Sprinto

Attaches custom evidence files to a custom check monitor Tags: evidence, monitor, custom-check Payload schema (JSON Schema): {"type":"object","properties":{"monitorPk":{"type":"string","format":"uuid","description":"Primary key (UUID) of the monitor (check instance) to attach custom evidence to. Resolve via search_sprinto."},"fileUrls":{"type":"array","items":{"type":"string","format":"url"},"minItems":1,"maxItems":20,"description":"Public, directly-downloadable https URL of the file (may be a pre-authed/presigned link). Sprinto fetches and stores it; <=10MB; allowed types: .jpeg, .jpg, .png, .gif, .tiff, .bmp, .svg, .doc, .docx, .xls, .xlsx, .pdf, .zip, .tar, .odt, .ods, .mp4, .mov, .wmv, .json, .csv, .txt, .msg."},"expiresOn":{"type":"string","optional":true,"nullable":true,"description":"Optional ISO-8601 date when this evidence expires (e.g. \"2026-12-31\")."}},"required":["monitorPk","fileUrls"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_MONITOR_CUSTOM_EVIDENCE

Marks an already-failing monitor as a special case Tags: monitor Payload schema (JSON Schema): {"type":"object","properties":{"monitorPk":{"type":"string","format":"uuid","description":"Primary key of the monitor to add an exception (special case) for. The monitor must already be failing."},"reason":{"type":"enum","values":["ADDITIONAL_TIME_NEEDED","EMPLOYEE_ON_LEAVE","EMPLOYEE_OWNED_DEVICE","NO_CUSTOMER_DATA","NO_DEVICE_ASSIGNED_TO_EMPLOYEE","NO_SENSITIVE_DATA","OLD_DEVICE","NON_PRODUCTION_SYSTEM","OTHER","EMPLOYEE_IS_CONTRACTOR_INTERN_PART_TIMER","EMPLOYEE_DOES_NOT_HAVE_ACCESS_TO_CUSTOMER_DATA","EMPLOYEE_DEVICE_REQUIRED_AN_OS_UPGRADE","EMPLOYEE_ACCOUNT_IS_ENABLED_THROUGH_AN_MDM_TOOL","EMPLOYEE_HAS_LEFT_THE_ORGANIZATION","EMPLOYEE_BACKGROUND_CHECK_IS_IN_PROGRESS","EMPLOYEE_REGION_DOES_NOT_SUPPORT_BACKGROUND_CHECKS","EMPLOYEE_HAS_A_GROUP_EMAIL_ID_OR_SERVICE_EMAIL_ID","EMPLOYEE_CURRENT_OS_IS_STILL_SUPPORTED","EMPLOYEE_DOES_NOT_HAVE_ACCESS_TO_PRODUCTION_SERVERS","EMPLOYEE_USES_MAC","EMPLOYEE_DOCUMENTATION_IS_DELAYED","EMPLOYEE_MFA_API_IS_UNAVAILABLE","EMPLOYEE_MFA_IS_ALREADY_ENABLED_THROUGH_SSO","CAS_TBAC_MIGRATION","ACCESS_VALIDATED_BY_TICKET","TOLERABLE_RISK","INACURATE_ALERT","UNUSED_CODE","PREAPPROVED_ON_EXTERNAL_INTEGRATION","PREAPPROVED_INTERNAL","BRANCH_PROTECTION_RULES_NOT_YET_APPLIED","EMERGENCY_FIX"],"description":"Exception reason code. The reason must be one allowed for the monitor type (monitorExceptionReasonsMap) OR be OTHER with non-empty additionalNotes; otherwise the handler returns userInput error key \"reason\" message \"InvalidExceptionReason\". Examples: ADDITIONAL_TIME_NEEDED, NO_CUSTOMER_DATA, EMPLOYEE_ON_LEAVE, NO_DEVICE_ASSIGNED_TO_EMPLOYEE, OTHER."},"customReason":{"type":"string","optional":true,"nullable":true,"description":"Optional free-text custom reason persisted for audit. Note: this is NOT used by the OTHER-reason validation (that checks additionalNotes), and the product UI does not send it."},"additionalNotes":{"type":"string","optional":true,"nullable":true,"description":"Required (non-empty) when reason is OTHER; for other reasons it is optional justification persisted on the exception."},"expiresOn":{"type":"string","format":"datetime","optional":true,"nullable":true,"description":"ISO 8601 datetime when the exception expires. Omit or null to make the exception valid forever (isValidForever is derived as expiresOn == null; isValidForever sent in input is ignored). A past expiry is tolerated (startDate is shifted just before it)."},"documentS3Key":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"S3 keys of supporting documents for the exception. Each key is checked for existence; if any key is invalid the handler returns userInput error key \"rawStateFiles\" message \"InvalidFile\"."}},"required":["monitorPk","reason"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_MONITOR_EXCEPTION

