OneTrust

OneTrust Risk Management API

APIs to manage risk configurations, scoring settings, categories, and metadata used across the risk management system.

Documentation GitHub OpenAPI

Business capability

Enterprise Risk Management BC-120

Operations 8

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

PUT /api/risk/v2/risks/upsert Create or update a risk by matching attributes · Create or Update Risk #

Ask an LLM

“Can I upsert a risk so it's created only if no matching risk exists?”

“Which attributes decide whether an upsert updates an existing risk?”

Tell an agent

Upsert a {type} risk from source {source} on inventory {associatedInventory} in org {orgGroupId}, matching on {matchAttributes}.

Create or update risk {name} matched by {matchAttributes}, type {type}, source {source}, inventory {associatedInventory}, org {orgGroupId}.

POST /api/risk/v2/risks/{id}/assign-stage Move a risk to a workflow stage · Update Risk Stage #

Ask an LLM

“How do I advance a risk to the next stage in its workflow?”

“Can I send a risk back a stage with a comment?”

Tell an agent

Move risk {id} {direction} to stage {nextStageId}.

Send risk {id} {direction} in its workflow with comment {comment}.

PUT /api/risk/v2/risks/{riskId} Replace a risk's details · Update Risk #

Ask an LLM

“Can I fully update a risk's name, description, owners and treatment in one call?”

“What result value is required when updating a risk in full?”

Tell an agent

Update risk {riskId} with result {result} and description {description}.

Fully update risk {riskId}: set result {result}, treatment {treatment}, deadline {deadline}.

DELETE /api/risk/v2/risks/{riskId} Delete a risk · Delete Risk #

Ask an LLM

“Can I remove a risk from the risk register?”

“Is deleting a risk permanent?”

Tell an agent destructive · confirm first

Delete risk {riskId}.

Remove risk {riskId} from the risk register.

PATCH /api/risk/v2/risks/{riskId} Partially modify a risk · Modify Risk #

Ask an LLM

“Can I change just a risk's deadline without resending everything?”

“What setting must be on to change a risk's managing organization?”

Tell an agent

Change the deadline of risk {riskId} to {deadline}.

Patch risk {riskId} to target risk level {targetRiskLevel}.

PUT /api/risk/v2/risks/{riskId}/approvers Update a risk's approvers · Update Risk Approvers #

Ask an LLM

“Who can approve a risk, and can I change them?”

“Why can't I change approvers on a risk in the Monitoring stage?”

Tell an agent

Set the approvers of risk {riskId} to {riskApprovers}.

Replace risk {riskId}'s approvers with {riskApprovers}.

PUT /api/risk/v2/risks/{riskId}/categories Update a risk's categories · Update Risk Categories #

Ask an LLM

“Can I recategorize an existing risk?”

“Is there a call just for changing the categories on a risk?”

Tell an agent

Update the categories on risk {riskId}.

Recategorize risk {riskId}.

PUT /api/risk/v2/risks/{riskId}/owners Update a risk's owners · Update Risk Owners #

Ask an LLM

“Can I reassign who owns a risk?”

“Are there stages where risk owners can't be changed?”

Tell an agent

Set the owners of risk {riskId} to {riskOwners}.

Reassign risk {riskId} to owners {riskOwners}.

Documentation

https://developer.onetrust.com/onetrust/reference/attribute-management

https://developer.onetrust.com/onetrust/reference/activity-log

https://developer.onetrust.com/onetrust/reference/preferences-v2

https://developer.onetrust.com/onetrust/reference/banner

https://developer.onetrust.com/onetrust/reference/consent-receipts

https://developer.onetrust.com/onetrust/reference/applications

https://developer.onetrust.com/onetrust/reference/categorizations

https://developer.onetrust.com/onetrust/reference/domain-data

https://developer.onetrust.com/onetrust/reference/preferences

https://developer.onetrust.com/onetrust/reference/mobile-app-data

https://developer.onetrust.com/onetrust/reference/privacy-notice-v2

https://developer.onetrust.com/onetrust/reference/collection-points

https://developer.onetrust.com/onetrust/reference/catalog-search-v1

https://developer.onetrust.com/onetrust/reference/classification

https://developer.onetrust.com/onetrust/reference/custom-scan

https://developer.onetrust.com/onetrust/reference/carbon-management

https://developer.onetrust.com/onetrust/reference/audit-records

https://developer.onetrust.com/onetrust/reference/bulk-export

https://developer.onetrust.com/onetrust/reference/attachments

https://developer.onetrust.com/onetrust/reference/system-credentials

https://developer.onetrust.com/onetrust/reference/inventory-relationships-v2

https://developer.onetrust.com/onetrust/reference/model-management

https://developer.onetrust.com/onetrust/reference/tasks

https://developer.onetrust.com/onetrust/reference/groups-v2

https://developer.onetrust.com/onetrust/reference/assessment-actions

https://developer.onetrust.com/onetrust/reference/inventory

https://developer.onetrust.com/onetrust/reference/inventory-1

https://developer.onetrust.com/onetrust/reference/drop-management

https://developer.onetrust.com/onetrust/reference/incidents

https://developer.onetrust.com/onetrust/reference/document-controller

https://developer.onetrust.com/onetrust/reference/audits

https://developer.onetrust.com/onetrust/reference/initiatives

https://developer.onetrust.com/onetrust/reference/document-attachments

https://developer.onetrust.com/onetrust/reference/issues

https://developer.onetrust.com/onetrust/reference/control-implementations

https://developer.onetrust.com/onetrust/reference/training

https://developer.onetrust.com/onetrust/reference/contracts

Specifications

https://raw.githubusercontent.com/api-evangelist/onetrust/refs/heads/main/openapi/onetrust-risk-management-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this

find_apisBrowse and filter every API in the catalog.
get_api_artifactsOne API's artifacts, grouped by type.
get_openapiThe primary OpenAPI for this API.
find_similar_apisAPIs that look like this one.
apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
resolveTurn a domain, URL or GitHub org into the provider it belongs to.
find_cohortsEvery scored population of providers in the catalog.

All 92 tools →

Call it yourself

curl for this page

This API

curl "https://apis.io/api/v1/apis/onetrust:onetrust-risk-management-api"

All apis

curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

openapi: 3.2.0
info:
  title: Tech Risk & Compliance - IT Risk Management API
  description: The IT Risk Management API provides comprehensive REST endpoints for managing enterprise security controls, threats, vulnerabilities, and their implementations with OAuth2 security and extensive customization capabilities.
  version: '1.0'
  contact:
    name: OneTrust Support
    url: https://my.onetrust.com/s/contactsupport
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
- url: https://{hostname}
  variables:
    hostname:
      default: hostname
      description: The OneTrust hostname such as app.onetrust.com, app-eu.onetrust.com, app-de.onetrust.com, app-uk.onetrust.com, app-apac.onetrust.com, trial.onetrust.com, or uat.onetrust.com.
tags:


# --- truncated at 32 KB (71 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/onetrust/refs/heads/main/openapi/onetrust-risk-management-api-openapi.yml