Sprinto

Marks an already-failing monitor as a special case Tags: monitor Payload schema (JSON Schema): {"type":"object","properties":{"monitorPk":{"type":"string","format":"uuid","description":"Primary key of the monitor to add an exception (special case) for. The monitor must already be failing."},"reason":{"type":"enum","values":["ADDITIONAL_TIME_NEEDED","EMPLOYEE_ON_LEAVE","EMPLOYEE_OWNED_DEVICE","NO_CUSTOMER_DATA","NO_DEVICE_ASSIGNED_TO_EMPLOYEE","NO_SENSITIVE_DATA","OLD_DEVICE","NON_PRODUCTION_SYSTEM","OTHER","EMPLOYEE_IS_CONTRACTOR_INTERN_PART_TIMER","EMPLOYEE_DOES_NOT_HAVE_ACCESS_TO_CUSTOMER_DATA","EMPLOYEE_DEVICE_REQUIRED_AN_OS_UPGRADE","EMPLOYEE_ACCOUNT_IS_ENABLED_THROUGH_AN_MDM_TOOL","EMPLOYEE_HAS_LEFT_THE_ORGANIZATION","EMPLOYEE_BACKGROUND_CHECK_IS_IN_PROGRESS","EMPLOYEE_REGION_DOES_NOT_SUPPORT_BACKGROUND_CHECKS","EMPLOYEE_HAS_A_GROUP_EMAIL_ID_OR_SERVICE_EMAIL_ID","EMPLOYEE_CURRENT_OS_IS_STILL_SUPPORTED","EMPLOYEE_DOES_NOT_HAVE_ACCESS_TO_PRODUCTION_SERVERS","EMPLOYEE_USES_MAC","EMPLOYEE_DOCUMENTATION_IS_DELAYED","EMPLOYEE_MFA_API_IS_UNAVAILABLE","EMPLOYEE_MFA_IS_ALREADY_ENABLED_THROUGH_SSO","CAS_TBAC_MIGRATION","ACCESS_VALIDATED_BY_TICKET","TOLERABLE_RISK","INACURATE_ALERT","UNUSED_CODE","PREAPPROVED_ON_EXTERNAL_INTEGRATION","PREAPPROVED_INTERNAL","BRANCH_PROTECTION_RULES_NOT_YET_APPLIED","EMERGENCY_FIX"],"description":"Exception reason code. The reason must be one allowed for the monitor type (monitorExceptionReasonsMap) OR be OTHER with non-empty additionalNotes; otherwise the handler returns userInput error key \"reason\" message \"InvalidExceptionReason\". Examples: ADDITIONAL_TIME_NEEDED, NO_CUSTOMER_DATA, EMPLOYEE_ON_LEAVE, NO_DEVICE_ASSIGNED_TO_EMPLOYEE, OTHER."},"customReason":{"type":"string","optional":true,"nullable":true,"description":"Optional free-text custom reason persisted for audit. Note: this is NOT used by the OTHER-reason validation (that checks additionalNotes), and the product UI does not send it."},"additionalNotes":{"type":"string","optional":true,"nullable":true,"description":"Required (non-empty) when reason is OTHER; for other reasons it is optional justification persisted on the exception."},"expiresOn":{"type":"string","format":"datetime","optional":true,"nullable":true,"description":"ISO 8601 datetime when the exception expires. Omit or null to make the exception valid forever (isValidForever is derived as expiresOn == null; isValidForever sent in input is ignored). A past expiry is tolerated (startDate is shifted just before it)."},"documentS3Key":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"S3 keys of supporting documents for the exception. Each key is checked for existence; if any key is invalid the handler returns userInput error key \"rawStateFiles\" message \"InvalidFile\"."}},"required":["monitorPk","reason"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Adds a mitigating note to a risk-to-asset mapping Tags: risk, risk-register, risk-management, mitigating-note, compliance Payload schema (JSON Schema): {"type":"object","properties":{"entityPk":{"type":"string","format":"uuid","description":"Primary key of the risk-to-asset mapping (OrgRiskItemToAsset) to annotate. Use query__listRisks or query__getMappedAssetsToRisk to find the mapping pk."},"entityModelName":{"type":"string","description":"Model name of the entity. Typically 'OrgRiskItemToAsset' when annotating a risk-to-asset mapping."},"orgRiskItemToAssetPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Explicit OrgRiskItemToAsset pk — can be provided instead of entityPk/entityModelName when already known."},"mitigationNoteText":{"type":"string","description":"Text of the mitigating note to add. Required, non-empty. Whitespace is trimmed."}},"required":["entityPk","entityModelName","mitigationNoteText"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Creates a new custom policy for the org Tags: policy, compliance, governance Payload schema (JSON Schema): {"type":"object","properties":{"policyName":{"type":"string","description":"Name of the policy to be created. Must be non-empty: when policyType is omitted it is derived from this name, and an empty name resolves to an empty policyType which the handler rejects with key=\"policyName\" messages=[\"PolicyTypeExists\"]."},"uploadedPolicyLink":{"type":"string","optional":true,"nullable":true,"description":"S3 key for the uploaded policy document"},"ownedByPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the user who owns this policy"},"ownedBySystemGroup":{"type":"enum","values":["INFOSEC_OFFICER","PRIVACY_OFFICER","PEOPLE_OPERATIONS","INFRA_OPERATIONS","SMT","COMPLIANCE_PROGRAM_MANAGER","EXCEPTION_ANALYST"],"optional":true,"nullable":true,"description":"System group that owns this policy. Valid values: \"INFOSEC_OFFICER\" (security/compliance policies), \"PRIVACY_OFFICER\" (privacy/data protection policies), \"PEOPLE_OPERATIONS\" (HR policies), \"INFRA_OPERATIONS\" (infrastructure policies), \"SMT\" (executive/governance policies), \"COMPLIANCE_PROGRAM_MANAGER\" (compliance program policies), \"EXCEPTION_ANALYST\" (exception policies). Either ownedByPk or ownedBySystemGroup MUST be provided — unlike the UI/GraphQL path, this action does NOT auto-default the owner, and omitting both fails with key=\"\" messages=[\"MissingOwner\"]."},"documentType":{"type":"enum","values":["POLICY","PROCEDURE","ISMS_DOCUMENT","ISMS_RECORD","CUSTOM_DOC","AIMS_DOCUMENT","QMS_DOCUMENT"],"description":"Type of document. Valid values: \"POLICY\" for policy documents, \"PROCEDURE\" for procedure documents, \"ISMS_DOCUMENT\" for ISMS documents, \"ISMS_RECORD\" for ISMS records, \"CUSTOM_DOC\" for custom documents, \"AIMS_DOCUMENT\" for AIMS documents."},"policyType":{"type":"enum","values":["AcceptableUsage","AccessControl","BreachNotification","DataBreachNotificationPolicy","BusinessContinuity","ChangeManagement","CoC","Confidentiality","DataBackup","DataClassification","DataDeletion","DataProtection","DisasterRecovery","Encryption","EndpointSecurity","HrSecurity","IncidentManagement","Infosec","MediaDisposal","Password","PhysicalSecurity","RiskManagement","VendorManagement","VulManagement","CardHolderDataManagement","NetworkSetup","CloudSecurityPolicy","PrivacyDesign","AssetManagement","Compliance","OperationSecurity","OrganizationOfInformationSecurity","SDLC","AccessControlProcedure","AssetManagementProcedure","ComplianceProcedure","HrSecurityProcedure","IncidentManagementProcedure","NetworkSecurityProcedure","PhysicalAndEnvironmentalSecurityProcedure","SdlcProcedure","OperationsSecurityProcedure","VendorManagementProcedure","BusinessContinuityPlanProcedure","PhiDataBreachNotificationProcedure","PersonalDataBreachNotificationProcedure","AISDLCPolicyAndProcedure","AIAcceptableUsagePolicy","AIDataManagementPolicyAndProcedure","AISystemImpactAssessmentPolicy","AISystemImpactAssessmentProcedure","AIMSCommunicationPlan","AISecurityPolicy","AuditLogManagementProcedure","ConfigurationManagementPolicy","ConfigurationManagementProcedure","ControlledMaintenancePolicy","QualityPolicy","ResourceManagementPolicy","IsmsScopeDocument","IsmsManual","IsmsInfosec","PciCharter","SystemDescription","AIRolesAndResponsibilities","AIMSManual","AIMSScopeDocument","AILifeCyclePhase","QMSManual","QMSScopeDocument"],"optional":true,"nullable":true,"description":"Type of policy from the predefined list (auto-generated from policy name for user-defined policies)"},"externalPolicyPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of external policy if linking to one"},"policyProviderPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of policy provider if using external provider"}},"required":["policyName","documentType"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Creates a policy exception and notifies the assigned analyst Tags: policy, exception, compliance, risk-acceptance Payload schema (JSON Schema): {"type":"object","properties":{"title":{"type":"string","description":"Title of the policy exception. Required, non-empty."},"description":{"type":"string","description":"Description explaining why an exception to the policy is needed. Required, non-empty."},"businessJustification":{"type":"string","optional":true,"nullable":true,"description":"Business justification for the exception. Explains the risk accepted or the compensating control."},"remidiationUserPk":{"type":"string","format":"uuid","description":"Primary key of the user responsible for remediating or owning the exception. Required. Use query__getActiveStaffPaginated to look up the user pk."},"reportedByPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the user reporting the exception. Defaults to the acting user. Only admins / InfoSec-role users may set this to another user (file on behalf of). Use query__getActiveStaffPaginated to look up the user pk."},"documentUploadS3Keys":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"Optional S3 keys for supporting documents uploaded with the exception. Each key must be a valid S3 key for a previously uploaded file. Omit if no supporting documents."},"entityCustomAttributeValues":{"type":"array","items":{"type":"object","properties":{"attributeDefinitionPk":{"type":"string","format":"uuid"},"value":{"type":"unknown"}},"required":["attributeDefinitionPk"]},"optional":true,"nullable":true,"description":"Optional custom attribute values for the exception entity."}},"required":["title","description","remidiationUserPk"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Creates an automated check that runs over a chosen entity model Tags: check, monitor Payload schema (JSON Schema): {"type":"object","properties":{"title":{"type":"string","description":"Title of the automated check. Required, non-empty (the underlying title column is non-null)."},"description":{"type":"string","optional":true,"nullable":true,"description":"Description of what the check verifies."},"fixInstruction":{"type":"string","optional":true,"nullable":true,"description":"Remediation guidance shown when the check fails."},"entityModelName":{"type":"string","description":"Sequelize model name of the entity the check runs over (e.g. \"Vendor\"). Required, non-empty."},"entityFilter":{"type":"record","valueType":{"type":"unknown"},"optional":true,"nullable":true,"description":"JSON filter to narrow the check to specific entities."