GET: Get RRP Setting

Erin Conry

https://api.bitsighttech.com/ratings/v1/companies/company_guid/risk-remediation-plan/settings/settings_guid

Retrieve full detail for a custom RRP setting, including its excluded findings and exclusion reason. A setting is accessible if it is shared (is_shared: true) or the requesting user is the creator. Returns 404 for settings that exist but are not accessible — the same response as not found.

Example Request

curl https://api.bitsighttech.com/ratings/v1/companies/a940bb61-33c4-42c9-9231-c8194c305db3/risk-remediation-plan/settings/3fa85f64-5717-4562-b3fc-2c963f66afa6 \
  -u api_token:

Example Response

{
  "guid": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "risk_vector": "web_appsec",
  "name": "Exclude legacy hosts",
  "description": "Exclude hosts scheduled for decommission",
  "exclusion_reason": "Host decommission in progress",
  "excluded_findings": ["f04XjmWh4Vfc4ghT18Dfxg=="],
  "is_shared": true,
  "user_guid": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "created_at": "2026-04-15T20:35:13.775Z"
}

Response Attributes

Field	Description
guid String [`uuid`]	Unique identifier for this setting.
risk_vector String	Risk vector slug this setting applies to.
name String	Display name of this setting.
description String or Null	Optional description of this setting.
exclusion_reason String or Null	Reason the specified findings were excluded from plans using this setting.
excluded_findings Array	List of `rolledup_observation_id` values excluded from plans using this setting.
is_shared Boolean	Whether this setting is visible to all users in the company.
user_guid String [`uuid`]	GUID of the user who created this setting.
created_at String [datetime]	ISO 8601 timestamp of when this setting was created.

Status Codes

200 – Okay: Everything worked as expected.
401 – Unauthorized: No valid API token was provided.
403 – Permission Denied: You do not have permission to access this resource.
404 – Not Found: The specified setting does not exist or is not accessible to the requesting user.
422 – Unprocessable Entity: A path parameter value is invalid.