Creates a new custom policy for the org Tags: policy, compliance, governance Payload schema (JSON Schema): {"type":"object","properties":{"policyName":{"type":"string","description":"Name of the policy to be created. Must be non-empty: when policyType is omitted it is derived from this name, and an empty name resolves to an empty policyType which the handler rejects with key=\"policyName\" messages=[\"PolicyTypeExists\"]."},"uploadedPolicyLink":{"type":"string","optional":true,"nullable":true,"description":"S3 key for the uploaded policy document"},"ownedByPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the user who owns this policy"},"ownedBySystemGroup":{"type":"enum","values":["INFOSEC_OFFICER","PRIVACY_OFFICER","PEOPLE_OPERATIONS","INFRA_OPERATIONS","SMT","COMPLIANCE_PROGRAM_MANAGER","EXCEPTION_ANALYST"],"optional":true,"nullable":true,"description":"System group that owns this policy. Valid values: \"INFOSEC_OFFICER\" (security/compliance policies), \"PRIVACY_OFFICER\" (privacy/data protection policies), \"PEOPLE_OPERATIONS\" (HR policies), \"INFRA_OPERATIONS\" (infrastructure policies), \"SMT\" (executive/governance policies), \"COMPLIANCE_PROGRAM_MANAGER\" (compliance program policies), \"EXCEPTION_ANALYST\" (exception policies). Either ownedByPk or ownedBySystemGroup MUST be provided — unlike the UI/GraphQL path, this action does NOT auto-default the owner, and omitting both fails with key=\"\" messages=[\"MissingOwner\"]."},"documentType":{"type":"enum","values":["POLICY","PROCEDURE","ISMS_DOCUMENT","ISMS_RECORD","CUSTOM_DOC","AIMS_DOCUMENT","QMS_DOCUMENT"],"description":"Type of document. Valid values: \"POLICY\" for policy documents, \"PROCEDURE\" for procedure documents, \"ISMS_DOCUMENT\" for ISMS documents, \"ISMS_RECORD\" for ISMS records, \"CUSTOM_DOC\" for custom documents, \"AIMS_DOCUMENT\" for AIMS documents."},"policyType":{"type":"enum","values":["AcceptableUsage","AccessControl","BreachNotification","DataBreachNotificationPolicy","BusinessContinuity","ChangeManagement","CoC","Confidentiality","DataBackup","DataClassification","DataDeletion","DataProtection","DisasterRecovery","Encryption","EndpointSecurity","HrSecurity","IncidentManagement","Infosec","MediaDisposal","Password","PhysicalSecurity","RiskManagement","VendorManagement","VulManagement","CardHolderDataManagement","NetworkSetup","CloudSecurityPolicy","PrivacyDesign","AssetManagement","Compliance","OperationSecurity","OrganizationOfInformationSecurity","SDLC","AccessControlProcedure","AssetManagementProcedure","ComplianceProcedure","HrSecurityProcedure","IncidentManagementProcedure","NetworkSecurityProcedure","PhysicalAndEnvironmentalSecurityProcedure","SdlcProcedure","OperationsSecurityProcedure","VendorManagementProcedure","BusinessContinuityPlanProcedure","PhiDataBreachNotificationProcedure","PersonalDataBreachNotificationProcedure","AISDLCPolicyAndProcedure","AIAcceptableUsagePolicy","AIDataManagementPolicyAndProcedure","AISystemImpactAssessmentPolicy","AISystemImpactAssessmentProcedure","AIMSCommunicationPlan","AISecurityPolicy","AuditLogManagementProcedure","ConfigurationManagementPolicy","ConfigurationManagementProcedure","ControlledMaintenancePolicy","QualityPolicy","ResourceManagementPolicy","IsmsScopeDocument","IsmsManual","IsmsInfosec","PciCharter","SystemDescription","AIRolesAndResponsibilities","AIMSManual","AIMSScopeDocument","AILifeCyclePhase","QMSManual","QMSScopeDocument"],"optional":true,"nullable":true,"description":"Type of policy from the predefined list (auto-generated from policy name for user-defined policies)"},"externalPolicyPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of external policy if linking to one"},"policyProviderPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of policy provider if using external provider"}},"required":["policyName","documentType"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_POLICY

Creates a policy exception and notifies the assigned analyst Tags: policy, exception, compliance, risk-acceptance Payload schema (JSON Schema): {"type":"object","properties":{"title":{"type":"string","description":"Title of the policy exception. Required, non-empty."},"description":{"type":"string","description":"Description explaining why an exception to the policy is needed. Required, non-empty."},"businessJustification":{"type":"string","optional":true,"nullable":true,"description":"Business justification for the exception. Explains the risk accepted or the compensating control."},"remidiationUserPk":{"type":"string","format":"uuid","description":"Primary key of the user responsible for remediating or owning the exception. Required. Use query__getActiveStaffPaginated to look up the user pk."},"reportedByPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the user reporting the exception. Defaults to the acting user. Only admins / InfoSec-role users may set this to another user (file on behalf of). Use query__getActiveStaffPaginated to look up the user pk."},"documentUploadS3Keys":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"Optional S3 keys for supporting documents uploaded with the exception. Each key must be a valid S3 key for a previously uploaded file. Omit if no supporting documents."},"entityCustomAttributeValues":{"type":"array","items":{"type":"object","properties":{"attributeDefinitionPk":{"type":"string","format":"uuid"},"value":{"type":"unknown"}},"required":["attributeDefinitionPk"]},"optional":true,"nullable":true,"description":"Optional custom attribute values for the exception entity."}},"required":["title","description","remidiationUserPk"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_POLICY_EXCEPTION