},"ownedByPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the owning user. Provide this or ownedBySystemGroup."},"ownedBySystemGroup":{"type":"string","optional":true,"nullable":true,"description":"System group that owns the check (e.g. \"IT_ADMIN\"). Provide this or ownedByPk."},"evalRule":{"type":"record","valueType":{"type":"unknown"},"optional":true,"nullable":true,"description":"JSON rule defining the failure condition evaluated per entity."},"filterRule":{"type":"record","valueType":{"type":"unknown"},"optional":true,"nullable":true,"description":"JSON rule that pre-filters entities before evaluation."},"escalatedToSystemGroups":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"System groups the failing todo escalates to. Defaults to [] when omitted."},"escalationWindow":{"type":"object","properties":{"value":{"type":"number","description":"Numeric duration value. Required."},"valueType":{"type":"enum","values":["minutes","businessHours","businessDays","days","months","weeks"],"optional":true,"nullable":true,"description":"Time unit for the value (TimeUnit enum)."}},"required":["value"],"description":"Escalation window. When it (or dueWindow) differs from defaults, an org process config is ensured.","optional":true,"nullable":true},"dueWindow":{"type":"object","properties":{"value":{"type":"number","description":"Numeric duration value. Required."},"valueType":{"type":"enum","values":["minutes","businessHours","businessDays","days","months","weeks"],"optional":true,"nullable":true,"description":"Time unit for the value (TimeUnit enum)."}},"required":["value"],"description":"Due-date window. When it (or escalationWindow) differs from defaults, an org process config is ensured.","optional":true,"nullable":true},"subSchema":{"type":"string","optional":true,"nullable":true,"description":"Sub-schema name from the entity flat-list, stored for UI display."},"isUserCreated":{"type":"boolean","description":"Whether the check is user-created (true) vs internal (false). Required (NOT NULL on the model, controls the edit flow)."}},"required":["title","entityModelName","isUserCreated"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Creates a new custom staff role for the organization Tags: staff, people, org-structure Payload schema (JSON Schema): {"type":"object","properties":{"name":{"type":"string","description":"Name of the staff role to be created (e.g. \"Security Engineer\", \"DevOps Lead\"). Required and non-empty (GQL: name: String!, persisted to NOT NULL column). The unique role key is auto-derived from this name (whitespace stripped, lowercased), so the name must be unique within the org."},"jd":{"type":"string","description":"Job description for the staff role. Required and non-empty (GQL: jd: String!, persisted to NOT NULL column)."}},"required":["name","jd"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Assigns a user to a system group and may replace the current unique role holder Tags: people, staff, role, system-group, privacy-officer, infosec, gdpr Payload schema (JSON Schema): {"type":"object","properties":{"userPk":{"type":"string","format":"uuid","description":"Primary key of the user to assign. Must be an active user in the same organization. Use query__getUsersPaginated or query__getUsers to look up the user's pk. Returns UserNotFound error if the user does not belong to the org."},"systemGroupName":{"type":"enum","values":["ADMIN","SMT","BOARD_MEMBER","INFOSEC_OFFICER","PRIVACY_OFFICER","PEOPLE_OPERATIONS","INFRA_OPERATIONS","COMPLIANCE_PROGRAM_MANAGER","AUDITOR","STAFF","SPRINTO_SUPPORT","COLLABORATOR","INTERNAL_AUDITOR","EXCEPTION_ANALYST","VIEWER","TRUST_CENTER_ADMIN","SEC_QUE_ADMIN","SEC_QUE_CONSUMER","SEC_QUE_EDITOR","SERVICE_PROVIDER","VENDOR_CONTACT","VENDOR_BUSINESS_OWNER"],"description":"System group to assign the user to. Examples: PRIVACY_OFFICER, INFOSEC_OFFICER, SMT (Senior Management), ADMIN, LIMITED_ADMIN. PRIVACY_OFFICER and INFOSEC_OFFICER enforce a UniqueInOrg constraint — assigning a new holder automatically removes the previous one. SMT also enforces UniqueInOrg. Returns SystemGroupMemberAlreadyExists if the user is already in the group, or SystemGroupMemberNotAdded if the user is already in SMT or INFOSEC_OFFICER and the target group is also SMT or INFOSEC_OFFICER."}},"required":["userPk","systemGroupName"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Creates one or more vendors in the organization. Do not use riskLevel=CRITICAL unless Critical vendor risk is enabled for the organization. Tags: vendor, vendor-discovery Payload schema (JSON Schema): {"type":"object","properties":{"vendors":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Name of the vendor (non-empty). Duplicate active-vendor names are rejected unless skipDuplicateCheck is true."},"type":{"type":"enum","values":["THIRD_PARTY_VENDOR","INTERNAL_LEGAL_ORGANIZATION"],"description":"Type of vendor (e.g., THIRD_PARTY_VENDOR, INTERNAL_LEGAL_ORGANIZATION)"},"description":{"type":"string","optional":true,"nullable":true,"description":"Free-text description of the vendor"},"category":{"type":"enum","values":["Analytics","Artificial Intelligence","Collaboration & Productivity","Content Management Systems","Customer Service","Data Privacy","Design","Development software","Digital Advertising Tech","Finance","Hosting Providers","HRMS","IAM providers","IoT Management Platforms","IT infrastructure","IT Management","Marketing","Product management tools","Sales","Security Software","Training","Others","Collaboration","MDM","Ticketing Softwares","Web conferencing","HRMS Providers","Background Check Services","Vulnerability Scanning Providers","Workflow Automation","Version Control Systems","Identity Providers","Survey Tools","Cloud Providers","Datastore Providers","Infra Monitoring Providers"],"optional":true,"nullable":true,"description":"Category/industry classification of the vendor"},"websiteUrl":{"type":"string","description":"Vendor website URL (required, NOT NULL on Vendor table). Trailing slashes are normalised server-side."},"ownerPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"User assigned as the vendor owner; defaults to the requesting user"},"vendorAdminPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"User assigned as the vendor admin. If both vendorAdminPk and vendorAdminSystemGroup are null, a default admin is auto-assigned."},"vendorAdminSystemGroup":{"type":"enum","values":["ADMIN","SMT","BOARD_MEMBER","INFOSEC_OFFICER","PRIVACY_OFFICER","PEOPLE_OPERATIONS","INFRA_OPERATIONS","COMPLIANCE_PROGRAM_MANAGER","AUDITOR","STAFF","SPRINTO_SUPPORT","COLLABORATOR","INTERNAL_AUDITOR","EXCEPTION_ANALYST","VIEWER","TRUST_CENTER_ADMIN","SEC_QUE_ADMIN","SEC_QUE_CONSUMER","SEC_QUE_EDITOR","SERVICE_PROVIDER","VENDOR_CONTACT","VENDOR_BUSINESS_OWNER"],"optional":true,"nullable":true,"description":"System group assigned as the vendor admin (alternative to vendorAdminPk)"},"internalBusinessContactPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Internal business contact user identifier"},"internalBusinessContactSystemGroup":{"type":"enum","values":["ADMIN","SMT","BOARD_MEMBER","INFOSEC_OFFICER","PRIVACY_OFFICER","PEOPLE_OPERATIONS","INFRA_OPERATIONS","COMPLIANCE_PROGRAM_MANAGER","AUDITOR","STAFF","SPRINTO_SUPPORT","COLLABORATOR","INTERNAL_AUDITOR","EXCEPTION_ANALYST","VIEWER","TRUST_CENTER_ADMIN","SEC_QUE_ADMIN","SEC_QUE_CONSUMER","SEC_QUE_EDITOR","SERVICE_PROVIDER","VENDOR_CONTACT","VENDOR_BUSINESS_OWNER"],"optional":true,"nullable":true,"description":"System group assigned as the internal business contact"},"internalContacts":{"type":"array","items":{"type":"object","properties":{"pk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of an existing internal contact (omit when creating)"},"userPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Internal user assigned as the contact"},"systemGroup":{"type":"enum","values":["ADMIN","SMT","BOARD_MEMBER","INFOSEC_OFFICER","PRIVACY_OFFICER","PEOPLE_OPERATIONS","INFRA_OPERATIONS","COMPLIANCE_PROGRAM_MANAGER","AUDITOR","STAFF","SPRINTO_SUPPORT","COLLABORATOR","INTERNAL_AUDITOR","EXCEPTION_ANALYST","VIEWER","TRUST_CENTER_ADMIN","SEC_QUE_ADMIN","SEC_QUE_CONSUMER","SEC_QUE_EDITOR","SERVICE_PROVIDER","VENDOR_CONTACT","VENDOR_BUSINESS_OWNER"],"optional":true,"nullable":true,"description":"System group assigned as the internal contact"}},"required":[]},"optional":true… (truncated) Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Adds one or more documents to a vendor as a manual upload Tags: vendor, document Payload schema (JSON Schema): {"type":"object","properties":{"vendorPk":{"type":"string","format":"uuid","description":"Primary key of the vendor to which documents are being added"},"documents":{"type":"array","items":{"type":"object","properties":{"documentType":{"type":"string","description":"Type of the vendor document (free-text label, e.g., CONTRACT, SECURITY_POLICY, CERTIFICATION). NOT NULL on the model."},"documentName":{"type":"string","description":"Name of the document. NOT NULL on the model."},"fileS3Key":{"type":"string","optional":true,"nullable":true,"description":"S3 key for a single attached file. Mutually exclusive with fileS3Keys — if both are supplied, fileS3Keys wins."},"fileS3Keys":{"type":"array","items":{"type":"string"},"maxItems":5,"optional":true,"nullable":true,"description":"S3 keys for multi-file uploads (capped at 5). When supplied, the VendorDocument.fileS3Key column is left null and individual files are written to VendorDocumentFile child rows. Handler rejects with error key=\"TooManyFiles\" if the cap is exceeded."},"fileUrl":{"type":"string","optional":true,"nullable":true,"description":"External URL of the document (used when the document lives outside S3)"},"expiryDate":{"type":"string","optional":true,"nullable":true,"description":"Expiry date of the document (ISO 8601 datetime). Not stored on the VendorDocument row directly — when present, the handler upserts an EntityExpiry row tracking VendorDocument.pk + expiryDate."},"remarks":{"type":"string","optional":true,"nullable":true,"description":"Free-text remarks persisted on the VendorDocument.remarks column."