POST: Create RRP Setting

Erin Conry

https://api.bitsighttech.com/ratings/v1/companies/company_guid/risk-remediation-plan/settings

Create a custom RRP setting for a risk vector. A completed base plan must already exist for the company and vector before a custom setting can be created. Custom settings allow you to exclude specific findings and apply filters to tailor the plan to your remediation priorities.

Request Body

Field	Description
risk_vector String — Required	Risk vector slug this setting applies to.
name String — Required	Display name for this setting. Maximum 50 characters. Must be unique per user per risk vector.
description String — Optional	Optional description of this setting. Maximum 500 characters.
excluded_findings Array — Optional	List of `rolledup_observation_id` values to exclude from the plan. Each finding must exist in the current base plan for this vector.
exclusion_reason String — Optional	Reason for excluding the specified findings. Maximum 500 characters.
is_shared Boolean — Optional	When `true`, this setting is visible to all users in the company. Default: `false`.

Example Request

curl -X POST https://api.bitsighttech.com/ratings/v1/companies/a940bb61-33c4-42c9-9231-c8194c305db3/risk-remediation-plan/settings \
  -u api_token: \
  -H "Content-Type: application/json" \
  -d '{
    "risk_vector": "web_appsec",
    "name": "Exclude legacy hosts",
    "description": "Exclude hosts scheduled for decommission",
    "excluded_findings": ["f04XjmWh4Vfc4ghT18Dfxg=="],
    "exclusion_reason": "Host decommission in progress",
    "is_shared": true
  }'

Example Response

{
  "guid": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "risk_vector": "web_appsec",
  "name": "Exclude legacy hosts",
  "description": "Exclude hosts scheduled for decommission",
  "exclusion_reason": "Host decommission in progress",
  "excluded_findings": ["f04XjmWh4Vfc4ghT18Dfxg=="],
  "is_shared": true,
  "user_guid": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "created_at": "2026-04-15T20:35:13.775Z"
}

Response Attributes

Field	Description
guid String [`uuid`]	Unique identifier for this setting. Use when creating a plan run or updating selections.
risk_vector String	Risk vector slug this setting applies to.
name String	Display name of this setting.
description String or Null	Optional description of this setting.
exclusion_reason String or Null	Reason the specified findings were excluded.
excluded_findings Array	List of `rolledup_observation_id` values excluded from plans using this setting.
is_shared Boolean	Whether this setting is visible to all users in the company.
user_guid String [`uuid`]	GUID of the user who created this setting.
created_at String [datetime]	ISO 8601 timestamp of when this setting was created.

Status Codes

201 – Created: The setting was successfully created.
401 – Unauthorized: No valid API token was provided.
403 – Permission Denied: You do not have permission to access this resource.
422 – Unprocessable Entity: A required field is missing, a value is invalid, or no base plan exists yet for this company and risk vector.