Creates an automated check that runs over a chosen entity model Tags: check, monitor Payload schema (JSON Schema): {"type":"object","properties":{"title":{"type":"string","description":"Title of the automated check. Required, non-empty (the underlying title column is non-null)."},"description":{"type":"string","optional":true,"nullable":true,"description":"Description of what the check verifies."},"fixInstruction":{"type":"string","optional":true,"nullable":true,"description":"Remediation guidance shown when the check fails."},"entityModelName":{"type":"string","description":"Sequelize model name of the entity the check runs over (e.g. \"Vendor\"). Required, non-empty."},"entityFilter":{"type":"record","valueType":{"type":"unknown"},"optional":true,"nullable":true,"description":"JSON filter to narrow the check to specific entities."},"ownedByPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the owning user. Provide this or ownedBySystemGroup."},"ownedBySystemGroup":{"type":"string","optional":true,"nullable":true,"description":"System group that owns the check (e.g. \"IT_ADMIN\"). Provide this or ownedByPk."},"evalRule":{"type":"record","valueType":{"type":"unknown"},"optional":true,"nullable":true,"description":"JSON rule defining the failure condition evaluated per entity."},"filterRule":{"type":"record","valueType":{"type":"unknown"},"optional":true,"nullable":true,"description":"JSON rule that pre-filters entities before evaluation."},"escalatedToSystemGroups":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"System groups the failing todo escalates to. Defaults to [] when omitted."},"escalationWindow":{"type":"object","properties":{"value":{"type":"number","description":"Numeric duration value. Required."},"valueType":{"type":"enum","values":["minutes","businessHours","businessDays","days","months","weeks"],"optional":true,"nullable":true,"description":"Time unit for the value (TimeUnit enum)."}},"required":["value"],"description":"Escalation window. When it (or dueWindow) differs from defaults, an org process config is ensured.","optional":true,"nullable":true},"dueWindow":{"type":"object","properties":{"value":{"type":"number","description":"Numeric duration value. Required."},"valueType":{"type":"enum","values":["minutes","businessHours","businessDays","days","months","weeks"],"optional":true,"nullable":true,"description":"Time unit for the value (TimeUnit enum)."}},"required":["value"],"description":"Due-date window. When it (or escalationWindow) differs from defaults, an org process config is ensured.","optional":true,"nullable":true},"subSchema":{"type":"string","optional":true,"nullable":true,"description":"Sub-schema name from the entity flat-list, stored for UI display."},"isUserCreated":{"type":"boolean","description":"Whether the check is user-created (true) vs internal (false). Required (NOT NULL on the model, controls the edit flow)."}},"required":["title","entityModelName","isUserCreated"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_PROGRAMMABLE_MONITOR

Adds a mitigating note to a risk-to-asset mapping Tags: risk, risk-register, risk-management, mitigating-note, compliance Payload schema (JSON Schema): {"type":"object","properties":{"entityPk":{"type":"string","format":"uuid","description":"Primary key of the risk-to-asset mapping (OrgRiskItemToAsset) to annotate. Use query__listRisks or query__getMappedAssetsToRisk to find the mapping pk."},"entityModelName":{"type":"string","description":"Model name of the entity. Typically 'OrgRiskItemToAsset' when annotating a risk-to-asset mapping."},"orgRiskItemToAssetPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Explicit OrgRiskItemToAsset pk — can be provided instead of entityPk/entityModelName when already known."},"mitigationNoteText":{"type":"string","description":"Text of the mitigating note to add. Required, non-empty. Whitespace is trimmed."}},"required":["entityPk","entityModelName","mitigationNoteText"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_ORG_RISK_MITIGATING_NOTE

Creates a new custom staff role for the organization Tags: staff, people, org-structure Payload schema (JSON Schema): {"type":"object","properties":{"name":{"type":"string","description":"Name of the staff role to be created (e.g. \"Security Engineer\", \"DevOps Lead\"). Required and non-empty (GQL: name: String!, persisted to NOT NULL column). The unique role key is auto-derived from this name (whitespace stripped, lowercased), so the name must be unique within the org."},"jd":{"type":"string","description":"Job description for the staff role. Required and non-empty (GQL: jd: String!, persisted to NOT NULL column)."}},"required":["name","jd"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_STAFF_ROLE

Adds one or more documents to a vendor as a manual upload Tags: vendor, document Payload schema (JSON Schema): {"type":"object","properties":{"vendorPk":{"type":"string","format":"uuid","description":"Primary key of the vendor to which documents are being added"},"documents":{"type":"array","items":{"type":"object","properties":{"documentType":{"type":"string","description":"Type of the vendor document (free-text label, e.g., CONTRACT, SECURITY_POLICY, CERTIFICATION). NOT NULL on the model."},"documentName":{"type":"string","description":"Name of the document. NOT NULL on the model."},"fileS3Key":{"type":"string","optional":true,"nullable":true,"description":"S3 key for a single attached file. Mutually exclusive with fileS3Keys — if both are supplied, fileS3Keys wins."},"fileS3Keys":{"type":"array","items":{"type":"string"},"maxItems":5,"optional":true,"nullable":true,"description":"S3 keys for multi-file uploads (capped at 5). When supplied, the VendorDocument.fileS3Key column is left null and individual files are written to VendorDocumentFile child rows. Handler rejects with error key=\"TooManyFiles\" if the cap is exceeded."},"fileUrl":{"type":"string","optional":true,"nullable":true,"description":"External URL of the document (used when the document lives outside S3)"},"expiryDate":{"type":"string","optional":true,"nullable":true,"description":"Expiry date of the document (ISO 8601 datetime). Not stored on the VendorDocument row directly — when present, the handler upserts an EntityExpiry row tracking VendorDocument.pk + expiryDate."},"remarks":{"type":"string","optional":true,"nullable":true,"description":"Free-text remarks persisted on the VendorDocument.remarks column."}},"required":["documentType","documentName"]},"minItems":1,"description":"Array of vendor document data to create (at least one)"}},"required":["vendorPk","documents"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_VENDOR_DOCUMENTS

