---
title: "List organization risks"
method: GET
path: "/v1/risks"
tags: ["Risks"]
---

# List organization risks

`GET /v1/risks`

List organization risks with owners, departments, severity, mitigation status, and evidence for risk management reporting.

## Query parameters

- `title` string
- `page` number
- `perPage` number
- `sort` 'createdAt' | 'updatedAt' | 'title' | 'status'
- `sortDirection` 'asc' | 'desc'
- `status` 'open' | 'pending' | 'closed' | 'archived'
- `category` 'customer' | 'fraud' | 'governance' | 'operations' | 'other' | 'people' | 'regulatory' | 'reporting' | 'resilience' | 'technology' | 'vendor_management'
- `department` string
- `assigneeId` string

## Response `200`

Risks retrieved successfully

- object
  - `data` object[]
    - `id` string — Risk ID
    - `title` string — Risk title
    - `description` string — Risk description
    - `category` 'customer' | 'governance' | 'operations' | 'other' | 'people' | 'regulatory' | 'reporting' | 'resilience' | 'technology' | 'vendor_management'
    - `status` 'open' | 'pending' | 'closed' | 'archived'
    - `likelihood` 'very_unlikely' | 'unlikely' | 'possible' | 'likely' | 'very_likely'
    - `impact` 'insignificant' | 'minor' | 'moderate' | 'major' | 'severe'
    - `treatmentStrategy` 'accept' | 'avoid' | 'mitigate' | 'transfer'
    - `assigneeId` string, nullable — ID of the user assigned to this risk
    - `createdAt` string, date-time — When the risk was created
    - `updatedAt` string, date-time — When the risk was last updated
  - `count` number — Total number of risks
  - `authType` 'api-key' | 'session' — How the request was authenticated
  - `authenticatedUser` object — User information (only for session auth)
    - `id` string
    - `email` string

## Other responses

- `401` — Unauthorized - Invalid authentication or insufficient permissions
- `404` — Organization not found
- `500` — Internal server error

## Changes

- **2026-06-05** `33c685841b7a` — 7 breaking, 1 warning
  - removed the enum value `admin` from the `query` request parameter `department`
  - removed the enum value `gov` from the `query` request parameter `department`
  - removed the enum value `hr` from the `query` request parameter `department`
  - removed the enum value `it` from the `query` request parameter `department`
  - …4 more
- **2026-06-05** `7ca7c363a732` — 1 breaking, 7 info
  - the `query` request parameter `department` was restricted to a list of enum values
  - added the new enum value `admin` to the `query` request parameter `department`
  - added the new enum value `gov` to the `query` request parameter `department`
  - added the new enum value `hr` to the `query` request parameter `department`
  - …4 more
- **2026-06-05** `d0f58f24175b` — 7 breaking, 1 warning
  - removed the enum value `admin` from the `query` request parameter `department`
  - removed the enum value `gov` from the `query` request parameter `department`
  - removed the enum value `hr` from the `query` request parameter `department`
  - removed the enum value `it` from the `query` request parameter `department`
  - …4 more
- **2026-06-04** `d7d0199d846f` — 1 info
  - the endpoint scheme security `oauth2` was removed from the API
- **2026-05-29** `5382c53ab431` — 1 info
  - the endpoint scheme security `oauth2` was added to the API

[Change history](https://skmtc.dev/trycompai/apis/comp-ai-api/changes/v1/risks/get.md)

---

[API](https://skmtc.dev/trycompai/apis/comp-ai-api.md) · [All operations](https://skmtc.dev/trycompai/apis/comp-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/trycompai/comp-ai-api/revisions/726b9523fb22/schema)