# OneTrust Tech Risk & Compliance — IT Risk Management **Canonical:** https://apis.io/apis/onetrust/tech-risk-and-compliance-it-risk-management/ **Provider:** OneTrust — https://apis.io/providers/onetrust/ **Base URL:** https://app.onetrust.com **Documentation:** https://developer.onetrust.com/onetrust/reference/control-implementations OneTrust Tech Risk & Compliance — IT Risk Management is one of 37 APIs that [OneTrust](https://apis.io/providers/onetrust/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. Tagged areas include Control Implementations, Control Links, Controls, Entity Types, and Evidence Task Implementations. The published artifact set on APIs.io includes an OpenAPI specification and API documentation. The IT Risk Management API provides comprehensive REST endpoints for managing enterprise security co ntrols, threats, vulnerabilities, and their implementations with OAuth2 security and extensive custo mization capabilities. (57 operations.) ## Operations (57) | Method | Path | Summary | |---|---|---| | POST | `/api/controls/v1/control-implementation-attributes/search` | Search Control Implementation Attributes | | POST | `/api/controls/v1/control-implementations/pages` | Get List of Control Implementations | | GET | `/api/controls/v1/control-implementations/{guid}` | Get Control Implementation | | PUT | `/api/controls/v1/control-implementations/{guid}` | Update Control Implementation | | DELETE | `/api/controls/v1/control-implementations/{guid}` | Delete Control Implementation | | POST | `/api/controls/v1/control-implementations/{guid}/attachments` | Attach Files to Control Implementation | | POST | `/api/controls/v1/controls` | Create Control | | POST | `/api/controls/v1/controls/pages` | Get List of Controls | | PUT | `/api/controls/v1/controls/{controlId}` | Update Control | | DELETE | `/api/controls/v1/controls/{controlId}` | Delete Control | | POST | `/api/controls/v1/entities/{entityId}/control-implementations/pages` | Get List of Control Implementations by Entity | | POST | `/api/controls/v1/evidence-task-implementations/pages` | Get List of Evidence Task Implementations | | GET | `/api/controls/v1/evidence-task-implementations/{evidenceTaskImplementationId}` | Get Evidence Task Implementation | | POST | `/api/controls/v1/evidence-task-implementations/{evidenceTaskImplementationId}/attachments` | Add Attachments to Evidence Task Implementation | | POST | `/api/controls/v1/links/bulk` | Link Controls | | POST | `/api/controls/v1/threats` | Create Threat | | POST | `/api/controls/v1/threats/pages` | Get List of Threats | | DELETE | `/api/controls/v1/threats/{threatId}` | Delete Threat | | POST | `/api/controls/v1/vulnerabilities` | Create Vulnerability | | POST | `/api/controls/v1/vulnerabilities/pages` | Get List of Vulnerabilities | | DELETE | `/api/controls/v1/vulnerabilities/{vulnerabilityId}` | Delete Vulnerability | | GET | `/api/controls/v2/control-entity-types` | Get List of Control Entity Source Types | | GET | `/api/controls/v2/related/control-entity-types` | Get Related Control Entity Types | | PUT | `/api/controls/v2/threats` | Update Threats | | POST | `/api/controls/v2/threats` | Create Multiple Threats | | PUT | `/api/controls/v2/vulnerabilities` | Update Vulnerabilities | | POST | `/api/controls/v2/vulnerabilities` | Create Multiple Vulnerabilities | | GET | `/api/risk-template/v1/templates/{riskTemplateId}` | Get Risk Template | | POST | `/api/risk/v2/entities/risks/unlink` | Unlink Risks | | GET | `/api/risk/v2/risk-categories` | Get List of Risk Categories | | GET | `/api/risk/v2/risk-settings/matrix` | Get Risk Matrix Configuration | | GET | `/api/risk/v2/risk-settings/standard` | Get Standard Risk Configuration | | POST | `/api/risk/v2/risks` | Create Risk | | POST | `/api/risk/v2/risks/pages` | Get List of Risks | | GET | `/api/risk/v2/risks/risk-entity-types` | Get List of Risk Entity Types | | GET | `/api/risk/v2/risks/source-entity-types` | Get List of Risk Entity Source Types | | PUT | `/api/risk/v2/risks/upsert` | Create or Update Risk | | POST | `/api/risk/v2/risks/{id}/assign-stage` | Update Risk Stage | | POST | `/api/risk/v2/risks/{riskEntityType}/{entityId}/risks` | Get List of Linked Risks | | GET | `/api/risk/v2/risks/{riskId}` | Get Risk | | PUT | `/api/risk/v2/risks/{riskId}` | Update Risk | | DELETE | `/api/risk/v2/risks/{riskId}` | Delete Risk | | PATCH | `/api/risk/v2/risks/{riskId}` | Modify Risk | | PUT | `/api/risk/v2/risks/{riskId}/actions/{action}` | Perform Risk Action | | PUT | `/api/risk/v2/risks/{riskId}/approve` | Approve Risk | | PUT | `/api/risk/v2/risks/{riskId}/approvers` | Update Risk Approvers | | PUT | `/api/risk/v2/risks/{riskId}/categories` | Update Risk Categories | | POST | `/api/risk/v2/risks/{riskId}/control-implementations` | Add Controls to Risk | | PUT | `/api/risk/v2/risks/{riskId}/grant-exception` | Grant Risk Exception | | PUT | `/api/risk/v2/risks/{riskId}/owners` | Update Risk Owners | | PUT | `/api/risk/v2/risks/{riskId}/reopen` | Reopen Risk | | PUT | `/api/risk/v2/risks/{riskId}/request-exception` | Request Risk Exception | | PUT | `/api/risk/v2/risks/{riskId}/send-back` | Send Back Risk | | PUT | `/api/risk/v2/risks/{riskId}/submit` | Submit Risk | | POST | `/api/risk/v2/risks/{riskId}/threats` | Add Threat to Risk | | POST | `/api/risk/v2/risks/{riskId}/vulnerabilities` | Add Vulnerabilities to Risk | | POST | `/api/risk/v3/risks` | Create Risk | ## Machine-readable artifacts (3) - **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/onetrust/refs/heads/main/openapi/onetrust-tech-risk-compliance-it-risk-management-openapi.json - **Documentation** — https://developer.onetrust.com/onetrust/reference/control-implementations - **Overlay** — https://raw.githubusercontent.com/api-evangelist/onetrust/refs/heads/main/overlays/onetrust-tech-risk-and-compliance-it-risk-management-overlay.yaml ## Other OneTrust APIs (12) - [OneTrust AI Governance — AI Governance](https://apis.io/apis/onetrust/ai-governance-ai-governance/) - [OneTrust Platform — Global Activity](https://apis.io/apis/onetrust/platform-global-activity/) - [OneTrust Consent & Preferences — Consent Interfaces](https://apis.io/apis/onetrust/consent-and-preferences-consent-interfaces/) - [OneTrust Consent & Preferences — Consent Management Platform (CMP)](https://apis.io/apis/onetrust/consent-and-preferences-consent-management-platform-cmp/) - [OneTrust Consent & Preferences — Consent Receipts](https://apis.io/apis/onetrust/consent-and-preferences-consent-receipts/) - [OneTrust Consent & Preferences — Cookie Consent](https://apis.io/apis/onetrust/consent-and-preferences-cookie-consent/) - [OneTrust Consent & Preferences — Cookie Consent (Swagger)](https://apis.io/apis/onetrust/consent-and-preferences-cookie-consent-swagger/) - [OneTrust Consent & Preferences — Cookie Domain Data](https://apis.io/apis/onetrust/consent-and-preferences-cookie-domain-data/) - [OneTrust Consent & Preferences — Cross-Device Consent](https://apis.io/apis/onetrust/consent-and-preferences-cross-device-consent/) - [OneTrust Consent & Preferences — Mobile App Consent](https://apis.io/apis/onetrust/consent-and-preferences-mobile-app-consent/) - [OneTrust Consent & Preferences — Policy & Notice Management](https://apis.io/apis/onetrust/consent-and-preferences-policy-and-notice-management/) - [OneTrust Consent & Preferences — Universal Consent & Preference Management (OAS)](https://apis.io/apis/onetrust/consent-and-preferences-universal-consent-and-preference-management-oas/) ## Tags Control Implementations, Control Links, Controls, Entity Types, Evidence Task Implementations, Risk Actions, Risk Management, Risk Relationships --- Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/onetrust/tech-risk-and-compliance-it-risk-management/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/onetrust/.