Creates one or more vendors in the organization. Do not use riskLevel=CRITICAL unless Critical vendor risk is enabled for the organization. Tags: vendor, vendor-discovery Payload schema (JSON Schema): {"type":"object","properties":{"vendors":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Name of the vendor (non-empty). Duplicate active-vendor names are rejected unless skipDuplicateCheck is true."},"type":{"type":"enum","values":["THIRD_PARTY_VENDOR","INTERNAL_LEGAL_ORGANIZATION"],"description":"Type of vendor (e.g., THIRD_PARTY_VENDOR, INTERNAL_LEGAL_ORGANIZATION)"},"description":{"type":"string","optional":true,"nullable":true,"description":"Free-text description of the vendor"},"category":{"type":"enum","values":["Analytics","Artificial Intelligence","Collaboration & Productivity","Content Management Systems","Customer Service","Data Privacy","Design","Development software","Digital Advertising Tech","Finance","Hosting Providers","HRMS","IAM providers","IoT Management Platforms","IT infrastructure","IT Management","Marketing","Product management tools","Sales","Security Software","Training","Others","Collaboration","MDM","Ticketing Softwares","Web conferencing","HRMS Providers","Background Check Services","Vulnerability Scanning Providers","Workflow Automation","Version Control Systems","Identity Providers","Survey Tools","Cloud Providers","Datastore Providers","Infra Monitoring Providers"],"optional":true,"nullable":true,"description":"Category/industry classification of the vendor"},"websiteUrl":{"type":"string","description":"Vendor website URL (required, NOT NULL on Vendor table). Trailing slashes are normalised server-side."},"ownerPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"User assigned as the vendor owner; defaults to the requesting user"},"vendorAdminPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"User assigned as the vendor admin. If both vendorAdminPk and vendorAdminSystemGroup are null, a default admin is auto-assigned."},"vendorAdminSystemGroup":{"type":"enum","values":["ADMIN","SMT","BOARD_MEMBER","INFOSEC_OFFICER","PRIVACY_OFFICER","PEOPLE_OPERATIONS","INFRA_OPERATIONS","COMPLIANCE_PROGRAM_MANAGER","AUDITOR","STAFF","SPRINTO_SUPPORT","COLLABORATOR","INTERNAL_AUDITOR","EXCEPTION_ANALYST","VIEWER","TRUST_CENTER_ADMIN","SEC_QUE_ADMIN","SEC_QUE_CONSUMER","SEC_QUE_EDITOR","SERVICE_PROVIDER","VENDOR_CONTACT","VENDOR_BUSINESS_OWNER"],"optional":true,"nullable":true,"description":"System group assigned as the vendor admin (alternative to vendorAdminPk)"},"internalBusinessContactPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Internal business contact user identifier"},"internalBusinessContactSystemGroup":{"type":"enum","values":["ADMIN","SMT","BOARD_MEMBER","INFOSEC_OFFICER","PRIVACY_OFFICER","PEOPLE_OPERATIONS","INFRA_OPERATIONS","COMPLIANCE_PROGRAM_MANAGER","AUDITOR","STAFF","SPRINTO_SUPPORT","COLLABORATOR","INTERNAL_AUDITOR","EXCEPTION_ANALYST","VIEWER","TRUST_CENTER_ADMIN","SEC_QUE_ADMIN","SEC_QUE_CONSUMER","SEC_QUE_EDITOR","SERVICE_PROVIDER","VENDOR_CONTACT","VENDOR_BUSINESS_OWNER"],"optional":true,"nullable":true,"description":"System group assigned as the internal business contact"},"internalContacts":{"type":"array","items":{"type":"object","properties":{"pk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of an existing internal contact (omit when creating)"},"userPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Internal user assigned as the contact"},"systemGroup":{"type":"enum","values":["ADMIN","SMT","BOARD_MEMBER","INFOSEC_OFFICER","PRIVACY_OFFICER","PEOPLE_OPERATIONS","INFRA_OPERATIONS","COMPLIANCE_PROGRAM_MANAGER","AUDITOR","STAFF","SPRINTO_SUPPORT","COLLABORATOR","INTERNAL_AUDITOR","EXCEPTION_ANALYST","VIEWER","TRUST_CENTER_ADMIN","SEC_QUE_ADMIN","SEC_QUE_CONSUMER","SEC_QUE_EDITOR","SERVICE_PROVIDER","VENDOR_CONTACT","VENDOR_BUSINESS_OWNER"],"optional":true,"nullable":true,"description":"System group assigned as the internal contact"}},"required":[]},"optional":true… (truncated) Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_VENDORS