}},"required":["documentType","documentName"]},"minItems":1,"description":"Array of vendor document data to create (at least one)"}},"required":["vendorPk","documents"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Registers vulnerability scanning providers for the organization Tags: vulnerability, security, scanning, infra, provider, pentest Payload schema (JSON Schema): {"type":"object","properties":{"vulnerabilityScanningProviders":{"type":"array","items":{"type":"object","properties":{"provider":{"type":"enum","values":["Dependabot","SLScan","Snyk","AWSINSPECTOR","RAPID_FORT","CODACY","TENABLE","SOCKET","DEEPSOURCE","INTRUDER","AWS_SECURITY_HUB","JIRA_VULN_PROVIDER","CROWDSTRIKE_SPOTLIGHT","MICROSOFT_DEFENDER_ENDPOINT","MICROSOFT_DEFENDER_VMS","CROWDSTRIKE_EDR","GITLAB_VULN_SCANNER","HALO_SECURITY","SENTINEL_ONE","SENTINEL_ONE_VMS","RAPID7_INSIGHTVM","CHECKMARX","AZURE_DEFENDER","WIZ_CLOUD","WIZ_CODE","GOOGLE_SECURITY_CENTER","SEMGREP","SONARCLOUD","SONARQUBE","QUALYS","AIKIDO"],"description":"The vulnerability scanning source. Examples: AWS_SECURITY_HUB, GOOGLE_SECURITY_CENTER, AZURE_DEFENDER, AWSINSPECTOR, SNYK, SLScan. Use query__listInfraProviders to see which infra providers are already connected."},"providerType":{"type":"enum","values":["INFRASTRUCTURE","CHANGE_MANAGEMENT","OTHERS"],"description":"Category of scanning provider. INFRASTRUCTURE = cloud/infra provider (requires infraProviderPk). CHANGE_MANAGEMENT = CI/CD pipeline scanner (requires changeManagementProviderPk). OTHERS = standalone scanners like Snyk."},"infraProviderPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the infra provider record. Required when providerType is INFRASTRUCTURE. Use query__listInfraProviders to find the pk."},"changeManagementProviderPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the change management provider. Required when providerType is CHANGE_MANAGEMENT. Use query__listInfraProviders to find the pk."}},"required":["provider","providerType"]},"minItems":1,"description":"One or more vulnerability scanning provider configurations to add. At least one entry required."}},"required":["vulnerabilityScanningProviders"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Approves a policy's draft, making it the active version Tags: policy, compliance, governance, approval, trust-center Payload schema (JSON Schema): {"type":"object","properties":{"policyPk":{"type":"string","format":"uuid","description":"Primary key of the policy to approve"},"draftPolicyLogPk":{"type":"string","format":"uuid","description":"Primary key of the draft policy log to approve"}},"required":["policyPk","draftPolicyLogPk"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Approves an organization risk item Tags: risk Payload schema (JSON Schema): {"type":"object","properties":{"orgRiskItemPk":{"type":"string","format":"uuid","description":"Unique identifier of the organization risk item to approve"},"riskApproverPks":{"type":"array","items":{"type":"string","format":"uuid"},"minItems":1,"description":"List of risk approver primary keys, we use the riskApprover.pk and not approverPk"}},"required":["orgRiskItemPk","riskApproverPks"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Archives an evidence request without permanently deleting it Tags: evidence-request, audit, compliance Payload schema (JSON Schema): {"type":"object","properties":{"orgEvidenceRequestPk":{"type":"string","format":"uuid","description":"Primary key of the evidence request to archive"}},"required":["orgEvidenceRequestPk"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Assigns policy acknowledgement requests to selected employees and can notify them Tags: people, policy Payload schema (JSON Schema): {"type":"object","properties":{"name":{"type":"string","description":"Name/label for the acknowledgment request."},"orgPolicyTypePks":{"type":"array","items":{"type":"string","format":"uuid"},"minItems":1,"description":"Policy type PKs the employees must acknowledge (at least one)."},"userPks":{"type":"array","items":{"type":"string","format":"uuid"},"minItems":1,"description":"Individual employee (user) PKs to assign the acknowledgment to (at least one)."},"sendPolicyAckNotification":{"type":"boolean","optional":true,"nullable":true,"description":"Whether to send acknowledgment notification emails (defaults to false)."}},"required":["name","orgPolicyTypePks","userPks"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Bulk-approves or revokes approval for security questionnaire questions Tags: security-questionnaire Payload schema (JSON Schema): {"type":"object","properties":{"questionMappings":{"type":"array","items":{"type":"object","properties":{"secQueQuestionPk":{"type":"string","format":"uuid","description":"UUID of the SecQueQuestion to approve or revoke approval for."},"autoRespQuestionPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"UUID of the associated auto-response question, used to build deep-link URLs in approval notifications."}},"required":["secQueQuestionPk"]},"minItems":1,"description":"Mappings of SecQueQuestion PKs to their optional auto-response question PKs. Must contain at least one entry with a valid secQueQuestionPk. If the derived secQueQuestionsPks list is empty, returns userInputErrors[].key=\"secQueQuestionsPks\", messages=[\"MissingSecQueQuestionsPks\"]."},"shouldApprove":{"type":"boolean","optional":true,"nullable":true,"description":"When true: approves questions by setting status to REVIEWED. Unanswered (UNANSWERED) questions are silently skipped. When false: revokes approval by setting status back to ANSWERED. Only questions currently in REVIEWED status are processed; all others are skipped. Approval notifications are sent to question owners only when shouldApprove is true."}},"required":["questionMappings"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Closes multiple open incidents in bulk Tags: incident Payload schema (JSON Schema): {"type":"object","properties":{"isAllSelected":{"type":"boolean","description":"When true, close ALL currently-open incidents for the org (optionally narrowed by `source`). When false, close only the open incidents whose pks are in incidentPksToClose."},"incidentPksToClose":{"type":"array","items":{"type":"string","format":"uuid"},"optional":true,"description":"UUID primary keys of incidents to close. Used when isAllSelected is false. Only pks that correspond to currently-OPEN incidents in the org are closed; pks that are already closed or do not exist are silently skipped. An empty or omitted array is a no-op when isAllSelected is false."},"closingNotes":{"type":"string","optional":true,"nullable":true,"description":"Optional closing notes (Incident.closingNotes, a nullable text column) applied to every incident closed by this action."},"source":{"type":"string","optional":true,"nullable":true,"description":"Optional single incident source to filter by (applied as Incident.source = source). Valid base values: \"GuardDuty\", \"StaffReported\", \"MicrosoftDefender\", \"GoogleSecurityCenter\", \"PagerDuty\", \"Jira\", \"OpsGenie\" (additional orchestra-provider sources may also exist). When omitted/null, incidents of all sources are eligible. NOTE: this is read regardless of isAllSelected, but only meaningfully changes behaviour when isAllSelected is true."}},"required":["isAllSelected"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Creates multiple evidence requests and notifies participants Tags: evidence-request, audit, compliance, bulk Payload schema (JSON Schema): {"type":"object","properties":{"orgEvidenceRequests":{"type":"array","items":{"type":"object","properties":{"title":{"type":"string","description":"Title of the evidence request"},"description":{"type":"string","optional":true,"nullable":true,"description":"Detailed description of what evidence is required"},"dueDate":{"type":"string","description":"ISO 8601 due date for evidence submission (required)"},"assigneePk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the user to assign"},"assigneeEmployeeGroupPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of an employee group to assign"},"reviewerPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the reviewer"}},"required":["title","dueDate"]},"minItems":1,"description":"List of evidence requests to create"}},"required":["orgEvidenceRequests"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Creates or updates multiple risk records inside a risk register Tags: risk, bulk Payload schema (JSON Schema): {"type":"object","properties":{"rows":{"type":"array","items":{"type":"object","properties":{"riskId":{"type":"string","description":"Unique identifier for the risk within the register (used for upsert matching)"},"name":{"type":"string","description":"Risk name"},"description":{"type":"string","optional":true,"nullable":true,"description":"Detailed description of the risk"},"categories":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"Risk category labels"},"treatment":{"type":"string","optional":true,"nullable":true,"description":"Treatment strategy (e.g., MITIGATE, ACCEPT, TRANSFER, AVOID)"},"treatmentNotes":{"type":"string","optional":true,"nullable":true,"description":"Notes on the treatment plan"},"evaluationNotes":{"type":"string","optional":true,"nullable":true,"description":"Notes from the risk evaluation"},"riskOwnerEmail":{"type":"string","optional":true,"nullable":true,"description":"Email of the staff member who owns this risk"},"riskOwnerSystemGroup":{"type":"string","optional":true,"nullable":true,"description":"System group identifier for the risk owner"},"sourceType":{"type":"string","optional":true,"nullable":true,"description":"Source classification of the risk"},"riskManagerEmails":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"Emails of risk managers for this risk"},"riskManagerSystemGroups":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"System group identifiers for risk managers"},"riskSource":{"type":"string","optional":true,"nullable":true,"description":"The origin source of the risk"},"applicableCIA":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"Applicable CIA triad components (CONFIDENTIALITY, INTEGRITY, AVAILABILITY)"},"exposedThreats":{"type":"string","optional":true,"nullable":true,"description":"Threats this risk exposes the org to"},"exposedVulnerabilities":{"type":"string","optional":true,"nullable":true,"description":"Vulnerabilities associated with this risk"},"monetaryValue":{"type":"string","optional":true,"nullable":true,"description":"Estimated monetary impact value"},"additionalInformation":{"type":"string","optional":true,"nullable":true,"description":"Any additional freeform information"},"entityCustomAttributeValues":{"type":"array","items":{"type":"object","properties":{"entityCustomAttributeDefinitionPk":{"type":"string","format":"uuid","description":"PK of the custom attribute definition"},"value":{"type":"unknown","description":"Value for the custom attribute"}},"required":["entityCustomAttributeDefinitionPk"]},"optional":true,"nullable":true,"description":"Custom attribute values for this risk"},"controlFrameworkValues":{"type":"array","items":{"type":"object","properties":{"framework":{"type":"string","description":"Framework identifier (e.g., SOC2, ISO27001)"},"criteria":{"type":"union","options":[{"type":"array","items":{"type":"string"}},{"type":"string"}],"description":"Framework criteria to map this risk to. May be an array or comma-separated string."