Risk Remediation Plan API Endpoint – Bitsight Knowledge Base

https://api.bitsighttech.com/ratings/v1/companies/company_guid/risk-remediation-plan

The Risk Remediation Plan endpoint generates and manages prioritized remediation plans for a company's risk vectors, identifying the most impactful findings to fix in order to improve grades toward an A.

Paths

GET: List Risk Remediation Plans

List all risk remediation plan runs for a company using offset pagination. Optional query parameters: risk_vector (filter by vector slug), settings_guid (filter by custom setting), base_plans_only (exclude custom plan runs), limit, and offset.

Path: GET /v1/companies/company_guid/risk-remediation-plan/

POST: Create Risk Remediation Plan

Create a new risk remediation plan run for a given risk vector. Omit settings_guid to create a base plan. Include settings_guid to create a custom plan; if no base plan exists for today, one is queued automatically first. Returns 200 if an up-to-date plan already exists (cached), or 202 if a new job was queued.

Path: POST /v1/companies/company_guid/risk-remediation-plan/

GET: Get Risk Remediation Plan

Retrieve a completed risk remediation plan by GUID. Use the Accept header for format: application/json (default) returns the full plan document; text/csv returns a downloadable CSV. CSV columns vary by risk vector — Critical Vulnerability Management includes vulnerability severity and 1-, 30-, 60-, and 91-day status fields.

Path: GET /v1/companies/company_guid/risk-remediation-plan/rrp_guid

POST: Generate Forecast Timelines

Generate grade projection timelines for one or more risk vectors based on a remediation scenario. Each vector in the request body specifies a due date, remediation strategy, and findings or grade targets. Returns projected grade state at future effective dates per vector.

Path: POST /v1/companies/company_guid/risk-remediation-plan/forecast-timelines

GET: Get Plan Selections

Returns the requesting user's selected plan setting and latest completed run for each supported risk vector. A null entry means no base plan exists yet for that vector. settings is null when the base plan is selected.

Path: GET /v1/companies/company_guid/risk-remediation-plan/selections

PUT: Update Plan Selection

Set or clear the requesting user's default plan selection for a risk vector. Provide settings_guid to select a custom setting, or omit it to revert to the base plan.

Path: PUT /v1/companies/company_guid/risk-remediation-plan/selections

GET: List RRP Settings

List accessible custom RRP settings for the company, grouped by risk vector. Returns shared settings and the requesting user's own private settings, newest first within each vector.

Path: GET /v1/companies/company_guid/risk-remediation-plan/settings

POST: Create RRP Setting

Create a custom RRP setting for a risk vector. A completed base plan must already exist for the company and vector. Settings can specify excluded findings, an exclusion reason, and whether the setting is shared with other users in the company.

Path: POST /v1/companies/company_guid/risk-remediation-plan/settings

GET: Get RRP Setting

Retrieve full detail for a custom RRP setting, including excluded findings and exclusion reason. Accessible only if the setting is shared or the requesting user is the creator; returns 404 otherwise.

Path: GET /v1/companies/company_guid/risk-remediation-plan/settings/settings_guid

PUT: Update RRP Setting

Update a custom RRP setting. Only the creator may update. Updatable fields: name, description, exclusion_reason, excluded_findings, is_shared.

Path: PUT /v1/companies/company_guid/risk-remediation-plan/settings/settings_guid

DELETE: Delete RRP Setting

Delete a custom RRP setting. Only the creator may delete. Returns 204 on success.

Path: DELETE /v1/companies/company_guid/risk-remediation-plan/settings/settings_guid