Sign in

v1

latestOpenAPI 3.0.1Vanta Terms of Service2026-07-26327517821.8 KB
Risk Scenarios

Add a control to a risk scenario

Associate a control with a risk scenario.

Body: { controlId, controlType? }. controlType is TREATMENT_PLAN for a control that is part of the risk's treatment plan; omit it (or pass EXISTING) to associate the control as a plain existing control.

controlId may be a Vanta control shorthand, custom-control shorthand, or object ID; it resolves to a single canonical control before any write.

Behavior on conflict with an existing association:

  • Same resolved control already associated with the same controlType:

    the request is a no-op and the existing relationship is returned (200).

  • Same resolved control associated with the other controlType: the

    request is rejected with a hint to use PATCH instead (422).

post/risk-scenarios/{riskScenarioId}/controls

Path parameters

riskScenarioIdstring required

Request body

controlIdstring required

Control to associate with the risk scenario. Accepts Vanta control shorthands (e.g. "A.12.2.1"), custom-control shorthand names, or object IDs.

controlType'EXISTING' | 'TREATMENT_PLAN'

Response

Ok

controlIdstring required

The control's shorthand identifier (e.g. "A.12.2.1") when it has one, falling back to the canonical Vanta control id (Mongo object id) otherwise.

controlType'EXISTING' | 'TREATMENT_PLAN' required