Registers vulnerability scanning providers for the organization Tags: vulnerability, security, scanning, infra, provider, pentest Payload schema (JSON Schema): {"type":"object","properties":{"vulnerabilityScanningProviders":{"type":"array","items":{"type":"object","properties":{"provider":{"type":"enum","values":["Dependabot","SLScan","Snyk","AWSINSPECTOR","RAPID_FORT","CODACY","TENABLE","SOCKET","DEEPSOURCE","INTRUDER","AWS_SECURITY_HUB","JIRA_VULN_PROVIDER","CROWDSTRIKE_SPOTLIGHT","MICROSOFT_DEFENDER_ENDPOINT","MICROSOFT_DEFENDER_VMS","CROWDSTRIKE_EDR","GITLAB_VULN_SCANNER","HALO_SECURITY","SENTINEL_ONE","SENTINEL_ONE_VMS","RAPID7_INSIGHTVM","CHECKMARX","AZURE_DEFENDER","WIZ_CLOUD","WIZ_CODE","GOOGLE_SECURITY_CENTER","SEMGREP","SONARCLOUD","SONARQUBE","QUALYS","AIKIDO"],"description":"The vulnerability scanning source. Examples: AWS_SECURITY_HUB, GOOGLE_SECURITY_CENTER, AZURE_DEFENDER, AWSINSPECTOR, SNYK, SLScan. Use query__listInfraProviders to see which infra providers are already connected."},"providerType":{"type":"enum","values":["INFRASTRUCTURE","CHANGE_MANAGEMENT","OTHERS"],"description":"Category of scanning provider. INFRASTRUCTURE = cloud/infra provider (requires infraProviderPk). CHANGE_MANAGEMENT = CI/CD pipeline scanner (requires changeManagementProviderPk). OTHERS = standalone scanners like Snyk."},"infraProviderPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the infra provider record. Required when providerType is INFRASTRUCTURE. Use query__listInfraProviders to find the pk."},"changeManagementProviderPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the change management provider. Required when providerType is CHANGE_MANAGEMENT. Use query__listInfraProviders to find the pk."}},"required":["provider","providerType"]},"minItems":1,"description":"One or more vulnerability scanning provider configurations to add. At least one entry required."}},"required":["vulnerabilityScanningProviders"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_VULNERABILITY_SCANNING_PROVIDERS

Approves a policy's draft, making it the active version Tags: policy, compliance, governance, approval, trust-center Payload schema (JSON Schema): {"type":"object","properties":{"policyPk":{"type":"string","format":"uuid","description":"Primary key of the policy to approve"},"draftPolicyLogPk":{"type":"string","format":"uuid","description":"Primary key of the draft policy log to approve"}},"required":["policyPk","draftPolicyLogPk"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__APPROVE_POLICY_V2

Approves an organization risk item Tags: risk Payload schema (JSON Schema): {"type":"object","properties":{"orgRiskItemPk":{"type":"string","format":"uuid","description":"Unique identifier of the organization risk item to approve"},"riskApproverPks":{"type":"array","items":{"type":"string","format":"uuid"},"minItems":1,"description":"List of risk approver primary keys, we use the riskApprover.pk and not approverPk"}},"required":["orgRiskItemPk","riskApproverPks"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__APPROVE_RISK_V2

Archives an evidence request without permanently deleting it Tags: evidence-request, audit, compliance Payload schema (JSON Schema): {"type":"object","properties":{"orgEvidenceRequestPk":{"type":"string","format":"uuid","description":"Primary key of the evidence request to archive"}},"required":["orgEvidenceRequestPk"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ARCHIVE_ORG_EVIDENCE_REQUEST

Assigns policy acknowledgement requests to selected employees and can notify them Tags: people, policy Payload schema (JSON Schema): {"type":"object","properties":{"name":{"type":"string","description":"Name/label for the acknowledgment request."},"orgPolicyTypePks":{"type":"array","items":{"type":"string","format":"uuid"},"minItems":1,"description":"Policy type PKs the employees must acknowledge (at least one)."},"userPks":{"type":"array","items":{"type":"string","format":"uuid"},"minItems":1,"description":"Individual employee (user) PKs to assign the acknowledgment to (at least one)."},"sendPolicyAckNotification":{"type":"boolean","optional":true,"nullable":true,"description":"Whether to send acknowledgment notification emails (defaults to false)."}},"required":["name","orgPolicyTypePks","userPks"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ASSIGN_POLICY_ACK_TO_EMPLOYEES

