v1

latestOpenAPI 3.0.1Vanta Terms of Service2026-07-26327517821.8 KB

Risk Scenarios

Cancel risk scenario approval request

Cancel approval request for a risk scenario.

post/risk-scenarios/{riskScenarioId}/cancel-approval-request

Path parameters

riskScenarioIdstring required

Response

riskIdstring required

The unique ID of the risk specified by the user. Used to reference and update existing risks.

descriptionstring required

This describes an actual or potential risk to your organization's people, processes, technology, data, and facilities. Document actual issues or likely scenarios based on your specific environment or a potential vulnerability.

Naming note: in the UI, description is labelled "Title" and detailedDescription is labelled "Description". The field names are preserved for backwards compatibility with the public REST API and existing data.

detailedDescriptionstring nullable

Optional long-form description providing extended context for the risk scenario. Maximum 10000 characters.

isSensitiveboolean nullable required

If set to true this risk can only be seen by its owner or users with Admin, RiskSensitiveManage or RiskSensitiveView permissions.

likelihoodinteger nullable required

Represents the probability of an incident occurring due to this risk or vulnerability, expressed as a numerical score. Defaults to a range of 1-5, where higher values indicate greater likelihood. The range can be customized in the Risk Management settings. A value of null indicates that no score has been assigned.

impactinteger nullable required

Represents the potential severity of harm to your organization’s operations if this risk is exploited, expressed as a numerical score. Defaults to a range of 1-5, where higher values indicate greater impact. The range can be customized in the Risk Management settings. A value of null indicates that no score has been assigned.

residualLikelihoodinteger nullable required

Represents the adjusted probability of this risk being exploited or affecting operations after implementing risk treatments, such as controls or mitigations. Expressed as a numerical score, defaulting to a range of 1-5. The range can be customized in the Risk Management settings. A value of null indicates that no score has been assigned.

residualImpactinteger nullable required

Represents the adjusted severity of harm to your organization’s operations if this risk is exploited after implementing risk treatments, such as controls or mitigations. Expressed as a numerical score, defaulting to a range of 1-5. The range can be customized in the Risk Management settings. A value of null indicates that no score has been assigned.

categoriesstring[] required

The list of categories this risk scenario belongs to.

ciaCategoriesCIA[] required

A list of the following for the type of risk documented:

Confidentiality: Risk to data stores, customer/sensitive information, etc.
Integrity: Risk to accuracy or integrity of system settings and/or data
Availability: Risk to normal service operations and critical system functionality

treatment'Mitigate' | 'Transfer' | 'Avoid' | 'Accept' required

ownerstring nullable required

The email of the person responsible for tracking and mitigating this risk scenario.

notestring nullable required

Additional context about the risk scenario and why it has specific impact and likelihood scores.

riskRegisterstring nullable required

Name of the risk register associated with this scenario.

isArchivedboolean required

Whether this scenario is archived.

requiredApproversstring[] required

The list of required approvers for this risk scenario.

type'Risk Scenario' | 'Enterprise Risk' required

identificationDatestring date-time required

The date this risk was identified. Matches the "Identified Date" field in the Vanta UI. Set by the customer when a risk is created; defaults to the scenario's creation time when not explicitly provided.