — Threat ID associated with the risk
    - `vulnerabilityIds` string[]
    - `riskTemplate` PrivacyAutomationAssessmentAutomationRiskTemplateIdentifier
      - `id` string, uuid
    - `targetRiskLevel` PrivacyAutomationAssessmentAutomationRiskLevelDetail
      - `levelId` integer
      - `level` string
      - `impactLevelId` integer
      - `impactLevel` string
      - `probabilityLevelId` integer
      - `probabilityLevel` string
      - `riskScore` number
    - `attributeValues` object — Map of attribute values for the risk
    - `orgGroupId` string, uuid — Organization group ID
    - `treatment` string — AKA remediation in current workflow
    - `riskManager` string[]
    - `riskDomain` string, uuid

## Response `201`

Created

- PrivacyAutomationAssessmentAutomationAssessmentQuestionRiskDetailInformation
  - `questionIds` string[]
  - `riskId` string, uuid
  - `level` integer
  - `riskResponse` PrivacyAutomationAssessmentAutomationRiskInformation
    - `id` string, uuid
    - `number` integer
    - `type` 'ASSESSMENTS' | 'ASSETS' | 'PROCESSING_ACTIVITIES' | 'VENDORS' | 'ENTITIES' | 'INCIDENTS' | 'ESG' | 'GENERIC' | 'GENERAL' | 'ENGAGEMENTS'
    - `riskType` PrivacyAutomationAssessmentAutomationRiskEntityTypeInformation
      - `id` string, required
      - `label` string
    - `creationType` string
    - `state` 'IDENTIFIED' | 'RECOMMENDATION_ADDED' | 'RECOMMENDATION_SENT' | 'REMEDIATION_PROPOSED' | 'EXCEPTION_REQUESTED' | 'REDUCED' | 'RETAINED' | 'ARCHIVED_IN_VERSION'
    - `previousState` 'IDENTIFIED' | 'RECOMMENDATION_ADDED' | 'RECOMMENDATION_SENT' | 'REMEDIATION_PROPOSED' | 'EXCEPTION_REQUESTED' | 'REDUCED' | 'RETAINED' | 'ARCHIVED_IN_VERSION'
    - `typeRefIds` string[]
    - `sourceType` 'PIA' | 'DM' | 'RA' | 'GRA' | 'DINA' | 'INVENTORY' | 'ENGAGEMENT'
    - `source` PrivacyAutomationAssessmentAutomationRiskSourceInformation
      - `id` string, uuid
      - `name` string
      - `type` 'PIA' | 'DM' | 'RA' | 'GRA' | 'DINA' | 'INVENTORY' | 'ENGAGEMENT'
      - `sourceType` PrivacyAutomationAssessmentAutomationRiskEntityTypeInformation
        - `id` string, required
        - `label` string
      - `additionalAttributes` object
      - `sectionId` string, uuid
      - `questionId` string, uuid
      - `parentQuestionResponseDetailId` string, uuid
    - `name` string
    - `description` string
    - `recommendation` string
    - `remediationProposal` string
    - `orgGroup` PrivacyAutomationAssessmentAutomationBasicEntityDetail
      - `id` string, uuid — Unique identifier of the entity (organization group, user, etc.)
      - `name` string — Display name of the entity (organization name or user's full name)
      - `nameKey` string — Translation key for the name, used for internationalization
    - `requestedException` string
    - `mitigation` string
    - `mitigatedDate` string, date-time
    - `justification` string
    - `deadline` string, date-time
    - `references` PrivacyAutomationAssessmentAutomationRiskReferenceInformation[]
      - `id` string, uuid
      - `type` 'QUESTION' | 'ASSESSMENT' | 'INVENTORY' | 'ENGAGEMENT' | 'GENERIC'
      - `name` string
      - `additionalAttributes` object
    - `createdUTCDateTime` string, date-time
    - `levelId` integer
    - `level` string
    - `levelDisplayName` string
    - `probabilityLevelId` integer
    - `probabilityLevel` string
    - `impactLevelId` integer
    - `impactLevel` string
    - `riskScore` number
    - `viewOnly` boolean
    - `controlsIdentifier` string[]
    - `categories` PrivacyAutomationAssessmentAutomationRiskCategoryInformation[]
      - `id` string, uuid
      - `name` string
      - `nameKey` string
    - `riskOwnerId` string, uuid
    - `riskOwner` string
    - `riskOwnersId` string[]
    - `riskOwnersName` string
    - `riskApproversId` string[]
    - `riskApprovers` string
    - `inherentRiskLevel` PrivacyAutomationAssessmentAutomationRiskLevelDetail
      - `levelId` integer
      - `level` string
      - `impactLevelId` integer
      - `impactLevel` string
      - `probabilityLevelId` integer
      - `probabilityLevel` string
      - `riskScore` number
    - `targetRiskLevel` PrivacyAutomationAssessmentAutomationRiskLevelDetail
      - `levelId` integer
      - `level` string
      - `impactLevelId` integer
      - `impactLevel` string
      - `probabilityLevelId` integer
      - `probabilityLevel` string
      - `riskScore` number
    - `treatmentPlan` string
    - `treatment` string
    - `result` string
    - `treatmentStatus` string
    - `workflow` PrivacyAutomationAssessmentAutomationBasicEntityDetail
      - `id` string, uuid — Unique identifier of the entity (organization group, user, etc.)
      - `name` string — Display name of the entity (organization name or user's full name)
      - `nameKey` string — Translation key for the name, used for internationalization
    - `stage` PrivacyAutomationAssessmentAutomationBasicEntityDetail
      - `id` string, uuid — Unique identifier of the entity (organization group, user, etc.)
      - `name` string — Display name of the entity (organization name or user's full name)
      - `nameKey` string — Translation key for the name, used for internationalization
    - `actionId` integer
    - `threatInformation` PrivacyAutomationAssessmentAutomationRiskThreatInformation
      - `Threat Id` string, uuid
      - `Threat Name` string
    - `vulnerabilitiesInformation` PrivacyAutomationAssessmentAutomationRiskVulnerabilityInformation[]
      - `Vulnerability Id` string, uuid
      - `Vulnerability Name` string
    - `reminderDays` integer
    - `valid` boolean
    - `attributeValues` object
    - `closed` boolean
    - `riskDomain` PrivacyAutomationAssessmentAutomationBasicEntityDetail
      - `id` string, uuid — Unique identifier of the entity (organization group, user, etc.)
      - `name` string — Display name of the entity (organization name or user's full name)
      - `nameKey` string — Translation key for the name, used for internationalization
  - `questionId` string, uuid

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `429` — Too Many Requests. For more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview).
- `500` — Internal Server Error

---

[API](https://skmtc.net/onetrust/apis/platform-access-management.md) · [All operations](https://skmtc.net/onetrust/apis/platform-access-management/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/onetrust/platform-access-management/revisions/21de3aa0b170/schema)