PUT: Update RRP Setting

Erin Conry

https://api.bitsighttech.com/ratings/v1/companies/company_guid/risk-remediation-plan/settings/settings_guid

Update a custom RRP setting. Only the creator of the setting may update it. All provided fields replace their current values; omit a field to leave it unchanged.

Request Body

Field	Description
name String — Optional	Updated display name. Maximum 50 characters.
description String or Null — Optional	Updated description. Maximum 500 characters. Set to `null` to clear.
excluded_findings Array — Optional	Updated list of `rolledup_observation_id` values to exclude. Replaces the existing list entirely.
exclusion_reason String or Null — Optional	Updated reason for the exclusions. Maximum 500 characters. Set to `null` to clear.
is_shared Boolean — Optional	Updated sharing preference. Set to `true` to make the setting visible to all company users, or `false` to make it private.

Example Request

curl -X PUT https://api.bitsighttech.com/ratings/v1/companies/a940bb61-33c4-42c9-9231-c8194c305db3/risk-remediation-plan/settings/3fa85f64-5717-4562-b3fc-2c963f66afa6 \
  -u api_token: \
  -H "Content-Type: application/json" \
  -d '{"name": "Exclude legacy hosts v2", "is_shared": false}'

Example Response

{
  "guid": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "risk_vector": "web_appsec",
  "name": "Exclude legacy hosts v2",
  "description": "Exclude hosts scheduled for decommission",
  "exclusion_reason": "Host decommission in progress",
  "excluded_findings": ["f04XjmWh4Vfc4ghT18Dfxg=="],
  "is_shared": false,
  "user_guid": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
  "created_at": "2026-04-15T20:35:13.775Z"
}

Response Attributes

Field	Description
guid String [`uuid`]	Unique identifier for this setting.
risk_vector String	Risk vector slug this setting applies to. Cannot be changed after creation.
name String	Display name of this setting.
description String or Null	Optional description of this setting.
exclusion_reason String or Null	Reason the specified findings were excluded.
excluded_findings Array	List of `rolledup_observation_id` values excluded from plans using this setting.
is_shared Boolean	Whether this setting is visible to all users in the company.
user_guid String [`uuid`]	GUID of the user who created this setting.
created_at String [datetime]	ISO 8601 timestamp of when this setting was originally created.

Status Codes

200 – Okay: Everything worked as expected.
401 – Unauthorized: No valid API token was provided.
403 – Permission Denied: You do not have permission to access this resource.
404 – Not Found: The specified setting does not exist or is not accessible to the requesting user.
422 – Unprocessable Entity: A field value is invalid.