OneTrust

OneTrust Risk Actions API

APIs to manage risk workflow actions including submissions, approvals, exceptions, and stage transitions within the risk lifecycle.

Documentation GitHub OpenAPI

Business capability

Risk Treatment Management BC-120.30

Operations 7

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

PUT /api/risk/v2/risks/{riskId}/actions/{action} Perform a risk action (deprecated) · Perform Risk Action #

Ask an LLM

“Is the generic perform-risk-action endpoint still supported?”

“Can I run a named action on a risk through the deprecated call?”

Tell an agent

Perform action {action} on risk {riskId} using the deprecated endpoint.

Run legacy risk action {action} for {riskId}.

PUT /api/risk/v2/risks/{riskId}/approve Approve a risk · Approve Risk #

Ask an LLM

“Can I approve a risk and set its residual risk level and score?”

“What must be provided to approve a risk?”

Tell an agent

Approve risk {riskId} with result {result}, residual level {residualRiskLevelId}, score {residualRiskScore}.

Approve risk {riskId} with comment {comment}.

PUT /api/risk/v2/risks/{riskId}/grant-exception Grant an exception for a risk · Grant Risk Exception #

Ask an LLM

“Can I grant an exception on a risk instead of remediating it?”

“Does granting a risk exception let me record a residual score?”

Tell an agent

Grant an exception on risk {riskId} with result {result}.

Grant risk {riskId} an exception, result {result}, noting {comment}.

PUT /api/risk/v2/risks/{riskId}/reopen Reopen a risk · Reopen Risk #

Ask an LLM

“Can a closed risk be reopened?”

“Is it possible to send a reopened risk to a specific workflow stage?”

Tell an agent

Reopen risk {riskId}.

Reopen risk {riskId} at stage {stage} with comment {comment}.

PUT /api/risk/v2/risks/{riskId}/request-exception Request an exception for a risk · Request Risk Exception #

Ask an LLM

“Can I ask for an exception on a risk rather than grant one?”

“Where do I submit a request for a risk exception?”

Tell an agent

Request an exception for risk {riskId}.

Ask for an exception on {riskId} because {comment}.

PUT /api/risk/v2/risks/{riskId}/send-back Send a risk back for more information · Send Back Risk #

Ask an LLM

“Can I return a risk to its owner to gather more detail?”

“What happens when a risk is sent back?”

Tell an agent

Send risk {riskId} back for more information.

Return risk {riskId} to its owner with note {comment}.

PUT /api/risk/v2/risks/{riskId}/submit Submit a risk for approval · Submit Risk #

Ask an LLM

“Can I submit a risk so it goes to the approver?”

“Is a comment allowed when submitting a risk?”

Tell an agent

Submit risk {riskId} for approval.

Submit {riskId} to its approver with comment {comment}.

Documentation

https://developer.onetrust.com/onetrust/reference/attribute-management

https://developer.onetrust.com/onetrust/reference/activity-log

https://developer.onetrust.com/onetrust/reference/preferences-v2

https://developer.onetrust.com/onetrust/reference/banner

https://developer.onetrust.com/onetrust/reference/consent-receipts

https://developer.onetrust.com/onetrust/reference/applications

https://developer.onetrust.com/onetrust/reference/categorizations

https://developer.onetrust.com/onetrust/reference/domain-data

https://developer.onetrust.com/onetrust/reference/preferences

https://developer.onetrust.com/onetrust/reference/mobile-app-data

https://developer.onetrust.com/onetrust/reference/privacy-notice-v2

https://developer.onetrust.com/onetrust/reference/collection-points

https://developer.onetrust.com/onetrust/reference/catalog-search-v1

https://developer.onetrust.com/onetrust/reference/classification

https://developer.onetrust.com/onetrust/reference/custom-scan

https://developer.onetrust.com/onetrust/reference/carbon-management

https://developer.onetrust.com/onetrust/reference/audit-records

https://developer.onetrust.com/onetrust/reference/bulk-export

https://developer.onetrust.com/onetrust/reference/attachments

https://developer.onetrust.com/onetrust/reference/system-credentials

https://developer.onetrust.com/onetrust/reference/inventory-relationships-v2

https://developer.onetrust.com/onetrust/reference/model-management

https://developer.onetrust.com/onetrust/reference/tasks

https://developer.onetrust.com/onetrust/reference/groups-v2

https://developer.onetrust.com/onetrust/reference/assessment-actions

https://developer.onetrust.com/onetrust/reference/inventory

https://developer.onetrust.com/onetrust/reference/inventory-1

https://developer.onetrust.com/onetrust/reference/drop-management

https://developer.onetrust.com/onetrust/reference/incidents

https://developer.onetrust.com/onetrust/reference/document-controller

https://developer.onetrust.com/onetrust/reference/audits

https://developer.onetrust.com/onetrust/reference/initiatives

https://developer.onetrust.com/onetrust/reference/document-attachments

https://developer.onetrust.com/onetrust/reference/issues

https://developer.onetrust.com/onetrust/reference/control-implementations

https://developer.onetrust.com/onetrust/reference/training

https://developer.onetrust.com/onetrust/reference/contracts

Specifications

https://raw.githubusercontent.com/api-evangelist/onetrust/refs/heads/main/openapi/onetrust-risk-actions-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/onetrust:onetrust-risk-actions-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Tech Risk & Compliance - IT Risk Management Risk Actions API
  description: The IT Risk Management API provides comprehensive REST endpoints for managing enterprise security controls, threats, vulnerabilities, and their implementations with OAuth2 security and extensive customization capabilities.
  version: '1.0'
  contact:
    name: OneTrust Support
    url: https://my.onetrust.com/s/contactsupport
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
- url: https://{hostname}
  variables:
    hostname:
      default: hostname
      description: The OneTrust hostname such as app.onetrust.com, app-eu.onetrust.com, app-de.onetrust.com, app-uk.onetrust.com, app-apac.onetrust.com, trial.onetrust.com, or uat.onetrust.com.
tags:


# --- truncated at 32 KB (48 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/onetrust/refs/heads/main/openapi/onetrust-risk-actions-api-openapi.yml