---
title: "This endpoint adds an existing TOE to the users portfolio."
method: POST
path: "/v1/toe/{toe_id}"
tags: ["Target Of Evaluation TOE"]
---

# This endpoint adds an existing TOE to the users portfolio.

`POST /v1/toe/{toe_id}`

## Request

- Base URL: `https://api.sandbox.riskrecon.com`
- URL: `https://api.sandbox.riskrecon.com/v1/toe/{toe_id}`
- Auth: HTTP bearer

This endpoint adds an existing TOE to the users portfolio.
The toe_id and other information can be obtained from the /v1/toes/by_domains response.

## Path parameters

- `toe_id` string, required

## Request body

- CompanyAddToPortfolio
  - `risk_relationship_slugs` string[]: Risk relationship slugs which are returned from /v1/portfolio/risk_relationships_folders. This is optional.
  - `subscription_level` 1 | 2, required: The SubscriptionLevelConfig. 1 (Discover) or 2 (Advisor). This defaults to 2.
  - `privacy_subscription_level` 2: The SubscriptionLevelConfig for privacy. Only 2 (Advisor) is available and this is only available if your customer has privacy enabled.
  - `internal_names` string[], nullable: The user defined names for the TOE.
  - `internal_ids` string[], nullable: The user defined identifiers for the TOE. These can be used to query the TOE.
  - `assessment_frequency` 'one_time' | 'continuous', required: Scan frequency. This must be either one_time or continuous. The default is continuous.

## Response `201`

OK

- TOEUpdated: The response for updating values for a given TOE. Only internal_id and internal_name are allowed to be updated by a user.
  - `toe_short_name` string: The Company or entity name.
  - `toe_id` string, uuid: The unique identifier for the Target Of Evaluation (TOE).
  - `internal_name` string[], nullable: The user defined names for the TOE.
  - `internal_id` string[], nullable: The user defined identifiers for the TOE. These can be used to query the TOE.

## Other responses

- `400`: Something was wrong with the request
- `401`: Authentication information was missing or invalid or the user is not authorized to access resource or perform the associated action.
- `403`: FORBIDDEN
- `422`: The syntax of the request entity is correct, but server was unable to process the contained instructions.

---

[API](https://skmtc.dev/recordedfuture/apis/mastercard-riskrecon-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/mastercard-riskrecon-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/mastercard-riskrecon-api/revisions/212ef0eeee9b?raw)