---
title: "Create Risk"
method: POST
path: "/api/risk/v3/risks"
tags: ["Risks"]
---

# Create Risk

`POST /api/risk/v3/risks`

## Request

- Base URL: `https://hostname`
- URL: `https://hostname/api/risk/v3/risks`
- Auth: OAuth 2
  - Client credentials
  - Token URL: `https://{hostname}/api/access/v1/oauth/token` scopes: `INTEGRATION`, `RISK`

Use this API to create a new risk in the Risk Register. The response will include details of the created risk.
> 🗒 Things to Know
>
> - This API will create a new risk with the specified details.
> - The risk will be created in the default state.
> - This is a standalone risk creation endpoint.

## Request body

- TechRiskComplianceRiskRiskRequest
  - `description` string: description
  - `treatmentPlan` string: treatment plan
  - `orgGroupId` string, uuid, required: organization group id
  - `riskApproversId` string[]: list of approver ids
  - `inherentRiskLevel` TechRiskComplianceRiskRiskLevelDetails
    - `levelId` integer: Risk level identifier
    - `level` string: Risk level name
    - `impactLevelId` integer: Impact level identifier
    - `impactLevel` string: Impact level name
    - `probabilityLevelId` integer: Probability level identifier
    - `probabilityLevel` string: Probability level name
    - `riskScore` number: Calculated risk score
    - `levelGuid` string, uuid: Risk level unique identifier
    - `levelKey` string: Risk level key
    - `colorCode` string: Risk level color code
    - `impactLevelGuid` string, uuid: Impact level unique identifier
    - `impactLevelKey` string: Impact level key
    - `probabilityLevelGuid` string, uuid: Probability level unique identifier
    - `probabilityLevelKey` string: Probability level key
  - `residualRiskLevel` TechRiskComplianceRiskRiskLevelDetails
    - `levelId` integer: Risk level identifier
    - `level` string: Risk level name
    - `impactLevelId` integer: Impact level identifier
    - `impactLevel` string: Impact level name
    - `probabilityLevelId` integer: Probability level identifier
    - `probabilityLevel` string: Probability level name
    - `riskScore` number: Calculated risk score
    - `levelGuid` string, uuid: Risk level unique identifier
    - `levelKey` string: Risk level key
    - `colorCode` string: Risk level color code
    - `impactLevelGuid` string, uuid: Impact level unique identifier
    - `impactLevelKey` string: Impact level key
    - `probabilityLevelGuid` string, uuid: Probability level unique identifier
    - `probabilityLevelKey` string: Probability level key
  - `categoryIds` string[]: risk categories' Ids
  - `threatId` string, uuid: risk threat' Id
  - `vulnerabilityIds` string[]: risk vulnerability' Ids
  - `attributeValues` object: Custom Attributes
  - `targetRiskLevel` TechRiskComplianceRiskRiskLevelDetails
    - `levelId` integer: Risk level identifier
    - `level` string: Risk level name
    - `impactLevelId` integer: Impact level identifier
    - `impactLevel` string: Impact level name
    - `probabilityLevelId` integer: Probability level identifier
    - `probabilityLevel` string: Probability level name
    - `riskScore` number: Calculated risk score
    - `levelGuid` string, uuid: Risk level unique identifier
    - `levelKey` string: Risk level key
    - `colorCode` string: Risk level color code
    - `impactLevelGuid` string, uuid: Impact level unique identifier
    - `impactLevelKey` string: Impact level key
    - `probabilityLevelGuid` string, uuid: Probability level unique identifier
    - `probabilityLevelKey` string: Probability level key
  - `deadline` string, date-time: deadline, format - YYYY-MM-DDTHH:MM:SS.FFFZ
  - `reminderDays` integer: number of days before the deadline when the reminder will be sent
  - `riskOwners` TechRiskComplianceRiskBasicEntityDetail[]: list of risk owners
    - `id` string, uuid: Unique Identifier for the Entity
    - `name` string: Name for the Entity
  - `relatedEntities` TechRiskComplianceRiskRiskSourceInformation[]: list of linked entities
    - `id` string, uuid, required: Source Entity Id
    - `type` 'PIA' | 'GRA' | 'INVENTORY' | 'INCIDENT' | 'ENGAGEMENT' | 'GENERIC': Source Type for the risk
    - `sourceType` TechRiskComplianceRiskEntityTypeInformation
      - `id` string, required: Entity Type ID. This can be Assets, Entities, PIA, Engagement, Custom Object GUID in form of String.
      - `label` string: Entity Type Name
      - `translationKey` string: Translation Key of Entity Type ID
      - `seeded` boolean: For Base Entity Type Seeded is true and false for Custom Object/Entity Types by default.
      - `sourceType` boolean: Indicates whether this type can be source type or not in Risk
      - `riskType` boolean: Indicates whether this type can be risk type or not in Risk
      - `eligibleForEntityLink` boolean: Indicates whether entity type is eligible for linking/relating with risk or not
      - `enabled` boolean: Indicates whether the entity type is enabled or not.
      - `moduleName` string: Name of the module
    - `name` string, required: Source Entity Name
    - `additionalAttributes` object: Additional information about the Source Entity. This will be a Map of String Key and Object value. 'inventoryType' key is mandatory to be passed when sourceType is 'Inventory', and it can have one of the following values, 20 - Assets, 30 - Processing Activities, 50 - Vendors, 60 - Entities
  - `entityIdToControlIds` object: Map of control and related entities
  - `controlIds` string[]: Set of Control Ids
  - `controlRequestDtos` TechRiskComplianceRiskControlRequestDto[]: Ad Hoc control creation requests
    - `identifier` string, required: The identifier of the control.
    - `name` string, required: The name of the control.
    - `orgGroupId` string, uuid, required: The identifier of the organization the master control is linked to. In general, this is top organization in the org hierarchy.
    - `description` string: Description of the control.
    - `recommendation` string: The recommendation status of this control based on Athena logic.
    - `frameworkId` string, uuid: Identifier of the framework the control is tied to.
    - `frameworkName` string: Name of the framework the control is tied to.
    - `frameworkNameKey` string: Identifier used for translation of Framework Name.
    - `status` 'Active' | 'Archived' | 'Pending': The new status of the control. This can be Active, Archived, or Pending.
    - `categoryId` string, uuid: The identifier of the category tied to the control. Optional if no category is needed or if category name is provided.
    - `categoryName` string: The name of the category tied to the control. Optional if category Id is provided.
    - `categoryNameKey` string: Identifier used for translation of category name. Optional if category Id is provided.
    - `attributes` object: Custom Attributes
    - `implementationGuidance` string: Implementation guidance of control.
  - `controlIdToCreateParameter` object: Map of controlId to create parameter
  - `riskTemplate` TechRiskComplianceRiskRiskTemplateIdentifier
    - `id` string, uuid
  - `name` string: name
  - `ignoreControlAutoInheritanceConfiguration` boolean
  - `treatment` string: AKA remediation in current workflow
  - `riskManager` string[]: list of manager ids

## Response `201`

Created

- string, uuid

## Other responses

- `400`: Bad Request
- `401`: Unauthorized
- `403`: Forbidden
- `429`: Too Many Requests. For more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview).
- `500`: Internal Server Error

---

[API](https://skmtc.dev/onetrust/apis/tech-risk-compliance-it-risk-management.md) - [All operations](https://skmtc.dev/onetrust/apis/tech-risk-compliance-it-risk-management/llms.txt) - [OpenAPI document](https://skmtc.dev/onetrust/apis/tech-risk-compliance-it-risk-management/revisions/d0bfd2a3c53e?raw)