GET: List Risk Remediation Plans

Erin Conry

https://api.bitsighttech.com/ratings/v1/companies/company_guid/risk-remediation-plan/

List all Risk Remediation Plan runs for a company, returned as a paginated list ordered by most recent first.

Query Parameters

Parameter	Description
risk_vector String	Filter results to this risk vector slug (e.g. `ssl_certificates`, `web_appsec`). Optional.
settings_guid String [`uuid`]	Filter to runs linked to this custom setting GUID. Cannot be combined with `base_plans_only`. Optional.
base_plans_only Boolean	When `true`, return only base plan runs (no custom setting). Cannot be combined with `settings_guid`. Default: `false`. Optional.
limit Integer	Page size. Minimum 1; maximum determined by the upstream service. Default: 100. Optional.
offset Integer	Number of rows to skip into the result set. Default: 0. Optional.

Example Request

curl https://api.bitsighttech.com/ratings/v1/companies/a940bb61-33c4-42c9-9231-c8194c305db3/risk-remediation-plan/?risk_vector=web_appsec -u api_token:

Example Response

{
  "count": 2,
  "links": {
    "next": null,
    "previous": null
  },
  "results": [
    {
      "guid": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "risk_vector": "web_appsec",
      "requested_date": "2026-04-15T20:27:54.967Z",
      "created_date": "2026-04-15T20:32:10.000Z",
      "user_guid": "3fa85f64-5717-4562-b3fc-2c963f66afa6",
      "company_guid": "a940bb61-33c4-42c9-9231-c8194c305db3",
      "scheduled": false,
      "job_guid": null,
      "location_bucket": "bitsight-artifacts",
      "location_key": "companies/acme/web_appsec/plan.json",
      "status": "completed",
      "settings": null
    }
  ]
}

Response Attributes

Field	Description
count Integer	Total number of plan runs matching the query.
links.next String or Null	URL for the next page of results. Null if on the last page.
links.previous String or Null	URL for the previous page of results. Null if on the first page.
results[].guid String [`uuid`]	Unique identifier for this plan run. Use to retrieve the full plan via GET.
results[].risk_vector String	Risk vector slug this plan was generated for (e.g. `ssl_certificates`, `web_appsec`, `patching_cadence`).
results[].requested_date String [datetime]	ISO 8601 timestamp of when this plan run was requested.
results[].created_date String [datetime] or Null	ISO 8601 timestamp of when this plan run completed. Null if still processing.
results[].user_guid String [`uuid`]	GUID of the user who requested this plan.
results[].company_guid String [`uuid`]	GUID of the company this plan belongs to.
results[].scheduled Boolean	True if this plan was triggered automatically by the plan scheduler rather than by a user.
results[].job_guid String [`uuid`] or Null	Background job identifier. Present while the plan is processing; null when completed or failed.
results[].location_bucket String or Null	Storage bucket where the completed plan file is held. Null until the plan completes.
results[].location_key String or Null	Storage path to the completed plan file. Null until the plan completes.
results[].status String	Current status of this plan run: `completed`, `processing`, `failed`, or `pending`.
results[].settings Object or Null	Summary of the custom setting used for this run. Null for base plans. Includes `guid`, `name`, `is_shared`, and `user_guid`.

Status Codes

200 – Okay: Everything worked as expected.
401 – Unauthorized: No valid API token was provided.
403 – Permission Denied: You do not have permission to access this resource.
422 – Unprocessable Entity: A query parameter value is invalid (e.g. settings_guid and base_plans_only used together).