---
title: "List risks for an audit"
method: GET
path: "/audits/{auditId}/risks/{snapshotId}"
tags: ["Audits"]
---

# List risks for an audit

`GET /audits/{auditId}/risks/{snapshotId}`

Retrieves risk population data for an audit.

This endpoint provides access to the risk records visible to auditors
during an audit engagement. Risk data is scoped to a specific risk
assessment snapshot identified by the `snapshotId` parameter.

Only Controlled Audit View (CAV) audits are supported. Full Audit
View audits are rejected with 403.

Supports filtering by:
- `search`: Searches risk scenario descriptions (case-insensitive)

Results are sorted by identified date (newest first) by default.
Use `orderBy` and `orderDirection` to customize sorting.
Sort parameters must remain consistent across paginated requests.

Uses cursor-based pagination. To paginate:
1. Make initial request with desired `pageSize`
2. Check `results.pageInfo.hasNextPage`
3. Use `results.pageInfo.endCursor` as `pageCursor` for next request

Rate limit: 10 requests / minute.

## Path parameters

- `auditId` string, required
- `snapshotId` string, required

## Query parameters

- `pageSize` integer — Controls the maximum number of items returned in one response from the API.
- `pageCursor` string — A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor.
- `search` string
- `orderBy` 'inherentRisk' | 'riskId' | 'riskScenario' | 'treatment' | 'residualRisk' | 'reviewStatus' | 'owner' | 'categories' | 'ciaCategories' | 'identified'
- `orderDirection` 'asc' | 'desc' — `"asc"` for ascending, `"desc"` for descending.

## Response `200`

Paginated list of risks with pagination metadata

- PaginatedResponseAuditRisk
  - `results` object, required
    - `data` AuditRisk[], required
      - `id` string, required — Unique identifier for the risk scenario version.
      - `riskId` string, nullable, required — Custom risk ID (e.g., "RISK-001"), or null if not available.
      - `riskScenario` string, nullable — Description of the risk scenario, or null if not available.
      - `likelihood` number, double, nullable — Likelihood score of the risk, or null if not scored. Full Audit View only - omitted in Controlled Audit View.
      - `impact` number, double, nullable — Impact score of the risk, or null if not scored. Full Audit View only - omitted in Controlled Audit View.
      - `inherentRisk` number, double, nullable — Inherent risk score (likelihood * impact), or null if not calculable.
      - `treatment` 'ACCEPT' | 'AVOID' | 'MITIGATE' | 'TRANSFER' — Risk treatment strategy returned by the auditor API.
      - `treatmentStatus` 'IN_PROGRESS' | 'DONE' — Treatment implementation status returned by the auditor API.
      - `residualRisk` number, double, nullable — Residual risk score after treatment, or null if not calculable.
      - `reviewStatus` 'APPROVED' | 'DRAFT' | 'NOT_REVIEWED' | 'AWAITING_SUBMISSION' | 'PENDING_APPROVAL' | 'REQUESTED_CHANGES' — Risk scenario review status returned by the auditor API.
      - `owner` AuditRiskOwner — Owner information for a risk.
        - `displayName` string, required — Display name of the risk owner.
        - `imageUrl` string, nullable, required — URL of the owner's profile image, or null if not available.
      - `categories` string[] — Risk category names, or empty array if not categorized.
      - `ciaCategories` AuditRiskCia[] — CIA triad categories, or empty array if not categorized.
      - `linkedControlIds` string[] — IDs of controls linked to this risk scenario, or empty array if none. Full Audit View only - omitted in Controlled Audit View.
      - `identified` string, nullable — When the risk was identified, or null if not recorded. ISO 8601 format.
    - `pageInfo` PageInfo, required — Provides information about the pagination of a dataset.
      - `endCursor` string, nullable, required — The cursor that points to the end of the current page, or null if there is no such cursor.
      - `hasNextPage` boolean, required — Indicates if there is another page after the current page.
      - `hasPreviousPage` boolean, required — Indicates if there is a page before the current page.
      - `startCursor` string, nullable, required — The cursor that points to the start of the current page, or null if there is no such cursor.

---

[API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/revisions/6c1f7590538b/schema)