Assigns a user to a system group and may replace the current unique role holder Tags: people, staff, role, system-group, privacy-officer, infosec, gdpr Payload schema (JSON Schema): {"type":"object","properties":{"userPk":{"type":"string","format":"uuid","description":"Primary key of the user to assign. Must be an active user in the same organization. Use query__getUsersPaginated or query__getUsers to look up the user's pk. Returns UserNotFound error if the user does not belong to the org."},"systemGroupName":{"type":"enum","values":["ADMIN","SMT","BOARD_MEMBER","INFOSEC_OFFICER","PRIVACY_OFFICER","PEOPLE_OPERATIONS","INFRA_OPERATIONS","COMPLIANCE_PROGRAM_MANAGER","AUDITOR","STAFF","SPRINTO_SUPPORT","COLLABORATOR","INTERNAL_AUDITOR","EXCEPTION_ANALYST","VIEWER","TRUST_CENTER_ADMIN","SEC_QUE_ADMIN","SEC_QUE_CONSUMER","SEC_QUE_EDITOR","SERVICE_PROVIDER","VENDOR_CONTACT","VENDOR_BUSINESS_OWNER"],"description":"System group to assign the user to. Examples: PRIVACY_OFFICER, INFOSEC_OFFICER, SMT (Senior Management), ADMIN, LIMITED_ADMIN. PRIVACY_OFFICER and INFOSEC_OFFICER enforce a UniqueInOrg constraint — assigning a new holder automatically removes the previous one. SMT also enforces UniqueInOrg. Returns SystemGroupMemberAlreadyExists if the user is already in the group, or SystemGroupMemberNotAdded if the user is already in SMT or INFOSEC_OFFICER and the target group is also SMT or INFOSEC_OFFICER."}},"required":["userPk","systemGroupName"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_SYSTEM_GROUP_MEMBERSHIP

Answers security questionnaire questions using the Knowledge Hub. Send ALL questions at once — the tool batches internally, no limit per call. This tool only returns answers from Sprinto — it does not parse files or create CSVs. You (the assistant) do the parsing and CSV creation using Code Interpreter. Returns a structured result per question: answer text, confidence, needs_review, sources. ALWAYS display sources from each result in your response. Show citations below each answer. Supported formats (you parse these with Code Interpreter): - CSV (.csv) — pandas.read_csv() - Excel (.xlsx) — pandas.read_excel() - Word (.docx) — python-docx, extract tables or paragraphs - PDF (.pdf) — try pdfplumber or camelot; if no clean table, ask to re-upload as CSV/Excel - Old Word (.doc) or any other format — ask user to re-upload as CSV or Excel Flow (do all of this automatically — do NOT ask permission at any step): 1. Parse the uploaded file with Code Interpreter immediately. 2. Silently detect the question column: a. Exact name match: "Question", "Question Text", "Security Question", "Requirement" b. Column name contains "question" or "requirement" (case-insensitive) c. Column with the longest average text length Only ask if two columns are genuinely indistinguishable in size. 3. Silently detect or create the answer column (Response, Answer, Vendor Response, Comments). If none found, create "Answer". Only ask if two equally plausible candidates exist. 4. Call get_workspace_context once silently before generating answers. 5. Call this tool with ALL questions in a single call — the tool handles batching internally. Show a brief progress message like "Fetching answers from your Knowledge Hub..." 6. IMMEDIATELY generate the completed CSV using Code Interpreter — do not ask first. Preserve original columns/rows, write answers into the chosen column. Provide the CSV for download and say "Your completed questionnaire is ready to download." 7. Show a summary: "Finished. Total: [Y] | Answered: [X] | Needs review: [Z]" Include citations (sources) for any questions that had supporting documents. If PDF parsing fails (scanned/image PDF): tell the user and ask to re-upload as CSV or Excel. If .doc or unsupported format: ask the user to re-upload as CSV or Excel. If most questions are flagged for review: "Your Knowledge Hub may not have enough documentation yet. You can add policies at Sprinto → Knowledge Hub to improve coverage."

batch_answer_questions

Bulk-approves or revokes approval for security questionnaire questions Tags: security-questionnaire Payload schema (JSON Schema): {"type":"object","properties":{"questionMappings":{"type":"array","items":{"type":"object","properties":{"secQueQuestionPk":{"type":"string","format":"uuid","description":"UUID of the SecQueQuestion to approve or revoke approval for."},"autoRespQuestionPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"UUID of the associated auto-response question, used to build deep-link URLs in approval notifications."}},"required":["secQueQuestionPk"]},"minItems":1,"description":"Mappings of SecQueQuestion PKs to their optional auto-response question PKs. Must contain at least one entry with a valid secQueQuestionPk. If the derived secQueQuestionsPks list is empty, returns userInputErrors[].key=\"secQueQuestionsPks\", messages=[\"MissingSecQueQuestionsPks\"]."},"shouldApprove":{"type":"boolean","optional":true,"nullable":true,"description":"When true: approves questions by setting status to REVIEWED. Unanswered (UNANSWERED) questions are silently skipped. When false: revokes approval by setting status back to ANSWERED. Only questions currently in REVIEWED status are processed; all others are skipped. Approval notifications are sent to question owners only when shouldApprove is true."}},"required":["questionMappings"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__BULK_APPROVE_SECQUE_QUESTIONS

Closes multiple open incidents in bulk Tags: incident Payload schema (JSON Schema): {"type":"object","properties":{"isAllSelected":{"type":"boolean","description":"When true, close ALL currently-open incidents for the org (optionally narrowed by `source`). When false, close only the open incidents whose pks are in incidentPksToClose."},"incidentPksToClose":{"type":"array","items":{"type":"string","format":"uuid"},"optional":true,"description":"UUID primary keys of incidents to close. Used when isAllSelected is false. Only pks that correspond to currently-OPEN incidents in the org are closed; pks that are already closed or do not exist are silently skipped. An empty or omitted array is a no-op when isAllSelected is false."},"closingNotes":{"type":"string","optional":true,"nullable":true,"description":"Optional closing notes (Incident.closingNotes, a nullable text column) applied to every incident closed by this action."},"source":{"type":"string","optional":true,"nullable":true,"description":"Optional single incident source to filter by (applied as Incident.source = source). Valid base values: \"GuardDuty\", \"StaffReported\", \"MicrosoftDefender\", \"GoogleSecurityCenter\", \"PagerDuty\", \"Jira\", \"OpsGenie\" (additional orchestra-provider sources may also exist). When omitted/null, incidents of all sources are eligible. NOTE: this is read regardless of isAllSelected, but only meaningfully changes behaviour when isAllSelected is true."}},"required":["isAllSelected"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__BULK_CLOSE_INCIDENTS

