POST: Create Risk Remediation Plan

Erin Conry

https://api.bitsighttech.com/ratings/v1/companies/company_guid/risk-remediation-plan/

Create a new Risk Remediation Plan run for a given risk vector. Returns 200 if a matching plan already exists for today (cached). Returns 202 if a new job was queued.

Request Body

Field Description

Field	Description
risk_vector String — Required	Risk vector slug to generate the plan for (e.g. `ssl_certificates`, `web_appsec`, `patching_cadence`).
settings_guid String [`uuid`] — Optional	GUID of a custom RRP setting to use. Omit to create a base plan. When provided, the service queues a base plan first if one does not exist for today, then queues the custom plan.

risk_vector

String — Required

Risk vector slug to generate the plan for (e.g. ssl_certificates, web_appsec, patching_cadence).

settings_guid

String [uuid] — Optional

GUID of a custom RRP setting to use. Omit to create a base plan. When provided, the service queues a base plan first if one does not exist for today, then queues the custom plan.

Example Request

curl -X POST https://api.bitsighttech.com/ratings/v1/companies/a940bb61-33c4-42c9-9231-c8194c305db3/risk-remediation-plan/ \
  -u api_token: \
  -H "Content-Type: application/json" \
  -d '{"risk_vector": "web_appsec"}'

Example Response

{
  "guid": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "risk_vector": "web_appsec",
  "requested_date": "2026-04-15T20:30:03.812Z",
  "created_date": null,
  "user_guid": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "company_guid": "a940bb61-33c4-42c9-9231-c8194c305db3",
  "scheduled": false,
  "job_guid": "7cb85f64-5717-4562-b3fc-2c963f66afa6",
  "location_bucket": null,
  "location_key": null,
  "status": "processing",
  "settings": null
}

Response Attributes

Field	Description
guid String [`uuid`]	Unique identifier for this plan run. Use to poll status or retrieve the completed plan via GET.
risk_vector String	Risk vector slug this plan was generated for.
requested_date String [datetime]	ISO 8601 timestamp of when this plan run was requested.
created_date String [datetime] or Null	ISO 8601 timestamp of when this plan completed. Null while still processing.
user_guid String [`uuid`]	GUID of the user who requested this plan.
company_guid String [`uuid`]	GUID of the company this plan belongs to.
scheduled Boolean	True if this plan was triggered automatically by the plan scheduler.
job_guid String [`uuid`] or Null	Background job identifier. Present while processing; null when completed or failed.
location_bucket String or Null	Storage bucket containing the completed plan file. Null until the plan completes.
location_key String or Null	Storage path to the completed plan file. Null until the plan completes.
status String	Current status: `completed`, `processing`, `failed`, or `pending`.
settings Object or Null	Summary of the custom setting used for this run. Null for base plans.

Status Codes

200 – Okay: A matching plan already exists for today and was returned without starting a new job.
202 – Accepted: A new plan run was created and queued for processing.
401 – Unauthorized: No valid API token was provided.
403 – Permission Denied: You do not have permission to access this resource.
422 – Unprocessable Entity: A required field is missing or a field value is invalid.