---
title: "List risk scenarios"
method: GET
path: "/risk-scenarios"
tags: ["Risk Scenarios"]
---

# List risk scenarios

`GET /risk-scenarios`

List risk scenarios.

## Query parameters

- `pageSize` integer — Controls the maximum number of items returned in one response from the API.
- `pageCursor` string — A marker or pointer, telling the API where to start fetching items for the subsequent page in a paginated dataset. Note that the requested page will not include the item that corresponds to this cursor but will start from the one immediately after this cursor.
- `includeIgnored` boolean
- `ownerMatchesAny` string[]
- `searchString` string
- `categoryMatchesAny` string[]
- `ciaCategoryMatchesAny` union[]
  - union
    - 'Confidentiality' | 'Integrity' | 'Availability'
    - 'Uncategorized'
- `treatmentTypeMatchesAny` union[]
  - union
    - 'Mitigate' | 'Transfer' | 'Avoid' | 'Accept'
    - 'No treatment type'
- `inherentScoreGroupMatchesAny` ScoreGroup[]
- `residualScoreGroupMatchesAny` ScoreGroup[]
- `reviewStatusMatchesAny` ReviewStatus[]
- `type` 'Risk Scenario' | 'Enterprise Risk'
- `orderBy` 'description' | 'createdAt'

## Response `200`

Ok

- PaginatedResponseRiskScenario
  - `results` object, required
    - `data` RiskScenario[], required
      - `riskId` string, required — The unique ID of the risk specified by the user. Used to reference and update existing risks.
      - `description` string, required — This describes an actual or potential risk to your organization's people, processes, technology, data, and facilities. Document actual issues or likely scenarios based on your specific environment or a potential vulnerability. Naming note: in the UI, `description` is labelled "Title" and `detailedDescription` is labelled "Description". The field names are preserved for backwards compatibility with the public REST API and existing data.
      - `detailedDescription` string, nullable — Optional long-form description providing extended context for the risk scenario. Maximum 10000 characters. Naming note: in the UI, `description` is labelled "Title" and `detailedDescription` is labelled "Description". The field names are preserved for backwards compatibility with the public REST API and existing data.
      - `isSensitive` boolean, nullable, required — If set to true this risk can only be seen by its owner or users with Admin, RiskSensitiveManage or RiskSensitiveView permissions.
      - `likelihood` integer, nullable, required — Represents the probability of an incident occurring due to this risk or vulnerability, expressed as a numerical score. Defaults to a range of 1-5, where higher values indicate greater likelihood. The range can be customized in the Risk Management settings. A value of `null` indicates that no score has been assigned.
      - `impact` integer, nullable, required — Represents the potential severity of harm to your organization’s operations if this risk is exploited, expressed as a numerical score. Defaults to a range of 1-5, where higher values indicate greater impact. The range can be customized in the Risk Management settings. A value of `null` indicates that no score has been assigned.
      - `residualLikelihood` integer, nullable, required — Represents the adjusted probability of this risk being exploited or affecting operations after implementing risk treatments, such as controls or mitigations. Expressed as a numerical score, defaulting to a range of 1-5. The range can be customized in the Risk Management settings. A value of `null` indicates that no score has been assigned.
      - `residualImpact` integer, nullable, required — Represents the adjusted severity of harm to your organization’s operations if this risk is exploited after implementing risk treatments, such as controls or mitigations. Expressed as a numerical score, defaulting to a range of 1-5. The range can be customized in the Risk Management settings. A value of `null` indicates that no score has been assigned.
      - `categories` string[], required — The list of categories this risk scenario belongs to.
      - `ciaCategories` CIA[], required — A list of the following for the type of risk documented: - Confidentiality: Risk to data stores, customer/sensitive information, etc. - Integrity: Risk to accuracy or integrity of system settings and/or data - Availability: Risk to normal service operations and critical system functionality
      - `treatment` 'Mitigate' | 'Transfer' | 'Avoid' | 'Accept', required
      - `owner` string, nullable, required — The email of the person responsible for tracking and mitigating this risk scenario.
      - `note` string, nullable, required — Additional context about the risk scenario and why it has specific impact and likelihood scores.
      - `riskRegister` string, nullable, required — Name of the risk register associated with this scenario.
      - `customFields` CustomAttribute[], required — The list of custom fields. You can reference existing custom fields in the Risk Management settings and/or create new ones. The format is: - {label: "field-name", value: "string-representation"} for text, date, number and currency fields - {label: "field-name", value: ["option1", "option2"]} for picklist fields
        - `label` string, required
        - `value` union, required
          - string
          - string[]
      - `isArchived` boolean, required — Whether this scenario is archived.
      - `reviewStatus` 'APPROVED' | 'DRAFT' | 'NOT_REVIEWED' | 'AWAITING_SUBMISSION' | 'PENDING_APPROVAL' | 'REQUESTED_CHANGES', required
      - `requiredApprovers` string[], required — The list of required approvers for this risk scenario.
      - `type` 'Risk Scenario' | 'Enterprise Risk', required
      - `identificationDate` string, date-time, required — The date this risk was identified. Matches the "Identified Date" field in the Vanta UI. Set by the customer when a risk is created; defaults to the scenario's creation time when not explicitly provided.
    - `pageInfo` PageInfo, required — Provides information about the pagination of a dataset.
      - `endCursor` string, nullable, required — The cursor that points to the end of the current page, or null if there is no such cursor.
      - `hasNextPage` boolean, required — Indicates if there is another page after the current page.
      - `hasPreviousPage` boolean, required — Indicates if there is a page before the current page.
      - `startCursor` string, nullable, required — The cursor that points to the start of the current page, or null if there is no such cursor.

---

[API](https://skmtc.net/vanta/apis/build-integrations.md) · [All operations](https://skmtc.net/vanta/apis/build-integrations/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/vanta/build-integrations/revisions/6c1f7590538b/schema)