}},"required":["framework","criteria"]},"optional":true,"nullable":true,"description":"Framework criteria this risk is mapped to"}},"required":["riskId","name"]},"minItems":1,"description":"Array of risk records to create or update. Matching within the register is done by riskId. Existing riskIds are updated; new ones create records."},"orgRiskRegisterPk":{"type":"string","format":"uuid","description":"PK of the risk register these risks belong to"}},"required":["rows","orgRiskRegisterPk"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Creates or updates multiple vendor records in a single dispatch. Do not use overallRiskLevel=CRITICAL unless Critical vendor risk is enabled for the organization. Tags: vendor, bulk Payload schema (JSON Schema): {"type":"object","properties":{"vendors":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Vendor name. Used to match an existing vendor (update) or create a new one."},"websiteUrl":{"type":"string","optional":true,"nullable":true,"description":"Vendor website URL"},"category":{"type":"string","optional":true,"nullable":true,"description":"Vendor category (e.g., CLOUD_SERVICES, SAAS)"},"description":{"type":"string","optional":true,"nullable":true,"description":"Short description of the vendor"},"overallRiskLevel":{"type":"enum","values":["CRITICAL","HIGH","MEDIUM","LOW","NA"],"optional":true,"nullable":true,"description":"Overall risk level. Use HIGH, MEDIUM, LOW, or NA. Use CRITICAL only when Critical vendor risk is enabled for the organization. Normalized to internal enum values before saving."},"vendorAdminEmail":{"type":"string","optional":true,"nullable":true,"description":"Email of the vendor's admin contact in Sprinto"},"vendorAdminSystemGroup":{"type":"string","optional":true,"nullable":true,"description":"System group identifier for the vendor admin"},"internalBusinessContactEmail":{"type":"string","optional":true,"nullable":true,"description":"Email of the internal business owner for this vendor"},"contactName":{"type":"string","optional":true,"nullable":true,"description":"Name of the primary vendor contact"},"contactEmail":{"type":"string","optional":true,"nullable":true,"description":"Email of the primary vendor contact"},"externalContactEmails":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"Additional external contact emails for this vendor"},"entityCustomAttributeValues":{"type":"array","items":{"type":"object","properties":{"entityCustomAttributeDefinitionPk":{"type":"string","format":"uuid","description":"PK of the custom attribute definition"},"value":{"type":"unknown","description":"Value for the custom attribute"}},"required":["entityCustomAttributeDefinitionPk"]},"optional":true,"nullable":true,"description":"Custom attribute values for this vendor"},"riskDimensions":{"type":"array","items":{"type":"object","properties":{"orgVendorRiskDimensionPk":{"type":"string","format":"uuid","description":"PK of the org-level risk dimension"},"values":{"type":"array","items":{"type":"string"},"description":"Selected values for this risk dimension"}},"required":["orgVendorRiskDimensionPk","values"]},"optional":true,"nullable":true,"description":"Risk dimension values scoped to this vendor"}},"required":["name"]},"description":"Array of vendor records to create or update. Matching is done by vendor name within the org. Existing vendors are updated; new names create new vendor records."}},"required":["vendors"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Atomically bulk-updates access control entity–user connections Tags: access-control, access-review Payload schema (JSON Schema): {"type":"object","properties":{"accessUserMappings":{"type":"array","items":{"type":"object","properties":{"accessControlEntityPk":{"type":"string","format":"uuid","description":"Primary key (UUID) of the AccessControlEntity record to update. Each pk must appear at most once in the batch — duplicate accessControlEntityPks are rejected upfront with DuplicateAccessUserMapping."},"decision":{"type":"enum","values":["ADD_AS_A_NEW_USER","NOT_A_USER","NO_CONNECTION","USER"],"description":"How to resolve this access user's connection to a Sprinto staff user. One of:\n- USER: link to an existing Sprinto user via connectedUserPk (requires connectedUserPk).\n- ADD_AS_A_NEW_USER: create a new Sprinto staff user from userToAdd, then link to them (requires userToAdd).\n- NOT_A_USER: mark the entry as a non-person/service account (sets notAUser=true, clears connection).\n- NO_CONNECTION: clear the connection without marking as non-user."},"connectedUserPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key (UUID) of the existing Sprinto User to link. REQUIRED when decision is USER; ignored otherwise."},"userToAdd":{"type":"object","properties":{"firstName":{"type":"string","description":"New user's first name. Must be non-empty (the underlying User.firstName column is NOT NULL)."},"lastName":{"type":"string","optional":true,"nullable":true,"description":"New user's last name"},"email":{"type":"string","format":"email","description":"New user's email address. Must be a valid email format. Must not match any active user already in the organisation — if it does, the action returns success:false with errors. When multiple mappings in the same batch share the same userToAdd.email, only one new user is created; the remaining mappings are rewritten to a USER decision pointing at that new user."},"employmentType":{"type":"enum","values":["EMPLOYEE","CONTRACTOR","NHI"],"optional":true,"nullable":true,"description":"Employment classification of the new user. One of: EMPLOYEE, CONTRACTOR, NHI. Optional — the handler defaults a missing/empty value to EMPLOYEE."},"employmentStartDate":{"type":"string","optional":true,"nullable":true,"description":"ISO date string for the new user's employment start date"},"employmentIsNew":{"type":"boolean","optional":true,"description":"Whether the user is brand new to the organisation (true) or is an existing person being formally added (false)"},"createdVia":{"type":"string","optional":true,"nullable":true,"description":"Source or channel through which this user record is being created (e.g., integration name)"}},"required":["firstName","email"],"optional":true,"nullable":true,"description":"Data for the new staff user to create and link. REQUIRED when decision is ADD_AS_A_NEW_USER; ignored otherwise."}},"required":["accessControlEntityPk","decision"]},"description":"List of per-entity connection mappings to apply in a single atomic batch. Each mapping specifies one AccessControlEntity and the decision to apply. An empty array is a no-op: returns success with empty results. The entire batch is all-or-nothing — any single failure rolls back all writes."}},"required":["accessUserMappings"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Updates evidence review status for multiple audit items Tags: audit, evidence-review, audit-item, bulk Payload schema (JSON Schema): {"type":"object","properties":{"auditItemPks":{"type":"array","items":{"type":"string","format":"uuid"},"minItems":1,"description":"List of audit item primary keys to update (at least one required)"},"evidenceReviewStatus":{"type":"enum","values":["COLLECTING_EVIDENCE","INTERNAL_REVIEW","READY_FOR_REVIEW","INFO_REQUESTED","ACCEPTED"],"description":"New evidence review status for all selected items. Values: COLLECTING_EVIDENCE, INTERNAL_REVIEW, READY_FOR_REVIEW, INFO_REQUESTED, ACCEPTED"},"evidenceReviewFindingType":{"type":"enum","values":["NO_FINDINGS","IMPROVEMENT_OPPORTUNITY","MAJOR_NONCONFORMITY","MINOR_NONCONFORMITY"],"optional":true,"nullable":true,"description":"Finding type. Values: NO_FINDINGS, IMPROVEMENT_OPPORTUNITY, MAJOR_NONCONFORMITY, MINOR_NONCONFORMITY"},"isAuditorView":{"type":"boolean","optional":true,"nullable":true,"description":"Pass true when the caller is acting as an auditor"}},"required":["auditItemPks","evidenceReviewStatus"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Bulk-reassigns the owner of one or more security questionnaire questions Tags: security-questionnaire Payload schema (JSON Schema): {"type":"object","properties":{"assigneePk":{"type":"string","format":"uuid","description":"Primary key of the user to assign as the new owner (ownedByPk) for all specified questions. Validation error key: \"assigneePk\", message: \"MissingAssigneePk\" when omitted."},"questionMappings":{"type":"array","items":{"type":"object","properties":{"secQueQuestionPk":{"type":"string","format":"uuid","description":"Primary key of the SecQueQuestion to reassign (UUID, NOT NULL)."},"autoRespQuestionPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the corresponding SecQueAutoRespQuestion, if any. Used for notification deep-link routing."}},"required":["secQueQuestionPk"]},"minItems":1,"description":"Non-empty list of question mappings. The handler extracts secQueQuestionPks from this array via _.compact(_.map(questionMappings, \"secQueQuestionPk\")). Validation error key: \"secQueQuestionsPks\", message: \"MissingSecQueQuestionsPks\" when the resulting array is empty."