OneTrust

OneTrust Risk Relationships API

APIs to manage relationships between risks and other entities including threats, vulnerabilities, controls, and inventory items.

GitHub OpenAPI
Business capability
Enterprise Risk Management BC-120

Operations 3

Each operation below carries the questions people ask an LLM about it and the instructions they give an agent to run it. Generated by API Evangelist overlay

POST /api/risk/v2/risks/{riskId}/control-implementations Add control implementations to a risk · Add Controls to Risk #
Ask an LLM
“How do I attach mitigating controls to a risk?”
“Can I set the status of controls as I add them to a risk?”
Tell an agent
Add controls {controlIds} to risk {riskId}.
Attach controls {controlIds} to risk {riskId} with status {status}.
POST /api/risk/v2/risks/{riskId}/threats Set the threat on a risk · Add Threat to Risk #
Ask an LLM
“How do I record which threat a risk comes from?”
“Does adding a threat replace the one already on the risk?”
Tell an agent
Set threat {threatId} on risk {riskId}.
Replace the threat on risk {riskId} with {threatId}.
POST /api/risk/v2/risks/{riskId}/vulnerabilities Set the vulnerabilities on a risk · Add Vulnerabilities to Risk #
Ask an LLM
“How do I tie library vulnerabilities to a risk?”
“Will assigning vulnerabilities overwrite those already on the risk?”
Tell an agent
Assign vulnerabilities {vulnerabilityIdList} to risk {riskId}.
Replace risk {riskId}'s vulnerabilities with {vulnerabilityIdList}.

Documentation

📖
Documentation
https://developer.onetrust.com/onetrust/reference/attribute-management
📖
Documentation
https://developer.onetrust.com/onetrust/reference/activity-log
📖
Documentation
https://developer.onetrust.com/onetrust/reference/preferences-v2
📖
Documentation
https://developer.onetrust.com/onetrust/reference/banner
📖
Documentation
https://developer.onetrust.com/onetrust/reference/consent-receipts
📖
Documentation
https://developer.onetrust.com/onetrust/reference/applications
📖
Documentation
https://developer.onetrust.com/onetrust/reference/categorizations
📖
Documentation
https://developer.onetrust.com/onetrust/reference/domain-data
📖
Documentation
https://developer.onetrust.com/onetrust/reference/preferences
📖
Documentation
https://developer.onetrust.com/onetrust/reference/mobile-app-data
📖
Documentation
https://developer.onetrust.com/onetrust/reference/privacy-notice-v2
📖
Documentation
https://developer.onetrust.com/onetrust/reference/collection-points
📖
Documentation
https://developer.onetrust.com/onetrust/reference/catalog-search-v1
📖
Documentation
https://developer.onetrust.com/onetrust/reference/classification
📖
Documentation
https://developer.onetrust.com/onetrust/reference/custom-scan
📖
Documentation
https://developer.onetrust.com/onetrust/reference/carbon-management
📖
Documentation
https://developer.onetrust.com/onetrust/reference/audit-records
📖
Documentation
https://developer.onetrust.com/onetrust/reference/bulk-export
📖
Documentation
https://developer.onetrust.com/onetrust/reference/attachments
📖
Documentation
https://developer.onetrust.com/onetrust/reference/system-credentials
📖
Documentation
https://developer.onetrust.com/onetrust/reference/inventory-relationships-v2
📖
Documentation
https://developer.onetrust.com/onetrust/reference/model-management
📖
Documentation
https://developer.onetrust.com/onetrust/reference/tasks
📖
Documentation
https://developer.onetrust.com/onetrust/reference/groups-v2
📖
Documentation
https://developer.onetrust.com/onetrust/reference/assessment-actions
📖
Documentation
https://developer.onetrust.com/onetrust/reference/inventory
📖
Documentation
https://developer.onetrust.com/onetrust/reference/inventory-1
📖
Documentation
https://developer.onetrust.com/onetrust/reference/drop-management
📖
Documentation
https://developer.onetrust.com/onetrust/reference/incidents
📖
Documentation
https://developer.onetrust.com/onetrust/reference/document-controller
📖
Documentation
https://developer.onetrust.com/onetrust/reference/audits
📖
Documentation
https://developer.onetrust.com/onetrust/reference/initiatives
📖
Documentation
https://developer.onetrust.com/onetrust/reference/document-attachments
📖
Documentation
https://developer.onetrust.com/onetrust/reference/issues
📖
Documentation
https://developer.onetrust.com/onetrust/reference/control-implementations
📖
Documentation
https://developer.onetrust.com/onetrust/reference/training
📖
Documentation
https://developer.onetrust.com/onetrust/reference/contracts

Specifications

⚙
OpenAPI
https://raw.githubusercontent.com/api-evangelist/onetrust/refs/heads/main/openapi/onetrust-risk-relationships-api-openapi.yml

Work with this as data

Every API here is available over the APIs.io API and to AI agents over MCP.

