---
title: "Create organization risk"
method: POST
path: "/v1/risks"
tags: ["Risks"]
---

# Create organization risk

`POST /v1/risks`

Create a risk record with ownership and context so compliance teams can track mitigation and remediation work.

## Request body

- CreateRiskDto
  - `title` string, required — Risk title
  - `description` string, required — Detailed description of the risk
  - `category` 'customer' | 'fraud' | 'governance' | 'operations' | 'other' | 'people' | 'regulatory' | 'reporting' | 'resilience' | 'technology' | 'vendor_management', required — Risk category
  - `department` string — Department responsible for the risk. Built-in values: none, admin, gov, hr, it, itsm, qms. Custom department names are also accepted.
  - `status` 'open' | 'pending' | 'closed' | 'archived', required — Current status of the risk
  - `likelihood` 'very_unlikely' | 'unlikely' | 'possible' | 'likely' | 'very_likely', required — Likelihood of the risk occurring
  - `impact` 'insignificant' | 'minor' | 'moderate' | 'major' | 'severe', required — Impact if the risk materializes
  - `residualLikelihood` 'very_unlikely' | 'unlikely' | 'possible' | 'likely' | 'very_likely', required — Residual likelihood after treatment
  - `residualImpact` 'insignificant' | 'minor' | 'moderate' | 'major' | 'severe', required — Residual impact after treatment
  - `treatmentStrategyDescription` string — Description of the treatment strategy
  - `treatmentStrategy` 'accept' | 'avoid' | 'mitigate' | 'transfer', required — Risk treatment strategy
  - `assigneeId` string — ID of the user assigned to this risk

## Response `201`

Risk created successfully

- object
  - `id` string — Risk ID
  - `title` string — Risk title
  - `description` string — Risk description
  - `category` 'customer' | 'governance' | 'operations' | 'other' | 'people' | 'regulatory' | 'reporting' | 'resilience' | 'technology' | 'vendor_management'
  - `department` 'none' | 'admin' | 'gov' | 'hr' | 'it' | 'itsm' | 'qms', nullable
  - `status` 'open' | 'pending' | 'closed' | 'archived'
  - `likelihood` 'very_unlikely' | 'unlikely' | 'possible' | 'likely' | 'very_likely'
  - `impact` 'insignificant' | 'minor' | 'moderate' | 'major' | 'severe'
  - `residualLikelihood` 'very_unlikely' | 'unlikely' | 'possible' | 'likely' | 'very_likely'
  - `residualImpact` 'insignificant' | 'minor' | 'moderate' | 'major' | 'severe'
  - `treatmentStrategyDescription` string, nullable
  - `treatmentStrategy` 'accept' | 'avoid' | 'mitigate' | 'transfer'
  - `organizationId` string
  - `assigneeId` string, nullable — ID of the user assigned to this risk
  - `createdAt` string, date-time — When the risk was created
  - `updatedAt` string, date-time — When the risk was last updated
  - `authType` 'api-key' | 'session' — How the request was authenticated
  - `authenticatedUser` object — User information (only for session auth)
    - `id` string
    - `email` string

## Other responses

- `400` — Bad request - Invalid input data
- `401` — Unauthorized - Invalid authentication or insufficient permissions
- `404` — Organization not found
- `500` — Internal server error

## Changes

> 56 revisions in range; 4 could not be searched.

- **2026-06-05** `33c685841b7a` — 7 breaking, 1 warning
  - removed the enum value `admin` of the request property `department`
  - removed the enum value `gov` of the request property `department`
  - removed the enum value `hr` of the request property `department`
  - removed the enum value `it` of the request property `department`
  - …4 more
- **2026-06-05** `7ca7c363a732` — 1 breaking, 7 info
  - request property `department` was restricted to a list of enum values
  - added the new `admin` enum value to the request property `department`
  - added the new `gov` enum value to the request property `department`
  - added the new `hr` enum value to the request property `department`
  - …4 more
- **2026-06-05** `d0f58f24175b` — 7 breaking, 1 warning
  - removed the enum value `admin` of the request property `department`
  - removed the enum value `gov` of the request property `department`
  - removed the enum value `hr` of the request property `department`
  - removed the enum value `it` of the request property `department`
  - …4 more
- **2026-06-04** `d7d0199d846f` — 1 info
  - the endpoint scheme security `oauth2` was removed from the API
- **2026-05-29** `5382c53ab431` — 1 info
  - the endpoint scheme security `oauth2` was added to the API

[Change history](https://skmtc.dev/trycompai/apis/comp-ai-api/changes/v1/risks/post.md)

---

[API](https://skmtc.dev/trycompai/apis/comp-ai-api.md) · [All operations](https://skmtc.dev/trycompai/apis/comp-ai-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/trycompai/comp-ai-api/revisions/726b9523fb22/schema)