---
title: "This resource sends action plan email to recipients of a TOE."
method: POST
path: "/v1/action_plan/{toe_id}"
tags: ["Action Plans"]
---

# This resource sends action plan email to recipients of a TOE.

`POST /v1/action_plan/{toe_id}`

## Request

- Base URL: `https://api.sandbox.riskrecon.com`
- URL: `https://api.sandbox.riskrecon.com/v1/action_plan/{toe_id}`
- Auth: HTTP bearer

This API sends action plan findings to internal and external recipients. The end-user needs to input the TOE ID (toe_id) for a given action plan in the API request.

Recipients and frequency are optional. If recipients are not provided, the action plan will be shared with previously shared recipients. If frequency is not provided, the action plan will be shared manually.

Users can retrieve action plan configuration from ```(GET) /v1/action_plan/{toe_id} ``` API.
* recipients: An Array of first_name, last_name, email, internal (true/false) for each recipient. See schema for more details.
* frequency:  0 (default) is for manual/one-off, where 30/60/90 sets periodic automated action plan emails.

## Path parameters

- `toe_id` string, required

## Request body

- ShareActionPlan
  - `recipients` Recipient[]: A collection of recipients.
    - `first_name` string, required: The first name of the recipient.
    - `last_name` string, required: The last name of the recipient.
    - `email` string, required: The email address of the recipient. External recipients domain checked against the TOE domain.
    - `internal` boolean, required: Is the recipient internal? Internal recipients only receives confirmation emails when action plan is shared. At least one external recipient is required if not previously shared.
  - `frequency` 0 | 30 | 60 | 90: The frequency of the action plan.

## Response `201`

OK

## Other responses

- `400`: Something was wrong with the request
- `401`: Authentication information was missing or invalid or the user is not authorized to access resource or perform the associated action.
- `422`: The syntax of the request entity is correct, but server was unable to process the contained instructions.

---

[API](https://skmtc.dev/recordedfuture/apis/mastercard-riskrecon-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/mastercard-riskrecon-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/mastercard-riskrecon-api/revisions/212ef0eeee9b?raw)