Creates or updates multiple risk records inside a risk register Tags: risk, bulk Payload schema (JSON Schema): {"type":"object","properties":{"rows":{"type":"array","items":{"type":"object","properties":{"riskId":{"type":"string","description":"Unique identifier for the risk within the register (used for upsert matching)"},"name":{"type":"string","description":"Risk name"},"description":{"type":"string","optional":true,"nullable":true,"description":"Detailed description of the risk"},"categories":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"Risk category labels"},"treatment":{"type":"string","optional":true,"nullable":true,"description":"Treatment strategy (e.g., MITIGATE, ACCEPT, TRANSFER, AVOID)"},"treatmentNotes":{"type":"string","optional":true,"nullable":true,"description":"Notes on the treatment plan"},"evaluationNotes":{"type":"string","optional":true,"nullable":true,"description":"Notes from the risk evaluation"},"riskOwnerEmail":{"type":"string","optional":true,"nullable":true,"description":"Email of the staff member who owns this risk"},"riskOwnerSystemGroup":{"type":"string","optional":true,"nullable":true,"description":"System group identifier for the risk owner"},"sourceType":{"type":"string","optional":true,"nullable":true,"description":"Source classification of the risk"},"riskManagerEmails":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"Emails of risk managers for this risk"},"riskManagerSystemGroups":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"System group identifiers for risk managers"},"riskSource":{"type":"string","optional":true,"nullable":true,"description":"The origin source of the risk"},"applicableCIA":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"Applicable CIA triad components (CONFIDENTIALITY, INTEGRITY, AVAILABILITY)"},"exposedThreats":{"type":"string","optional":true,"nullable":true,"description":"Threats this risk exposes the org to"},"exposedVulnerabilities":{"type":"string","optional":true,"nullable":true,"description":"Vulnerabilities associated with this risk"},"monetaryValue":{"type":"string","optional":true,"nullable":true,"description":"Estimated monetary impact value"},"additionalInformation":{"type":"string","optional":true,"nullable":true,"description":"Any additional freeform information"},"entityCustomAttributeValues":{"type":"array","items":{"type":"object","properties":{"entityCustomAttributeDefinitionPk":{"type":"string","format":"uuid","description":"PK of the custom attribute definition"},"value":{"type":"unknown","description":"Value for the custom attribute"}},"required":["entityCustomAttributeDefinitionPk"]},"optional":true,"nullable":true,"description":"Custom attribute values for this risk"},"controlFrameworkValues":{"type":"array","items":{"type":"object","properties":{"framework":{"type":"string","description":"Framework identifier (e.g., SOC2, ISO27001)"},"criteria":{"type":"union","options":[{"type":"array","items":{"type":"string"}},{"type":"string"}],"description":"Framework criteria to map this risk to. May be an array or comma-separated string."}},"required":["framework","criteria"]},"optional":true,"nullable":true,"description":"Framework criteria this risk is mapped to"}},"required":["riskId","name"]},"minItems":1,"description":"Array of risk records to create or update. Matching within the register is done by riskId. Existing riskIds are updated; new ones create records."},"orgRiskRegisterPk":{"type":"string","format":"uuid","description":"PK of the risk register these risks belong to"}},"required":["rows","orgRiskRegisterPk"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__BULK_IMPORT_RISKS

Creates or updates multiple vendor records in a single dispatch. Do not use overallRiskLevel=CRITICAL unless Critical vendor risk is enabled for the organization. Tags: vendor, bulk Payload schema (JSON Schema): {"type":"object","properties":{"vendors":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Vendor name. Used to match an existing vendor (update) or create a new one."},"websiteUrl":{"type":"string","optional":true,"nullable":true,"description":"Vendor website URL"},"category":{"type":"string","optional":true,"nullable":true,"description":"Vendor category (e.g., CLOUD_SERVICES, SAAS)"},"description":{"type":"string","optional":true,"nullable":true,"description":"Short description of the vendor"},"overallRiskLevel":{"type":"enum","values":["CRITICAL","HIGH","MEDIUM","LOW","NA"],"optional":true,"nullable":true,"description":"Overall risk level. Use HIGH, MEDIUM, LOW, or NA. Use CRITICAL only when Critical vendor risk is enabled for the organization. Normalized to internal enum values before saving."},"vendorAdminEmail":{"type":"string","optional":true,"nullable":true,"description":"Email of the vendor's admin contact in Sprinto"},"vendorAdminSystemGroup":{"type":"string","optional":true,"nullable":true,"description":"System group identifier for the vendor admin"},"internalBusinessContactEmail":{"type":"string","optional":true,"nullable":true,"description":"Email of the internal business owner for this vendor"},"contactName":{"type":"string","optional":true,"nullable":true,"description":"Name of the primary vendor contact"},"contactEmail":{"type":"string","optional":true,"nullable":true,"description":"Email of the primary vendor contact"},"externalContactEmails":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"Additional external contact emails for this vendor"},"entityCustomAttributeValues":{"type":"array","items":{"type":"object","properties":{"entityCustomAttributeDefinitionPk":{"type":"string","format":"uuid","description":"PK of the custom attribute definition"},"value":{"type":"unknown","description":"Value for the custom attribute"}},"required":["entityCustomAttributeDefinitionPk"]},"optional":true,"nullable":true,"description":"Custom attribute values for this vendor"},"riskDimensions":{"type":"array","items":{"type":"object","properties":{"orgVendorRiskDimensionPk":{"type":"string","format":"uuid","description":"PK of the org-level risk dimension"},"values":{"type":"array","items":{"type":"string"},"description":"Selected values for this risk dimension"}},"required":["orgVendorRiskDimensionPk","values"]},"optional":true,"nullable":true,"description":"Risk dimension values scoped to this vendor"}},"required":["name"]},"description":"Array of vendor records to create or update. Matching is done by vendor name within the org. Existing vendors are updated; new names create new vendor records."}},"required":["vendors"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__BULK_IMPORT_VENDORS