MCP server

One button, every client — Claude, Cursor, VS Code and the rest.

https://apis.io/mcp

Tools for apis

7 MCP tools reach this
  • find_apisBrowse and filter every API in the catalog.
  • get_api_artifactsOne API's artifacts, grouped by type.
  • get_openapiThe primary OpenAPI for this API.
  • find_similar_apisAPIs that look like this one.
  • apis_io_searchSTART HERE — APIs, providers and tags for one query, each with its total.
  • resolveTurn a domain, URL or GitHub org into the provider it belongs to.
  • find_cohortsEvery scored population of providers in the catalog.
All 92 tools →

Call it yourself

curl for this page
This API 
curl "https://apis.io/api/v1/apis/onetrust:onetrust-risk-relationships-api"
All apis 
curl "https://apis.io/api/v1/apis?limit=25"

Discovery needs no key. Ratings and market analysis are Pro.

Get an API key

Free tier, no form to fill in. Signing in shares your email address with us — we store it to create your key and to recognise you if you sign in with another provider. See our Privacy Policy and Terms.

GitHub Google LinkedIn

A second provider on the same verified email joins the account you already have.

OpenAPI Specification

onetrust-risk-relationships-api-openapi.yml Raw ↑ 
openapi: 3.2.0
info:
  title: Tech Risk & Compliance - IT Risk Management Risk…
  description: The IT Risk Management API provides comprehensive REST endpoints for managing enterprise security controls, threats, vulnerabilities, and their implementations with OAuth2 security and extensive customization capabilities.
  version: '1.0'
  contact:
    name: OneTrust Support
    url: https://my.onetrust.com/s/contactsupport
  license:
    name: Apache 2.0
    url: https://www.apache.org/licenses/LICENSE-2.0
servers:
- url: https://{hostname}
  variables:
    hostname:
      default: hostname
      description: The OneTrust hostname such as app.onetrust.com, app-eu.onetrust.com, app-de.onetrust.com, app-uk.onetrust.com, app-apac.onetrust.com, trial.onetrust.com, or uat.onetrust.com.
tags:
- name: Risk Relationships
  description: APIs to manage relationships between risks and other entities including threats, vulnerabilities, controls, and inventory items.
  externalDocs:
    description: OpenAPI 3.1.0 - Download Definition
    url: https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-it-risk-management.json
  x-displayName: Risk Relationships
paths:
  /api/risk/v2/risks/{riskId}/control-implementations:
    post:
      operationId: addControlsToRiskUsingPOST
      summary: Add Controls to Risk
      description: Adds control implementations to a risk
      tags:
      - Risk Relationships
      x-onetrust:
        spec-label: https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-it-risk-management.json
      parameters:
      - name: riskId
        in: path
        description: Unique identifier of the risk
        required: true
        schema:
          type: string
          format: uuid
        example: 123e4567-e89b-12d3-a456-426614174000
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TechRiskCompliance-Risk_RiskControlImplementationsRequest'
      responses:
        '201':
          description: Controls added successfully
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '429':
          description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)."
          headers:
            Retry-After:
              schema:
                description: The number of seconds after which requests will be allowed again.
                format: int32
            ot-period:
              schema:
                description: The unit of time for which the rate limit applies
                enum:
                - HOUR
                - MINUTE
            ot-ratelimit-event-id:
              schema:
                description: The unique identifier for the rate-limiting event.
                format: uuid
            ot-request-made:
              schema:
                description: The number of requests made within the specified period.
                format: int32
            ot-requests-allowed:
              schema:
                description: The number of requests allowed within the specified period.
                format: int32
        '500':
          description: Internal Server Error
      security:
      - TechRiskCompliance-Risk_OAUTH2:
        - INTEGRATION
        - RISK
  /api/risk/v2/risks/{riskId}/threats:
    post:
      operationId: addThreatToRisk
      summary: Add Threat to Risk
      description: 'Use this API to add or replace a threat on a risk.

