v1

latestOpenAPI 3.0.1Vanta Terms of Service2026-07-26327517821.8 KB
Risk Scenarios

Change a risk scenario control's controlType

Change the controlType on an existing risk-scenario / control association.

Body: { controlType }. The server atomically moves the resolved control between the treatment-plan and existing-control sets in a single update — there is no intermediate unlinked state. PATCH { "controlType": "EXISTING" } removes the control from the treatment plan but keeps it linked as an existing control; use DELETE to unlink it entirely.

Returns 404 if the control is not currently associated with the scenario. Setting the controlType it already has is a 200 no-op.

patch/risk-scenarios/{riskScenarioId}/controls/{controlId}

Path parameters

riskScenarioIdstring required
controlIdstring required

Request body

controlType'EXISTING' | 'TREATMENT_PLAN' required

Response

Ok

controlIdstring required

The control's shorthand identifier (e.g. "A.12.2.1") when it has one, falling back to the canonical Vanta control id (Mongo object id) otherwise.

controlType'EXISTING' | 'TREATMENT_PLAN' required