PUT: Update Plan Selection – Bitsight Knowledge Base

https://api.bitsighttech.com/ratings/v1/companies/company_guid/risk-remediation-plan/selections

Set or clear the requesting user's default plan selection for a risk vector. Provide settings_guid to activate a custom setting, or omit it to revert to the base plan. Changes only affect the requesting user's selection.

Request Body

Field Description

risk_vector

String — Required

Risk vector slug to update the selection for.

settings_guid

String [uuid] or Null — Optional

GUID of the custom setting to activate. Omit or set to null to revert to the base plan. The setting must exist and be accessible to the requesting user.

Example Request

curl -X PUT https://api.bitsighttech.com/ratings/v1/companies/a940bb61-33c4-42c9-9231-c8194c305db3/risk-remediation-plan/selections \
  -u api_token: \
  -H "Content-Type: application/json" \
  -d '{"risk_vector": "web_appsec", "settings_guid": "22c85f64-5717-4562-b3fc-2c963f66afa9"}'

Example Response

{
  "settings": {
    "guid": "22c85f64-5717-4562-b3fc-2c963f66afa9",
    "name": "Exclude critical CVEs",
    "is_shared": false,
    "user_guid": "3fa85f64-5717-4562-b3fc-2c963f66afa6"
  },
  "latest_run": {
    "rrp_guid": "3fa85f64-5717-4562-b3fc-2c963f66afa7",
    "created_at": "2026-04-15T20:35:13.775Z"
  }
}

Response Attributes

Field	Description
settings Object or Null	The custom setting now active for this vector. `null` if the selection was reverted to the base plan.
settings.guid String [`uuid`]	Unique identifier for the selected custom setting.
settings.name String	Display name of the selected custom setting.
settings.is_shared Boolean	Whether this setting is visible to all users in the company.
latest_run.rrp_guid String [`uuid`] or Null	GUID of the most recent completed plan run for this selection. Null if no run exists yet.
latest_run.created_at String [datetime] or Null	ISO 8601 timestamp of when the most recent completed plan run finished.

Status Codes

200 – Okay: Everything worked as expected.
401 – Unauthorized: No valid API token was provided.
403 – Permission Denied: You do not have permission to access this resource.
422 – Unprocessable Entity: A field value is invalid or the specified setting is not accessible.