}},"required":["assigneePk","questionMappings"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Bulk-updates the reviewer of one or more security questionnaire questions Tags: security-questionnaire Payload schema (JSON Schema): {"type":"object","properties":{"reviewerPk":{"type":"string","format":"uuid","description":"UUID of the user to assign as reviewer for the selected questions. Required. If empty, returns userInputErrors[].key=\"reviewerPk\", messages=[\"MissingReviewerPk\"]."},"secQueQuestionsPks":{"type":"array","items":{"type":"string","format":"uuid"},"minItems":1,"description":"Array of SecQueQuestion PKs to update. Must contain at least one entry. If empty, returns userInputErrors[].key=\"secQueQuestionsPks\", messages=[\"MissingSecQueQuestionsPks\"]."},"notifyNewReviewer":{"type":"boolean","optional":true,"description":"When true, sends an email notification to the new reviewer. The notification is only sent if at least one of the updated questions is in PENDING_REVIEW status."}},"required":["reviewerPk","secQueQuestionsPks"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Updates multiple existing staff roles' name and/or job description (jd) for the requesting user's organization in one call. Each entry must reference an existing staffRolePk in this org. fieldsToUpdate declares which of those columns this call actually persists — pass ["jd"] for a description-only update (the common case) so name is left untouched in the database and the changelog, or ["name","jd"] when also renaming roles. Authorization is enforced by the conveyor (authorizeAction -> hasAdminAuthorisation): a non-admin user receives a ForbiddenError and success=false, and no roles are updated (SYSTEM_AUTOMATION service users bypass this check). Any entry whose staffRolePk does not resolve to a role in this org is skipped and reported with status="ROLE_NOT_FOUND" in data.results. Any entry whose new name's derived key collides with a different existing role — or with another entry in this same batch — is skipped and reported with status="DUPLICATE_ROLE", referencing the conflicting role; it does not fail the whole call. Every successfully applied update is reported with status="UPDATED". data.updatedStaffRoles holds only the roles actually updated in this call. Tags: staff, people, org-structure Payload schema (JSON Schema): {"type":"object","properties":{"roles":{"type":"array","items":{"type":"object","properties":{"staffRolePk":{"type":"string","format":"uuid","description":"Primary key of the staff role to update."},"name":{"type":"string","description":"Name of the staff role (e.g. \"Security Engineer\", \"DevOps Lead\"). If changed, the unique role key is re-derived from this name (whitespace stripped, lowercased) and must remain unique within the org and within this batch."},"jd":{"type":"string","description":"Job description for the staff role."}},"required":["staffRolePk","name","jd"]},"minItems":1,"description":"Staff role updates to apply in one batch."},"fieldsToUpdate":{"type":"array","items":{"type":"enum","values":["name","jd"]},"minItems":1,"description":"Which fields to actually persist for every role in this batch. Pass [\"jd\"] when only drafting/updating descriptions — every entry in `roles` must still supply its current `name` (used to validate no duplicate-key collision), but name will not be written to the database or appear in the changelog as changed. Pass [\"name\",\"jd\"] when also renaming roles."}},"required":["roles","fieldsToUpdate"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Closes (completes) a custom task Tags: vendor, risk, audit Payload schema (JSON Schema): {"type":"object","properties":{"closeCustomTaskDict":{"type":"object","properties":{"pk":{"type":"string","format":"uuid","description":"Primary key of the custom task to close"},"closureRemarks":{"type":"string","optional":true,"nullable":true,"description":"Remarks captured at task closure"},"closureAttachmentS3Keys":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"S3 keys for attachments captured at closure"},"closureMetadata":{"type":"object","properties":{"reviewStatus":{"type":"enum","values":["APPROVED","REJECTED"],"optional":true,"nullable":true,"description":"Review outcome (APPROVED or REJECTED). REJECTED drives a REUPLOAD_REQUESTED audit-task notification."},"skipRemarks":{"type":"string","optional":true,"nullable":true,"description":"Remarks captured when the upload step is skipped"},"skipUpload":{"type":"boolean","optional":true,"nullable":true,"description":"Whether the evidence upload step was skipped; treated like having attachments for notifications"}},"required":[],"optional":true,"nullable":true,"description":"Structured closure metadata (review status / skip flags)"}},"required":["pk"],"description":"Closure payload for the custom task"}},"required":["closeCustomTaskDict"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Closes a single incident for the org Tags: incident Payload schema (JSON Schema): {"type":"object","properties":{"incidentPk":{"type":"string","format":"uuid","description":"Primary key (UUID) of the incident to close. Must belong to the user's org and must NOT already be CLOSED, otherwise the action returns a userInput error with key 'incidentPk'."},"customerDataLossReported":{"type":"boolean","description":"Whether customer data loss was reported for this incident. Required. If true, informedToCustomers MUST also be true, otherwise closing fails with key \"informedToCustomers\" / message \"CanNotCloseWithOutInforming\"."},"informedToCustomers":{"type":"boolean","optional":true,"nullable":true,"description":"Whether customers were informed of the incident. Required (must be true) when customerDataLossReported is true; otherwise the action fails with the \"CanNotCloseWithOutInforming\" userInput error."},"closingNotes":{"type":"string","optional":true,"nullable":true,"description":"Notes documenting the incident closure, resolution, or lessons learned."},"affectedDataTypes":{"type":"array","items":{"type":"enum","values":["CUSTOMER_DATA","CONFIDENTIAL_CORPORATE_DATA","PII","PHI","CHD","OTHER"]},"optional":true,"nullable":true,"description":"Data types affected by the incident. Allowed values: CUSTOMER_DATA, CONFIDENTIAL_CORPORATE_DATA, PII, PHI, CHD, OTHER. NOTE: the GraphQL input accepts an array but the underlying DB column is a single-value ENUM, so pass at most one value."},"evidenceS3Keys":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"S3 keys of evidence files attached to the incident closure."}},"required":["incidentPk","customerDataLossReported"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Creates or updates a completed risk assessment snapshot Tags: risk, risk-assessment, risk-register, compliance, governance Payload schema (JSON Schema): {"type":"object","properties":{"riskAssessmentPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of an existing risk assessment to update. If provided, the assessment is updated in place rather than creating a new one. Omit to create a new risk assessment."},"riskAssessmentTitle":{"type":"string","description":"Title for the risk assessment. Required."},"riskAssessmentType":{"type":"enum","values":["ASSET_BASED","PROCESS_BASED"],"optional":true,"nullable":true,"description":"The assessment methodology. ASSET_BASED = risk scored per asset/system. PROCESS_BASED = risk scored per business process. Required when creating a register-based assessment (no riskProfileS3Key). Ignored when riskProfileS3Key is provided."},"riskProfileS3Key":{"type":"string","optional":true,"nullable":true,"description":"S3 key of a previously uploaded risk profile document to attach to the assessment. Optional."},"zonePk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the risk register zone to scope this assessment to. Use query__getOrgRiskCategories or the risk register query to find zone pks. Omit for the default zone."},"orgRiskRegisterPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the org risk register to associate this assessment with. Omit to use the default risk register. Use query__listRisks to find the orgRiskRegisterPk."}},"required":["riskAssessmentTitle"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Creates a new compliance audit for the organization Tags: audit, governance Payload schema (JSON Schema): {"type":"object","properties":{},"required":[],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Adds a file, generated document, or existing policy file to an audit Tags: audit, document, upload, compliance, soc2, iso27001 Payload schema (JSON Schema): {"type":"object","properties":{"auditPk":{"type":"string","format":"uuid","description":"Primary key of the audit to attach this document to. Use query__listAudits to find the pk."},"documentType":{"type":"enum","values":["SYSTEM_DESCRIPTION","CONTROL_MAPPING_SHEET","STATEMENT_OF_APPLICABILITY","OTHERS"],"description":"Type of audit document. Allowed values: SYSTEM_DESCRIPTION, CONTROL_MAPPING_SHEET, STATEMENT_OF_APPLICABILITY, OTHERS. SYSTEM_DESCRIPTION is typical for SOC 2 audits. CONTROL_MAPPING_SHEET documents control coverage. STATEMENT_OF_APPLICABILITY is used for ISO 27001."},"documentDescription":{"type":"string","optional":true,"nullable":true,"description":"Optional free-text description of the document."},"documentFileUrl":{"type":"string","format":"url","optional":true,"nullable":true,"description":"Public URL of the document file to upload. Public, directly-downloadable https URL of the file (may be a pre-authed/presigned link). Sprinto fetches and stores it; <=10MB; allowed types: .jpeg, .jpg, .png, .gif, .tiff, .bmp, .txt, .doc, .docx, .odt, .pdf, .zip, .csv, .xls, .xlsx, .msg, .json. Provide either documentFileUrl OR content (HTML string), not both. documentFileUrl takes precedence."},"content":{"type":"string","optional":true,"nullable":true,"description":"HTML content to convert to a DOCX document. Used when no documentFileUrl is provided. Converted to DOCX server-side and stored in S3. Mutually exclusive with documentFileUrl."},"policyFileS3Key":{"type":"string","optional":true,"nullable":true,"description":"S3 key of an existing policy file to use as the document source. Takes precedence over content when provided."