docs

Get one risk record

GET /risk/records/{id}

Scope risk:read Plan Growth+

Requires the risk:read scope. Needs the risk_management plan feature.

Example

curl "https://api.autociso.io/api/v1/risk/records/<id>" \
  -H "Authorization: Bearer <your-api-token>"

Response 200

{
  "data": {
    "assetIds": [
      "ast_1hfz2m3r9t5b"
    ],
    "businessOwnerId": "empl_1hgyq2b7z5tc",
    "controlIds": [
      "A.5.18",
      "A.8.2"
    ],
    "createdAt": "2026-08-04T09:00:00Z",
    "domain": "access",
    "dueAt": "2026-12-31T00:00:00Z",
    "id": "rrec_1hj7c2m8x4qa",
    "inherentScore": 16,
    "ownerId": "empl_1hgyq2b7z5tc",
    "residualScore": 8,
    "status": "active",
    "strategy": "minimize",
    "supplierId": "sup_1hd8c2x7q0wn",
    "technicalOwnerId": "empl_1hgyun41rx48",
    "updatedAt": "2026-10-09T14:10:00Z"
  },
  "error": null
}

Path parameters

  • id string required

Returns

The data field of the standard { data, error, meta } envelope:

  • assetIds array of string required
    Linked asset ids (ast_).
  • businessOwnerId string
    Business owner employee id (empl_), when set.
  • controlIds array of string required
    Linked ISO 27001 control ids.
  • createdAt string (date-time) required
    Creation time (UTC).
  • domain string
    Risk domain: access, compliance, vulnerability, resilience or assets.
  • dueAt string (date-time) or null
    Next review date (UTC), when set.
  • id string required
    Risk record id (rrec_).
  • inherentScore number or null
    Inherent risk score, when assessed.
  • ownerId string
    Risk owner employee id (empl_), when set.
  • residualScore number or null
    Residual risk score, when assessed.
  • status string required
    awaiting_review, active, accepted, mitigated, avoided or closed.
  • strategy string
    Selected treatment strategy: accept, minimize or avoid.
  • supplierId string
    Linked supplier id (sup_), when set.
  • technicalOwnerId string
    Technical owner employee id (empl_), when set.
  • updatedAt string (date-time) required
    Last modification time (UTC); the incremental-sync field.
  • No other fields.

Errors

Status Code Retry Meaning
400 - no The request is invalid.
401 - no The token is missing, malformed, expired or revoked.
402 - no The organisation’s plan does not include the feature this route needs.
403 - no The token may not use this route.
404 - no The resource does not exist in this organisation.
429 - yes Rate limit or row budget exceeded; retry after the time in Retry-After.
500 - no Unexpected server error.
503 - yes A dependency is temporarily unavailable; retry later.
Last reviewed: 2026-10-13

Was this page helpful?

Esc