GET: Get Risk Remediation Plan

Erin Conry

https://api.bitsighttech.com/ratings/v1/companies/company_guid/risk-remediation-plan/rrp_guid

Retrieve a completed Risk Remediation Plan by GUID. Use the Accept request header to choose the response format: application/json (default) or text/csv.

Example Request

# JSON response (default)
curl https://api.bitsighttech.com/ratings/v1/companies/a940bb61-33c4-42c9-9231-c8194c305db3/risk-remediation-plan/3fa85f64-5717-4562-b3fc-2c963f66afa6 \
  -u api_token:

# CSV download
curl https://api.bitsighttech.com/ratings/v1/companies/a940bb61-33c4-42c9-9231-c8194c305db3/risk-remediation-plan/3fa85f64-5717-4562-b3fc-2c963f66afa6 \
  -u api_token: \
  -H "Accept: text/csv"

Example Response

{
  "plan_type": "remediation_plan",
  "entity_id": 87051,
  "risk_vector": "web_appsec",
  "start_date": "2026-02-10",
  "end_date": "2026-04-10",
  "baseline_rating": 629.9,
  "final_rating": 794.2,
  "total_improvement": 164.3,
  "findings": 93,
  "items": [
    {
      "grade_improvement": "D (Fix to obtain C)",
      "current_rating": 629.9,
      "rating_improvement": 106.3,
      "cumulative_rating": 736.1,
      "order": 1,
      "item_type": "web_appsec",
      "rolledup_observation_id": "f04XjmWh4Vfc4ghT18Dfxg==",
      "evidence_key": "study.bu.edu:443",
      "first_seen": "2025-02-14",
      "last_seen": "2026-04-08",
      "tag_event_grade": "BAD",
      "assessment_name": "mixed_content",
      "total_evidence": 12,
      "failed_evidence": 12
    }
  ]
}

Response Attributes

Field	Description
plan_type String	Plan structure type. `remediation_plan` for all vectors except Critical Vulnerability Management, which uses a different top-level shape with no `plan_type` field.
entity_id Integer	Internal entity identifier for the company.
risk_vector String	Risk vector slug this plan covers.
start_date String [date]	Start of the observation window used to build this plan.
end_date String [date]	End of the observation window used to build this plan.
baseline_rating Number	Company's headline rating at the time this plan was built.
final_rating Number	Projected headline rating if every finding in this plan is remediated.
total_improvement Number	Total projected rating improvement if every finding is remediated.
findings Integer	Number of active grade-impacting findings included in this plan.
items[].grade_improvement String	Letter grade improvement achieved by fixing this finding (e.g. `D (Fix to obtain C)`).
items[].current_rating Number	Company's cumulative headline rating immediately before fixing this finding.
items[].rating_improvement Number	Rating points gained by fixing this individual finding.
items[].cumulative_rating Number	Projected cumulative headline rating after fixing this finding.
items[].order Integer	Remediation priority order. Fix order 1 first for maximum rating improvement.
items[].rolledup_observation_id String	Unique identifier for this finding. Use to reference the finding in custom plan settings.
items[].evidence_key String	The host, endpoint, or asset where this finding was observed.
items[].first_seen String [date]	Date this finding was first observed.
items[].last_seen String [date]	Date this finding was most recently observed.
items[].tag_event_grade String	Current grade of this finding: `GOOD`, `FAIR`, `WARN`, or `BAD`.

Status Codes

200 – Okay: Everything worked as expected.
204 – No Content: The company or plan GUID was not found.
401 – Unauthorized: No valid API token was provided.
403 – Permission Denied: You do not have permission to access this resource.
422 – Unprocessable Entity: A path parameter value is invalid.