}},"required":["auditPk","documentType"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Creates a single custom control Tags: control, compliance Payload schema (JSON Schema): {"type":"object","properties":{"number":{"type":"string","description":"Control number/identifier. Required by the GraphQL contract. Max 255 characters, else userInput error key=\"number\". If numeric and \"order\" is omitted, the number is parsed into the order column."},"statement":{"type":"string","description":"Control statement text. Required, persisted to a NOT NULL column."},"order":{"type":"number","optional":true,"nullable":true,"description":"Sort order. If omitted and number is numeric, order is derived from number."},"controlOwnerPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the user who owns the control"},"ownedBySystemGroup":{"type":"string","optional":true,"nullable":true,"description":"System group that owns the control (e.g. \"IT_ADMIN\")"},"domain":{"type":"enum","values":["ACCESS_CONTROL","CHANGE_MANAGEMENT","ASSET_MANAGEMENT","PERSONNEL_SECURITY","PHYSICAL_AND_ENVIRONMENTAL_PROTECTION","PRIVACY","RISK_ASSESSMENT","VULNERABILITY_AND_PATCH_MANAGEMENT","THIRD_PARTY_RISK_MANAGEMENT","CONTINGENCY_PLANNING","CAPACITY_AND_PERFORMANCE_PLANNING","CRYPTOGRAPHIC_PROTECTIONS","ENDPOINT_SECURITY","NETWORK_SECURITY","SECURE_ENGINEERING","COMPLIANCE_ASSESSMENT","SYSTEM_AND_SERVICES_ACQUISITION","INCIDENT_RESPONSE","MAINTENANCE","AWARENESS_AND_TRAINING","DATA_CLASSIFICATION_AND_MEDIA_PROTECTION","GOVERNANCE_AND_PROGRAM_MANAGEMENT","CONTINUOUS_MONITORING","SYSTEM_AND_INFORMATION_INTEGRITY","THREAT_MANAGEMENT","CLOUD_SECURITY","DATA_MANAGEMENT","CUSTOMER_MANAGEMENT","ARTIFICIAL_AND_AUTONOMOUS_SYSTEMS","EMBEDDED_AND_CONNECTED_SYSTEMS","ASSESSMENT_AUTHORIZATION_AND_MONITORING","OTHERS"],"optional":true,"nullable":true,"description":"Control domain. Defaults to OTHERS on the DB column when omitted."},"shortText":{"type":"string","optional":true,"nullable":true,"description":"Short name of the control. Max 255 characters, else userInput error key=\"shortText\"."},"entityCustomAttributeValues":{"type":"array","items":{"type":"object","properties":{"entityCustomAttributeDefinitionPk":{"type":"string","format":"uuid","description":"Primary key of the custom attribute definition"},"value":{"type":"unknown","optional":true,"nullable":true,"description":"Value for the custom attribute (JSON)"},"unit":{"type":"string","optional":true,"nullable":true,"description":"Optional unit for the custom attribute value"}},"required":["entityCustomAttributeDefinitionPk"]},"optional":true,"nullable":true,"description":"Custom field values. Only persisted when the org has the CONTROL_CUSTOM_FIELDS feature flag; otherwise silently ignored."}},"required":["number","statement"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Attaches a piece of evidence to a control Tags: evidence, control Payload schema (JSON Schema): {"type":"object","properties":{"controlPk":{"type":"string","format":"uuid","description":"Primary key (UUID) of the Control to attach evidence to. Must belong to the user's org. Resolve via search_sprinto."},"title":{"type":"string","description":"Human-readable title/name for this piece of evidence."},"evidenceDate":{"type":"string","description":"ISO-8601 date the evidence was collected/effective (e.g. \"2026-06-11\")."},"fileUrl":{"type":"string","format":"url","description":"Public, directly-downloadable https URL of the file (may be a pre-authed/presigned link). Sprinto fetches and stores it; <=10MB; allowed types: .jpeg, .jpg, .png, .gif, .tiff, .bmp, .txt, .doc, .docx, .xls, .xlsx, .csv, .pdf, .zip, .tar, .odt, .ods, .msg, .json."}},"required":["controlPk","title","evidenceDate","fileUrl"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Creates one or more critical access systems for login access control Tags: access-control, access-review Payload schema (JSON Schema): {"type":"object","properties":{"criticalAccessSystems":{"type":"array","items":{"type":"object","properties":{"provider":{"type":"string","description":"Provider identifier for the critical access system (e.g., GSUITE, AWS, OKTA, GITHUB, AZURE, GCP, MONGO_ATLAS, OFFICE365, BITBUCKET, GITLAB, SLACK, ZOHO, JENKINS, SALESFORCE, SPRINTO, etc.). Must be a valid autoCriticalAccessSystemType (DB column is NOT NULL — non-empty required). SPRINTO provider triggers special INTEGRATE_SPRINTO_AS_ACAS dispatch and has no vendor connection support."},"accessType":{"type":"enum","values":["WEB_CONSOLE_ACCESS","INSTANCE_ACCESS","API_ACCESS"],"description":"Type of access this critical system represents. WEB_CONSOLE_ACCESS: browser-based access to a web console. INSTANCE_ACCESS: direct access to compute instances (e.g., SSH, RDP). API_ACCESS: programmatic access via API keys or tokens."},"reviewType":{"type":"enum","values":["AUTO","MANUAL"],"description":"Determines the access review workflow AND which conveyor the handler runs. AUTO: vendor-integrated path — connects via vendor integration, auto-populates users, runs periodic access reviews. MANUAL: self-managed path (e.g., Jenkins, Notion) — users added manually, reviews are on-demand. The fields criticalSystemPk, criticalSystemModelName, vendorConnectionPk, and integrated are only used by the AUTO path; MANUAL silently ignores them."},"criticalSystemPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the actual system entity (e.g., IdentityProvider, InfraProvider, OAuthActiveConnection). AUTO-only — used to link the CAS to the underlying provider record. Silently ignored for MANUAL reviewType."},"criticalSystemModelName":{"type":"string","optional":true,"nullable":true,"description":"Sequelize model name of the critical system entity (e.g., GSuiteCustomer, OktaApp, EntraApp, IamApp, AwsUser, InfraProvider). AUTO-only — silently ignored for MANUAL. If the value is OktaApp, EntraApp, or IamApp, the system is treated as IAM-based, enabling Okta IAM flow dispatch and login protection monitors."},"integrated":{"type":"boolean","optional":true,"nullable":true,"description":"Whether to upsert access control entities for this system. AUTO-only — silently ignored for MANUAL. When true, triggers upsertAccessControlEntitiesForASystem with a maximum of 50 entities per system. When false or omitted, no entities are created during setup."},"vendorConnectionPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the VendorConnection record. AUTO-only — used to dispatch sync operations (determines whether flow-based or job-based entity refresh runs). Silently ignored for MANUAL. Not applicable for SPRINTO provider."},"isAuditScope":{"type":"boolean","optional":true,"nullable":true,"description":"Whether this system is in audit scope. Defaults to true in the database model if not provided. Set to false to explicitly exclude the system from audit scope."},"reviewFreqValue":{"type":"number","optional":true,"nullable":true},"reviewFreqUnit":{"type":"string","optional":true,"nullable":true}},"required":["provider","accessType","reviewType"]},"minItems":1,"description":"Array of critical access systems to create. Must contain at least one item — passing an empty array silently no-ops (handler reduces to empty AUTO/MANUAL groups and produces no records). Each item is routed to either the AUTO creation path (vendor-integrated with automatic sync and monitor evaluation) or the MANUAL creation path (self-managed with custom checks) based on its reviewType. Per-item errors are collected separately, so partial success is possible."},"saveAddCasPreferencesForFuture":{"type":"boolean","optional":true,"nullable":true,"description":"When true, after all systems are created successfully and the main transaction commits, persist add-details defaults from the first item in criticalAccessSystems (isAuditScope, reviewFreqValue, reviewFre… (truncated) Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Creates a new custom compliance framework for the org Tags: framework Payload schema (JSON Schema): {"type":"object","properties":{"name":{"type":"string","description":"Framework name. Required, non-empty after trimming (handler rejects with key=\"name\", messages=[\"Framework name cannot be empty\"])."},"description":{"type":"string","optional":true,"nullable":true,"description":"Free-text framework description. Optional."},"geolocation":{"type":"string","optional":true,"nullable":true,"description":"Region for the framework (e.g. \"Global\", \"EU\", \"UK\"). Optional. Column defaults to \"Global\" when omitted."},"category":{"type":"enum","values":["ALL","PRIVACY","SECURITY","QMS","CUSTOM"],"optional":true,"nullable":true,"description":"Framework category. One of ALL, PRIVACY, SECURITY, QMS, CUSTOM. Optional. Column defaults to CUSTOM when omitted."}},"required":["name"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Creates a new custom task for vendor and risk workflows Tags: vendor, risk Payload schema (JSON Schema): {"type":"object","properties":{"createCustomTaskDict":{"type":"object","properties":{"entityPk":{"type":"string","format":"uuid","description":"Primary key of the entity the custom task is associated with"},"entityModelName":{"type":"string","description":"Sequelize model name of the entity this task is associated with (e.g. \"OrgRiskItem\", \"Vendor\", \"ManagementReview\"). Required, non-empty."},"secondaryEntityPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of secondary entity if applicable"},"secondaryEntityModelName":{"type":"string","optional":true,"nullable":true,"description":"Model name of secondary entity if applicable"},"type":{"type":"enum","values":["ACCESS_REVIEW","ACCESS_REVIEW_CUSTOM_USER_ACCESS","ACCESS_REVIEW_REVOKE_USER_ACCESS","ACCESS_REVIEW_DOWNGRADE_USER_ACCESS","ACCESS_REVIEW_DONE_BY_MANAGER","ACCESS_USER_REVIEW_BY_DELEGATED_REVIEWER","ACCESS_REVIEW_APPROVAL","AUDIT_TASK","AUDIT_CONTROL_TASK","RISK_MITIGATION_TREATMENT_ACCEPT","RISK_MITIGATION_TREATMENT_TRANSFER","RISK_MITIGATION_TREATMENT_FURTHER_MITIGATE","RISK_MITIGATION_TREATMENT_AVOID","RISK_MITIGATION_TREATMENT_NOT_SELECTED","UPLOAD_EVIDENCE_REQUEST","REVIEW_EVIDENCE_REQUEST","VENDOR_TASK","POLICY_LOG_TASK","CONTROL_TASK","CONTROL_EFFECTIVENESS_SCORE_UPDATE","CONTROL_FINDING_TASK","CONTROL_TEST_FINDING_TASK","POLICY_APPROVAL","RISK_APPROVAL","VENDOR_REQUEST_APPROVAL","VENDOR_DD_APPROVAL","VENDOR_APPROVAL","WORKFLOW_CHECK_APPROVAL","RDP_VULNERABILITY","WORKFLOW_STEP_TASK","WORKFLOW_STEP_USER_TASK","OUTCOME_GATE"],"description":"Type of custom task (e.g., AUDIT_TASK, VENDOR_TASK, RISK_MITIGATION, etc.)"