        > 🗒 Things to Know

        >

        > - If a threat was previously assigned to the risk, that threat will be replaced with the new specified threat after calling this API.'
      tags:
      - Risk Relationships
      x-onetrust:
        spec-label: https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-it-risk-management.json
      parameters:
      - name: riskId
        in: path
        description: Unique identifier of the risk
        required: true
        schema:
          type: string
          format: uuid
        example: 123e4567-e89b-12d3-a456-426614174000
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TechRiskCompliance-Risk_RiskThreatAddRequest'
      responses:
        '201':
          description: Threat added or replaced successfully
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '429':
          description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)."
          headers:
            Retry-After:
              schema:
                description: The number of seconds after which requests will be allowed again.
                format: int32
            ot-period:
              schema:
                description: The unit of time for which the rate limit applies
                enum:
                - HOUR
                - MINUTE
            ot-ratelimit-event-id:
              schema:
                description: The unique identifier for the rate-limiting event.
                format: uuid
            ot-request-made:
              schema:
                description: The number of requests made within the specified period.
                format: int32
            ot-requests-allowed:
              schema:
                description: The number of requests allowed within the specified period.
                format: int32
        '500':
          description: Internal Server Error
      security:
      - TechRiskCompliance-Risk_OAUTH2:
        - INTEGRATION
        - ITRM
  /api/risk/v2/risks/{riskId}/vulnerabilities:
    post:
      operationId: addVulnerabilitiesToRisk
      summary: Add Vulnerabilities to Risk
      description: 'Use this API to add or replace vulnerabilities on a risk.

        > 🗒 Things to Know

        >

        > - If vulnerabilities were previously assigned to the risk, those vulnerabilities will be replaced with the new specified vulnerabilities after calling this API.'
      tags:
      - Risk Relationships
      x-onetrust:
        spec-label: https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-it-risk-management.json
      parameters:
      - name: riskId
        in: path
        description: Unique identifier of the risk
        required: true
        schema:
          type: string
          format: uuid
        example: 123e4567-e89b-12d3-a456-426614174000
      requestBody:
        required: true
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/TechRiskCompliance-Risk_RiskVulnerabilityAddRequest'
      responses:
        '201':
          description: Vulnerabilities added or replaced successfully
        '400':
          description: Bad Request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '429':
          description: "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview)."
          headers:
            Retry-After:
              schema:
                description: The number of seconds after which requests will be allowed again.
                format: int32
            ot-period:
              schema:
                description: The unit of time for which the rate limit applies
                enum:
                - HOUR
                - MINUTE
            ot-ratelimit-event-id:
              schema:
                description: The unique identifier for the rate-limiting event.
                format: uuid
            ot-request-made:
              schema:
                description: The number of requests made within the specified period.
                format: int32
            ot-requests-allowed:
              schema:
                description: The number of requests allowed within the specified period.
                format: int32
        '500':
          description: Internal Server Error
      security:
      - TechRiskCompliance-Risk_OAUTH2:
        - INTEGRATION
        - ITRM
components:
  schemas:
    TechRiskCompliance-Risk_RiskThreatAddRequest:
      type: object
      properties:
        threatId:
          description: Unique identifier of the threat to be added. If null, any existing threat will be removed from the risk.
          type: string
          format: uuid
          example: 123e4567-e89b-12d3-a456-426614174000
    TechRiskCompliance-Risk_RiskControlImplementationsRequest:
      type: object
      properties:
        controlIds:
          type: array
          items:
            format: uuid
          uniqueItems: true
        status:
          description: Status of the control implementation. Can be Pending, Implemented, or NotDoing. Defaults to Pending if not specified
          type: string
          example: Pending
          default: Pending
          enum:
          - Pending
          - Implemented
          - NotDoing
      example:
        controlIds:
        - a8d2f0c6-63e5-476b-b600-79a447251a2a
        - b9e3f1d7-74f6-587c-c711-8ab558362b3b
        status: Pending
      required:
      - controlIds
    TechRiskCompliance-Risk_RiskVulnerabilityAddRequest:
      type: object
      properties:
        vulnerabilityIdList:
          description: List of unique identifiers of vulnerabilities to be added. If empty, all existing vulnerabilities will be removed from the risk.
          type: array
          items:
            type: string
            format: uuid
            description: List of unique identifiers of vulnerabilities to be added. If empty, all existing vulnerabilities will be removed from the risk.
          example:
          - 123e4567-e89b-12d3-a456-426614174000
          - 987fcdeb-51a2-43d7-9abc-123456789012
      required:
      - vulnerabilityIdList
  securitySchemes:
    TechRiskCompliance-ITRiskManagement_OAUTH2:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: https://{hostname}/api/access/v1/oauth/token
          scopes:
            CONTROL: Access to Control Implementation operations for external systems
            ITRM: Access to ITRM operations for external systems
    TechRiskCompliance-RiskTemplate_OAUTH2:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: https://{hostname}/api/access/v1/oauth/token
          scopes:
            INTEGRATION: Integration Scope
            RISK: Risk Scope
            RISK_READ: Risk read scope
    TechRiskCompliance-Risk_OAUTH2:
      type: oauth2
      flows:
        clientCredentials:
          tokenUrl: https://{hostname}/api/access/v1/oauth/token
          scopes:
            RISK: Risk Scope
            RISK_READ: Risk read scope
            INTEGRATION: Integration scope
x-readme:
  explorer-enabled: false
  proxy-enabled: false
  metrics-enabled: false
x-onetrust:
  spec-label: OpenAPI 3.1.0