---
title: "Add a control to a risk scenario"
method: POST
path: "/risk-scenarios/{riskScenarioId}/controls"
tags: ["Risk Scenarios"]
---

# Add a control to a risk scenario

`POST /risk-scenarios/{riskScenarioId}/controls`

Associate a control with a risk scenario.

Body: `{ controlId, controlType? }`. `controlType` is `TREATMENT_PLAN`
for a control that is part of the risk's treatment plan; omit it (or pass
`EXISTING`) to associate the control as a plain existing control.

`controlId` may be a Vanta control shorthand, custom-control shorthand,
or object ID; it resolves to a single canonical control before any write.

Behavior on conflict with an existing association:
- Same resolved control already associated with the same `controlType`:

  the request is a no-op and the existing relationship is returned (200).
- Same resolved control associated with the other `controlType`: the

  request is rejected with a hint to use `PATCH` instead (422).

## Path parameters

- `riskScenarioId` string, required

## Request body

- CreateRiskScenarioControlInput
  - `controlId` string, required — Control to associate with the risk scenario. Accepts Vanta control shorthands (e.g. `"A.12.2.1"`), custom-control shorthand names, or object IDs.
  - `controlType` 'EXISTING' | 'TREATMENT_PLAN'

## Response `200`

Ok

- RiskScenarioControl — A control's association with a risk scenario. The relationship identity is `(riskScenarioId, controlId)`; `controlType` is mutable state on that relationship. A given control can have at most one association per risk scenario.
  - `controlId` string, required — The control's shorthand identifier (e.g. `"A.12.2.1"`) when it has one, falling back to the canonical Vanta control id (Mongo object id) otherwise.
  - `controlType` 'EXISTING' | 'TREATMENT_PLAN', required

---

[API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/revisions/6c1f7590538b/schema)