},"state":{"type":"enum","values":["DRAFT","ACTIVE","CLOSED"],"optional":true,"description":"State of the custom task (DRAFT, ACTIVE, CLOSED). Defaults to DRAFT if omitted."},"name":{"type":"string","description":"Name/title of the custom task. Required, non-empty (the underlying name column is non-null)."},"description":{"type":"string","optional":true,"nullable":true,"description":"Description of the custom task"},"dueDate":{"type":"string","description":"Due date for the task (ISO 8601 datetime string). Required."},"assignedToPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the user assigned to the task. Provide either this OR assignedSystemGroup — at least one is required (the handler rejects with \"Cannot create a custom task without assignee\" otherwise). When provided, the user is also runtime-validated to be an admin or collaborator."},"assignedSystemGroup":{"type":"string","optional":true,"nullable":true,"description":"System group to assign the task to (e.g. \"IT_ADMIN\"). Provide either this OR assignedToPk — at least one is required."},"attachmentS3Keys":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"S3 keys for attachments"},"contextMetadata":{"type":"record","valueType":{"type":"unknown"},"optional":true,"nullable":true,"description":"Context metadata for the task"},"zonePks":{"type":"array","items":{"type":"string","format":"uuid"},"optional":true,"nullable":true,"description":"Zone primary keys to assign this task to. If omitted, the handler auto-determines zones based on entity context (createdWithZonePks=undefined path)."},"findingPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the finding this task is linked to"},"customTaskAction":{"type":"enum","values":["ENSURE_ACCESS_USER_REVIEW","ENSURE_RISK_APPROVAL_STATUS"],"optional":true,"nullable":true,"description":"Optional action to execute after task creation (e.g., ENSURE_ACCESS_USER_REVIEW, ENSURE_RISK_APPROVAL_STATUS)"},"source":{"type":"enum","values":["MANUAL","AUTOMATED"],"optional":true,"nullable":true,"description":"Source of the task. Allowed values: MANUAL, AUTOMATED. Defaults to MANUAL on the DB column when omitted."},"taskSyncEnabled":{"type":"boolean","optional":true,"nullable":true,"d… (truncated) Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Creates a custom user-authored policy Tags: policy Payload schema (JSON Schema): {"type":"object","properties":{"orgPk":{"type":"string","format":"uuid","description":"Organization identifier the policy is created for."},"hasCustomMarkdown":{"type":"literal","value":true,"description":"Must be true for CREATE_EDITABLE_CUSTOM_POLICY. Selects the custom-markdown generation path that creates an editable custom policy."},"policyTypeKey":{"type":"string","optional":true,"nullable":true,"description":"Policy type key. For custom policies this mirrors customMarkdownPolicyData.policyName."},"includeInitialDraft":{"type":"boolean","optional":true,"nullable":true,"description":"Whether to create the initial draft PolicyLog from the provided markdown. The custom path always generates the initial draft."},"customMarkdownPolicyData":{"type":"object","properties":{"policyName":{"type":"string","description":"Display name of the custom policy. Used as both policyType and policyName on the created OrgPolicyType."},"customMarkdown":{"type":"string","description":"Markdown body of the initial policy draft. Validated against embedded iframe/script tags; returns errors[].messages=\"Invalid data format, malicious data detected\" if malicious content is detected."},"documentType":{"type":"string","description":"Document type for the custom policy. System values: POLICY, PROCEDURE, ISMS_DOCUMENT, ISMS_RECORD, CUSTOM_DOC, AIMS_DOCUMENT (or an org custom CUSTOM_DOC_* value). Validated via validateDocumentTypeForCustomPolicy; an invalid or conflicting value exits with userInputErrors."},"ownedByPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the user who owns the policy. Provide this OR ownedBySystemGroup."},"ownedBySystemGroup":{"type":"string","optional":true,"nullable":true,"description":"System group that owns the policy (e.g. \"INFOSEC_OFFICER\"). The GraphQL layer defaults this to INFOSEC_OFFICER when both owner fields are omitted."}},"required":["policyName","customMarkdown","documentType"],"description":"Custom policy content and ownership for the editable draft."}},"required":["orgPk","hasCustomMarkdown","customMarkdownPolicyData"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Creates or edits an automated Critical Access System (CAS) configuration Tags: access-control Payload schema (JSON Schema): {"type":"object","properties":{"autoCriticalAccessSystemPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of an existing AutoCriticalAccessSystem record to update. When provided, the handler runs in update mode and edits the existing system. When omitted or null, the handler runs in create mode and creates a new Critical Access System."},"provider":{"type":"string","optional":true,"nullable":true,"description":"Provider identifier for the critical access system (e.g., \"AWS\", \"GSUITE\", \"OKTA\", \"GITHUB\", \"SLACK\"). Must be a value from the autoCriticalAccessSystemTypes constant in accessControlConstant.js. REQUIRED (non-empty) when creating a new system — the underlying DB column is NOT NULL. In update mode, an empty or whitespace-only value is silently preserved (handler trims and only includes the field in the update if non-empty)."},"criticalSystemModelName":{"type":"string","optional":true,"nullable":true,"description":"Database model name of the entity that holds the integration connection details for this critical system (e.g., \"InfraProvider\" for AWS, \"OAuthActiveConnection\" for GSuite). Corresponds to accessControlEntityToModelMap in accessControlConstants.js."},"criticalSystemPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key (UUID) of the criticalSystemModelName record that represents the connected integration for this critical access system."},"accessControllerModelName":{"type":"string","optional":true,"nullable":true,"description":"Model name of the entity that acts as the access controller for this system (e.g., an AWS account or a GCP project). Used to scope access control entities."},"accessControllerPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the accessControllerModelName record that scopes access control for this critical system."},"allowAllStaffAccess":{"type":"boolean","description":"When true, all staff members are considered to have legitimate access to this critical system and allowedStaffRolePks is ignored (the underlying create flow forces allowedStaffRolePks=[] when allowAllStaffAccess !== false). When false, only staff whose roles are listed in allowedStaffRolePks are considered to have legitimate access. This field is required."},"allowedStaffRolePks":{"type":"array","items":{"type":"string","format":"uuid"},"optional":true,"nullable":true,"description":"List of StaffRole primary keys whose members are considered to have legitimate access to this critical system. Only meaningful when allowAllStaffAccess is false. All provided pks must belong to the same organisation as the requesting user — otherwise the action returns userInputErrors with key \"staffRolePks\" and message \"InvalidStaffRolePks\"."},"ticketingProviderPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the TicketingProvider to link as the Ticket-Based Access Control (TBAC) source for this critical system. Providing a value enables TBAC and marks the ticketing provider as a TBAC source (TicketingProvider.isTbacSource=true). Changing the ticketing provider from a previously set value removes the old provider as TBAC source (only if it is not still used by another CAS) and triggers a background refresh of the new provider via TICKETING_PROVIDER_REFRESH. Pass null to remove the TBAC configuration."},"isAccessViaRolesEnabled":{"type":"boolean","optional":true,"nullable":true,"description":"Whether role-based access control is enabled for this critical system. When true, access is determined by the roles assigned to staff members rather than individual user assignments."}},"required":["allowAllStaffAccess"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Creates or updates a critical access system and its access control configuration Tags: access-control, access-review Payload schema (JSON Schema): {"type":"object","properties":{"criticalAccessSystemPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of an existing critical access system to update. If empty or null, a new system is created (CREATE path). If provided, the existing system and its access control config are updated (UPDATE path)."