Request payload containing filters, pagination and sorting options.

Minimum required payload :
{}

Since this is a POST search endpoint, an empty JSON object is accepted.

Filtering

Filters must be passed inside the filter object.

Supported fields include:

• search — case-insensitive contains search across risk name and risk code
• id, name (title remains a compatibility alias for name)
• status, status_id
• owner.id, owner.name, owner.email
• treatment
• department, department_id
• risk_category, risk_category_id
• inherent_impact, inherent_likelihood
• current_impact, current_likelihood
• target_impact, target_likelihood
• current_risk, current_risk_label
• tag
• program_name — program names (eq:ISO-27001:2022 or ISO-27001:2022); unknown name → 400

Each risk in the response includes objectives[] with program_name (direct and control-mediated mappings; indirect rows set indirect_mapping: true) and top-level programs[{id,name}].

Examples

"filter": {
  "search": "phishing",
  "status_id": "in:1,2",
  "department_id": "eq:3",
  "risk_category_id": "in:2,5",
  "current_impact": "eq:14",
  "treatment": "in:Avoid,Reduce",
  "tag": "in:Quarterly review,Security",
  "program_name": "eq:ISO-27001:2022"
}

Supported status values

Assessed, Assessment in progress, Closed, Needs Remediation, Not Assessed, Remediated

Supported treatment values

Avoid, Reduce, Transfer, Share, Accept

Supported operators

• eq — exact match
• in — comma-separated list

Example:

"status": "in:Not Assessed,Assessment in progress"

Pagination

• page_size default = 50
• page_size max = 200

Cursor Pagination

• cursor must be Base64 encoded.

Sorting

Allowed fields:

id, code, name, current_risk, owner.name, status, treatment, department, risk_category

Sorting rules:

• Ascending → name or +name
• Descending → -name