---
title: "This endpoint adds and updates subscription licenses for a TOE."
method: POST
path: "/v1/toes/{toe_id}/subscriptions"
tags: ["Portfolio"]
---

# This endpoint adds and updates subscription licenses for a TOE.

`POST /v1/toes/{toe_id}/subscriptions`

## Request

- Base URL: `https://api.sandbox.riskrecon.com`
- URL: `https://api.sandbox.riskrecon.com/v1/toes/{toe_id}/subscriptions`
- Auth: HTTP bearer

This request sets the list of subscription licenses that determine whether a TOE appears in your portfolio, and for which risk dimensions. The currently available Risk Dimensions are CYBER and PRIVACY. The available license types are AVISOR, DISCOVER, and SNAPSHOT. A cyber license of ADVISOR or DISCOVER is a prerequisite of any privacy license. SNAPSHOT licenses are not available for the privacy risk dimension at this time.

## Path parameters

- `toe_id` string, required

## Request body

- ChangeSubscriptions: A request to add or modify portfolio subscriptions for a TOE
  - `licenses` PortfolioLicense[]: The list of licenses to which this user wishes to subscribe for this TOE
    - `name` 'ADVISOR' | 'DISCOVER' | 'SNAPSHOT', required: Name indicating a Riskrecon subscription level purchased by the customer
    - `riskDimension` 'CYBER' | 'PRIVACY', required: Category of security domain or criteria. Can currently be cyber or privacy.

## Response `201`

ChangeSubscription list of affected subscriptions and success message.

- ChangedSubscriptions: Response object when the list of subscriptions for a TOE has been updated
  - `message` string, required: Success message or info about modified subscriptions
  - `events` ChangedSubscription[], required
    - `customerId` string, uuid, required: The customer Id of the user.
    - `toeId` string, uuid: The unique identifier for the Target Of Evaluation (TOE).
    - `newLicense` 'ADVISOR' | 'DISCOVER' | 'ENTERPRISE' | 'SNAPSHOT', required: The license level of a newly added subscription
    - `oldLicense` 'ADVISOR' | 'DISCOVER' | 'ENTERPRISE' | 'SNAPSHOT' | 'null', nullable, required: The license level of a subscription that has been replaced
    - `riskDimension` 'CYBER' | 'PRIVACY', required: Category of security domain or criteria. Can currently be cyber or privacy.
    - `subscriptionAdjustedOn` string, required: The date at which this subscription was updated

## Other responses

- `400`: Something was wrong with the request
- `401`: Authentication information was missing or invalid or the user is not authorized to access resource or perform the associated action.

---

[API](https://skmtc.dev/recordedfuture/apis/mastercard-riskrecon-api.md) - [All operations](https://skmtc.dev/recordedfuture/apis/mastercard-riskrecon-api/llms.txt) - [OpenAPI document](https://skmtc.dev/recordedfuture/apis/mastercard-riskrecon-api/revisions/212ef0eeee9b?raw)