},"provider":{"type":"enum","values":["OKTA","MICROSOFT_ENTRA_ID","AWS","AZURE","AZUREDEVOPS","GCP","MONGO_ATLAS","GSUITE","SLACK","GITHUB","GITLAB","OFFICE365","BITBUCKET","GITHUBAPP","ZOHO","AWSCODECOMMIT","JENKINS","FRESHDESK","DROPBOX","DOCUSIGN","CALENDLY","NOTION","ACTIVE_CAMPAIGN","COPPER","ZOHO_CRM","CLOSE","SALESFLARE","INSIGHTLY","ZOOM","PIPEDRIVE","INTERCOM","SALESFORCE","CLOUDFLARE","ADOBE_SIGN","FIREFLIES_AI","OUTREACH","SENDGRID","GOOGLE_ANALYTICS","KEAP","CONSTANT_CONTACT","BOX","AVOMA","WINGMAN","CONFLUENCE","ZOHO_ANALYTICS","ZENDESK_SELL","ACCELO","CAPSULE","MONEYBIRD","XERO","FREEAGENT","ORACLE_CLOUD","SPRINTO","HUBSPOT","SENTRY","TAILSCALE","BROWSERSTACK","JETBRAINS","GRAFANA_ACCESS","GORGIAS","BASECAMP","ZENDESK","MIRO","MONDAY","PANDADOC","TABLEAU","ZSCALER","BRITIVE","CYBERARK","FRESH_SERVICE","FIGMA","POSTMAN","CANVA","MICROSOFT_TEAMS","AIRTABLE","ZAPIER","DOCKERHUB","CODA","METABASE","CLICKUP_ACCESS","LINEAR_ACCESS","SHORTCUT_ACCESS","ASANA_ACCESS","JIRA_ACCESS","ZOHOVAULT","NEWRELIC_ACCESS","FRONT","OPENVPN","NETLIFY","SNYK_ACCESS","KEEPERSECURITY","LASTPASS","SHAREPOINT","SMARTSHEET","ZOHODESK","TYPEFORM","PAGERDUTY_ACCESS","FILESCOM","CISCOMERAKI","BAMBOOHR_ACCESS","HUMAANS_ACCESS","TEAMLEADER_ACCESS","ADOBE_ACCESS","YOUTRACK_ACCESS","POSTHOG_ACCESS","WEBEX_ACCESS","SNOWFLAKE_ACCESS","DATADOG_ACCESS","AZUREACTIVEDIRECTORY_ACCESS","HELPSCOUT_ACCESS","TRELLO_ACCESS","ONE_LOGIN","ZSCALER_ZIA_ACCESS","ZSCALER_ZPA_SCIM_ACCESS","TWINGATE_ACCESS","DATABRICKS_ACCESS","LUCID_ACCESS","QUICKBASE_FOR_PROJECT_MANAGEMENT_ACCESS","MICROSOFT_DYNAMICS_365_SALES_ACCESS","ZOHO_PROJECTS_ACCESS","OPENAI_ACCESS","ORACLE_NETSUITE_ACCESS","AVIGILON_ALTA_ACCESS","DUO_ACCESS","MANAGEENGINE_SERVICEDESK_PLUS_ACCESS","SUPABASE_ACCESS","SISENSE_ACCESS","LAUNCHDARKLY_ACCESS","JAMF_ACCESS","REDIS_ACCESS","COCKROACHDB_CLOUD_ACCESS","ADYEN_ACCESS","CROWDSTRIKE_ACCESS","ORACLE_FUSION_CLOUD_ACCESS","LEARNWORLDS_ACCESS","TENABLE_ACCESS","SUMO_LOGIC_ACCESS","SAILPOINT_IDENTITYIQ_SCIM_ACCESS","LOANPRO_ACCESS","CATO_NETWORKS_ACCESS","JUNIPER_MIST_ACCESS","KANDJI_ACCESS","AUTH0_ACCESS","CONCORD_ACCESS","WORKATO_ACCESS","MPARTICLE_ACCESS","META_MARKETING_API_ACCESS","AMPLITUDE_SCIM_ACCESS","DRUVA_INSYNC_ACCESS","WORDPRESS_ACCESS","EXABEAM_ACCESS","ARENA_ACCESS","ATOMICWORK_ACCESS","NAVAN_ACCESS","ENVOY_ACCESS","ONEPASSWORD_ACCESS","ARGO_CD_ACCESS","ZIP_ACCESS","SNIPE_IT_ACCESS"],"description":"Provider identifier for the critical access system. Must be a valid autoCriticalAccessSystemType (e.g., GSUITE, AWS, OKTA, GITHUB, AZURE, GCP, OFFICE365, BITBUCKET, GITLAB, SLACK, ZOHO, JENKINS, SALESFORCE, etc.)."},"accessType":{"type":"enum","values":["WEB_CONSOLE_ACCESS","INSTANCE_ACCESS","API_ACCESS"],"description":"Type of access this critical system represents. WEB_CONSOLE_ACCESS: browser-based access to a web console. INSTANCE_ACCESS: direct access to compute instances (e.g., SSH, RDP). API_ACCESS: programmatic access via API keys or tokens."},"reviewType":{"type":"enum","values":["AUTO","MANUAL"],"description":"Determines the access review workflow. AUTO: vendor-integrated with automatic user sync. MANUAL: self-managed system with manual user management. **On the CREATE path (criticalAccessSystemPk empty/null), the underlying module asserts reviewType === MANUAL — the schema enforces this up front so an AUTO value on create is rejected before the handler throws AssertionError.**"},"allowAllStaffAccess":{"type":"boolean","optional":true,"nullable":true,"description":"When true, all staff members have access to this system and allowedStaffRolePks is reset to an empty array. When false, access is restricted to… (truncated) Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Creates, updates, or removes Manual CAS user entries Tags: access-control Payload schema (JSON Schema): {"type":"object","properties":{"mcasUsers":{"type":"array","items":{"type":"object","properties":{"identifier":{"type":"string","description":"Provider-side identifier for this user within the critical access system (e.g. the user's email address or username in the integrated tool). Used together with criticalAccessSystemPk as the upsert key (DB-level unique index on (criticalAccessSystemPk, identifier)). Must be a non-empty string."},"criticalAccessSystemPk":{"type":"string","format":"uuid","description":"Primary key of the AutoCriticalAccessSystem (CAS) this user entry belongs to. Required for every entry."},"connectedUserPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the Sprinto User to link to this MCAS entry. Takes precedence over connectedUserEmail if both are provided."},"connectedUserEmail":{"type":"string","optional":true,"nullable":true,"description":"Email address of the Sprinto User to look up and link to this MCAS entry. The handler resolves the email to a connectedUserPk via a database lookup (case-insensitive). Ignored if connectedUserPk is already set."},"isActive":{"type":"boolean","optional":true,"nullable":true,"description":"Whether this MCAS user entry should be active. Set to false to deactivate (remove) the user; when false, deactivationDate is required. Omit or set to true to keep or restore the entry as active."},"deactivationDate":{"type":"string","optional":true,"nullable":true,"description":"ISO date/datetime string indicating when the user was deactivated. Required (non-empty) when isActive is false — omitting it causes a deactivationDateInvalid validation error."},"accessLevels":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"List of access level labels (e.g. role names or permission labels) granted to this user within the critical access system. On create, omitting defaults to []; on update, omitting leaves the existing value untouched."},"notes":{"type":"string","optional":true,"nullable":true,"description":"Free-text notes associated with the user entry. Typically used when deactivating/removing a user to record the reason (e.g., \"Offboarded employee\", \"Role changed\"). Persisted only when explicitly present in the payload — omit the field entirely to preserve existing notes; sending an explicit null will overwrite (clear) existing notes."},"attachmentS3Keys":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"S3 object keys for attachments related to this user entry (e.g., revocation evidence, offboarding proof). Typically used when deactivating a user to attach supporting documentation. Persisted only when explicitly present in the payload — omit the field entirely to preserve existing attachments; sending an explicit null will overwrite (clear) existing attachments."}},"required":["identifier","criticalAccessSystemPk"]},"description":"List of MCAS user entries to create or update. Each entry is matched by (identifier, criticalAccessSystemPk) to determine whether to create or update. Email-based connectedUserPk resolution is batched across all entries."},"suppressDuplicateErrors":{"type":"boolean","description":"When false, the handler validates that no entry with the same (identifier, criticalAccessSystemPk) already exists in active state — returning a userExists error for duplicates. When true, duplicates are silently handled via upsert without returning errors. Set to true when bulk-importing users where duplicates are expected."},"mcasUserListAck":{"type":"object","properties":{"criticalAccessSystemPk":{"type":"string","format":"uuid","description":"Primary key of the AutoCriticalAccessSystem whose user list is being acknowledged. The handler saves the current timestamp on the CAS record (mcasUserListAckAt) if the requesting user is the system owner or an Infosec Officer. This re-evaluates the CAS_USERS_UPTO_DATE monitor."}},"required":["criticalAccessSystem… (truncated) Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Creates or updates the change-management configuration for a repository Tags: repo Payload schema (JSON Schema): {"type":"object","properties":{"repoPk":{"type":"string","format":"uuid","description":"Primary key of the repository to configure. Must belong to the caller's org (else userInput error key=repoPk messages=[InvalidRepoPk])."},"ciBranches":{"type":"array","items":{"type":"string"},"minItems":1,"description":"Branch names to set as CI branches for this repo (e.g., main, develop). The handler syncs RepoBranch rows of type \"ci\" to exactly this list — branches present become CI, existing CI branches absent from the list are unset. Must be non-empty (an empty list fails with userInput error key=ciBranches messages=[InvalidBranchList])."},"prExceptionUserListPks":{"type":"array","items":{"type":"string","format":"uuid"},"optional":true,"nullable":true,"description":"Primary keys of users excepted from PR requirements. Persisted onto every CI RepoBranch row created/updated by this action (not onto the repoConfig)."},"changeManagementSource":{"type":"enum","values":["PROTECTED_BRANCHES","TICKETING_SYSTEM"],"optional":true,"nullable":true,"description":"Source for change management persisted on the repoConfig: PROTECTED_BRANCHES (branch protection rules) or TICKETING_SYSTEM (linked ticketing). Not validated/required by the handler."},"changeManagementTicketingSystemPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the ticketing system config when changeManagementSource is TICKETING_SYSTEM."}},"required":["repoPk","ciBranches"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

Defines a new custom field for one or more entity types Tags: custom-field, entity-custom-attribute Payload schema (JSON Schema): {"type":"object","properties":{"name":{"type":"string","description":"Display name of the custom field. Required."},"type":{"type":"enum","values":["SHORT_TEXT","LONG_TEXT","DATE","SINGLE_SELECT","MULTI_SELECT","USER_OR_ROLE","MULTI_USER_OR_ROLE","NUMBER","PERCENTAGE","FORMULA","ATTACHMENT"],"description":"Field type (e.g. SHORT_TEXT, NUMBER, DATE, SINGLE_SELECT, MULTI_SELECT, USER_OR_ROLE, FORMULA). Required."},"scopes":{"type":"array","items":{"type":"enum","values":["Vendor","CustomCheck","OrgRiskItem","OrgManualEvidence","User","OrgCustomAsset","TrustProfileSectionItem","TrustProfileView","OrgPolicyType","DataRightsRequest","Audit","Control","PolicyException","OrgEntityAssessmentTemplate","CustomRawState","FrameworkPrinciple","Finding","SecQue","SecQueQuestion","SecQueKbDocStore","OrgEvidenceRequirement","OrgEvidenceRequest","VendorRequest","AiSystemRequest","AiSystem","AccessRegister","ImpactAssessmentRun","ImpactAssessment"]},"minItems":1,"description":"Entity types the field applies to (e.g. Control, FrameworkPrinciple, Vendor). Required, at least one."},"description":{"type":"string","optional":true,"nullable":true,"description":"Optional description."},"helperText":{"type":"string","optional":true,"nullable":true,"description":"Optional helper text shown in the UI."},"options":{"type":"array","items":{"type":"object","properties":{"value":{"type":"string"},"description":{"type":"string","optional":true,"nullable":true}},"required":["value"]},"optional":true,"nullable":true,"description":"Choices for SINGLE_SELECT / MULTI_SELECT types."},"formula":{"type":"string","optional":true,"nullable":true,"description":"Formula expression. Required when type is FORMULA."},"withUnits":{"type":"boolean","optional":true,"nullable":true,"description":"For NUMBER fields, whether values carry a unit."}},"required":["name","type","scopes"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.