Skip to content

Risks

Create, read, update and delete risks of projects and modules, together with their tasks and countermeasures.

Use cases

  • Push risks found by threat-modelling or review tools into the risk register.
  • Track countermeasures and tasks from your ticketing system.
  • Export the risks of a project for a CRA or ISO 27001 audit.

Operations

Read scopes: manager, compliance_manager, portfolio_manager, company_security_manager. Write scopes: developer, manager, portfolio_manager, compliance_manager, company_security_manager. Delete scopes: manager, account_admin, portfolio_manager, company_security_manager.

Method Path What it does Scopes
GET /core/risks List risks of a project or module Read
POST /core/risks Create risk Write
GET /core/risks/{risk_id} Get risk details Read
POST /core/risks/{risk_id} Update risk Write
DELETE /core/risks/{risk_id} Delete risk Delete
GET /core/risks/{risk_id}/tasks List tasks of a risk Read
POST /core/risks/{risk_id}/tasks Create task Write
GET /core/risks/{risk_id}/tasks/{task_id} Get task Read
POST /core/risks/{risk_id}/tasks/{task_id} Update task Write
DELETE /core/risks/{risk_id}/tasks/{task_id} Delete task Delete
GET /core/risks/{risk_id}/countermeasures List countermeasures Read
POST /core/risks/{risk_id}/countermeasures Create countermeasure Write
GET /core/risks/{risk_id}/countermeasures/{cm_id} Get countermeasure Read
POST /core/risks/{risk_id}/countermeasures/{cm_id} Update countermeasure Write
DELETE /core/risks/{risk_id}/countermeasures/{cm_id} Delete countermeasure Delete

Listing risks

GET /core/risks needs projectId or moduleId; without both it answers 400. With projectId you get the project's own risks and the risks of its modules; with moduleId the risks of that module. Up to 100 per page (page), newest first.

Creating and updating a risk

POST /core/risks takes name (required), projectId or moduleId, and riskProperties:

Field Content
origin List of origin tags: SDLC, SQ, SSC, CVE, YARA, CWE, TD, TMA Assessment, LIC, threat-model
state identified, assessed, approved, planned, implementing, monitored, accepted, closed, deferred, escalated, expired, transferred, eliminated, out-of-scope
impactClass, impact, impactDescription Impact assessment
confidentiality, integrity, availability CIA impact
BV, EF, ARO (and *_enum) Business value, exposure factor, annual rate of occurrence for the quantitative assessment
generalApproach Treatment approach (update only)
countermeasures List of countermeasures, see below
threatModelContext strideCategories, enisaCategory, enisaThreat, cwes, affectedElementType, trustBoundaryCrossing, tmRunId, tmMethod, otmThreatId

Create answers 201 with {"riskId": "..."}. POST /core/risks/{risk_id} merges riskProperties one level deep, so fields you leave out (for example countermeasures) are kept. It answers 200 with the updated risk.

Risks that the SARIF import maintains carry sourceRefs, autoKey, autoTool and autoCwe. These fields are read-only.

DELETE /core/risks/{risk_id} answers 400 while the risk has tasks, unless you add ?force=true; then the tasks are deleted too.

Tasks

POST /core/risks/{risk_id}/tasks takes task and countermeasure (both required), and responsible (user ids), frequency, status, comment, due. Send riskId in the body as well: the task is linked to the risk id in the body, not the one in the path.

Create answers 201 with the new task's id in a field named riskId. Update answers 200 with the task. Tasks are listed 100 per page, newest first.

Countermeasures

A countermeasure has countermeasure (name, 3 to 200 characters, required), status (identified, planned, completed, ok, required, not-required, verified), comment, responsible (user ids), riskReduction (0 to 100 percent), standardRef, validationMethod and otmMitigationId.

  • Create answers 201 with {"countermeasureId": "..."}. The id is generated by the server; an _id in the body is ignored.
  • Update merges the fields you send into the stored countermeasure and answers 200 with it.
  • Delete removes the countermeasure; tasks that name it are not changed.