---
title: "Change a risk scenario control's controlType"
method: PATCH
path: "/risk-scenarios/{riskScenarioId}/controls/{controlId}"
tags: ["Risk Scenarios"]
---

# Change a risk scenario control's controlType

`PATCH /risk-scenarios/{riskScenarioId}/controls/{controlId}`

Change the `controlType` on an existing risk-scenario / control
association.

Body: `{ controlType }`. The server atomically moves the resolved control
between the treatment-plan and existing-control sets in a single update —
there is no intermediate unlinked state. `PATCH { "controlType": "EXISTING" }`
removes the control from the treatment plan but keeps it linked as an
existing control; use `DELETE` to unlink it entirely.

Returns 404 if the control is not currently associated with the scenario.
Setting the `controlType` it already has is a 200 no-op.

## Path parameters

- `riskScenarioId` string, required
- `controlId` string, required

## Request body

- UpdateRiskScenarioControlInput
  - `controlType` 'EXISTING' | 'TREATMENT_PLAN', required

## Response `200`

Ok

- RiskScenarioControl — A control's association with a risk scenario. The relationship identity is `(riskScenarioId, controlId)`; `controlType` is mutable state on that relationship. A given control can have at most one association per risk scenario.
  - `controlId` string, required — The control's shorthand identifier (e.g. `"A.12.2.1"`) when it has one, falling back to the canonical Vanta control id (Mongo object id) otherwise.
  - `controlType` 'EXISTING' | 'TREATMENT_PLAN', required

---

[API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/versions/6c1f7590538b/schema)