# Get one risk record

Requires the `risk:read` scope.

`GET /risk/records/{id}`

Scope `risk:read` | Plan **Growth+**

Requires the `risk:read` scope. Needs the `risk_management` plan feature.

## Path parameters

| Name | Type | Required | Description |
|---|---|---|---|
| `id` | string | yes |  |

## Returns

The `data` field of the standard `{ data, error, meta }` envelope:

- `assetIds`: array of string Linked asset ids (ast_).
- `businessOwnerId`: optional string Business owner employee id (empl_), when set.
- `controlIds`: array of string Linked ISO 27001 control ids.
- `createdAt`: string (date-time) Creation time (UTC).
- `domain`: optional string Risk domain: access, compliance, vulnerability, resilience or assets.
- `dueAt`: optional string (date-time) or null Next review date (UTC), when set.
- `id`: string Risk record id (rrec_).
- `inherentScore`: optional number or null Inherent risk score, when assessed.
- `ownerId`: optional string Risk owner employee id (empl_), when set.
- `residualScore`: optional number or null Residual risk score, when assessed.
- `status`: string awaiting_review, active, accepted, mitigated, avoided or closed.
- `strategy`: optional string Selected treatment strategy: accept, minimize or avoid.
- `supplierId`: optional string Linked supplier id (sup_), when set.
- `technicalOwnerId`: optional string Technical owner employee id (empl_), when set.
- `updatedAt`: string (date-time) Last modification time (UTC); the incremental-sync field.
- No other fields.

## Errors

| Status | Code | Retry | Meaning |
|---|---|---|---|
| 400 | - | no | The request is invalid. |
| 401 | - | no | The token is missing, malformed, expired or revoked. |
| 402 | - | no | The organisation's plan does not include the feature this route needs. |
| 403 | - | no | The token may not use this route. |
| 404 | - | no | The resource does not exist in this organisation. |
| 429 | - | yes | Rate limit or row budget exceeded; retry after the time in Retry-After. |
| 500 | - | no | Unexpected server error. |
| 503 | - | yes | A dependency is temporarily unavailable; retry later. |

## Example

### curl

```bash
curl "https://api.autociso.io/api/v1/risk/records/<id>" \
  -H "Authorization: Bearer <your-api-token>"
```

### Python

```python
import requests

response = requests.get(
    "https://api.autociso.io/api/v1/risk/records/<id>",
    headers={"Authorization": "Bearer <your-api-token>"},
)
print(response.json())
```

### JavaScript

```javascript
const response = await fetch("https://api.autociso.io/api/v1/risk/records/<id>", {
  method: "GET",
  headers: { "Authorization": "Bearer <your-api-token>" },
});
console.log(await response.json());
```

## Response (200)

```json
{
  "data": {
    "assetIds": [
      "ast_1hfz2m3r9t5b"
    ],
    "businessOwnerId": "empl_1hgyq2b7z5tc",
    "controlIds": [
      "A.5.18",
      "A.8.2"
    ],
    "createdAt": "2026-08-04T09:00:00Z",
    "domain": "access",
    "dueAt": "2026-12-31T00:00:00Z",
    "id": "rrec_1hj7c2m8x4qa",
    "inherentScore": 16,
    "ownerId": "empl_1hgyq2b7z5tc",
    "residualScore": 8,
    "status": "active",
    "strategy": "minimize",
    "supplierId": "sup_1hd8c2x7q0wn",
    "technicalOwnerId": "empl_1hgyun41rx48",
    "updatedAt": "2026-10-09T14:10:00Z"
  },
  "error": null
}
```