Atomically bulk-updates access control entity–user connections Tags: access-control, access-review Payload schema (JSON Schema): {"type":"object","properties":{"accessUserMappings":{"type":"array","items":{"type":"object","properties":{"accessControlEntityPk":{"type":"string","format":"uuid","description":"Primary key (UUID) of the AccessControlEntity record to update. Each pk must appear at most once in the batch — duplicate accessControlEntityPks are rejected upfront with DuplicateAccessUserMapping."},"decision":{"type":"enum","values":["ADD_AS_A_NEW_USER","NOT_A_USER","NO_CONNECTION","USER"],"description":"How to resolve this access user's connection to a Sprinto staff user. One of:\n- USER: link to an existing Sprinto user via connectedUserPk (requires connectedUserPk).\n- ADD_AS_A_NEW_USER: create a new Sprinto staff user from userToAdd, then link to them (requires userToAdd).\n- NOT_A_USER: mark the entry as a non-person/service account (sets notAUser=true, clears connection).\n- NO_CONNECTION: clear the connection without marking as non-user."},"connectedUserPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key (UUID) of the existing Sprinto User to link. REQUIRED when decision is USER; ignored otherwise."},"userToAdd":{"type":"object","properties":{"firstName":{"type":"string","description":"New user's first name. Must be non-empty (the underlying User.firstName column is NOT NULL)."},"lastName":{"type":"string","optional":true,"nullable":true,"description":"New user's last name"},"email":{"type":"string","format":"email","description":"New user's email address. Must be a valid email format. Must not match any active user already in the organisation — if it does, the action returns success:false with errors. When multiple mappings in the same batch share the same userToAdd.email, only one new user is created; the remaining mappings are rewritten to a USER decision pointing at that new user."},"employmentType":{"type":"enum","values":["EMPLOYEE","CONTRACTOR","NHI"],"optional":true,"nullable":true,"description":"Employment classification of the new user. One of: EMPLOYEE, CONTRACTOR, NHI. Optional — the handler defaults a missing/empty value to EMPLOYEE."},"employmentStartDate":{"type":"string","optional":true,"nullable":true,"description":"ISO date string for the new user's employment start date"},"employmentIsNew":{"type":"boolean","optional":true,"description":"Whether the user is brand new to the organisation (true) or is an existing person being formally added (false)"},"createdVia":{"type":"string","optional":true,"nullable":true,"description":"Source or channel through which this user record is being created (e.g., integration name)"}},"required":["firstName","email"],"optional":true,"nullable":true,"description":"Data for the new staff user to create and link. REQUIRED when decision is ADD_AS_A_NEW_USER; ignored otherwise."}},"required":["accessControlEntityPk","decision"]},"description":"List of per-entity connection mappings to apply in a single atomic batch. Each mapping specifies one AccessControlEntity and the decision to apply. An empty array is a no-op: returns success with empty results. The entire batch is all-or-nothing — any single failure rolls back all writes."}},"required":["accessUserMappings"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__BULK_UPDATE_ACCESS_USER_CONNECTION

Bulk-reassigns the owner of one or more security questionnaire questions Tags: security-questionnaire Payload schema (JSON Schema): {"type":"object","properties":{"assigneePk":{"type":"string","format":"uuid","description":"Primary key of the user to assign as the new owner (ownedByPk) for all specified questions. Validation error key: \"assigneePk\", message: \"MissingAssigneePk\" when omitted."},"questionMappings":{"type":"array","items":{"type":"object","properties":{"secQueQuestionPk":{"type":"string","format":"uuid","description":"Primary key of the SecQueQuestion to reassign (UUID, NOT NULL)."},"autoRespQuestionPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the corresponding SecQueAutoRespQuestion, if any. Used for notification deep-link routing."}},"required":["secQueQuestionPk"]},"minItems":1,"description":"Non-empty list of question mappings. The handler extracts secQueQuestionPks from this array via _.compact(_.map(questionMappings, \"secQueQuestionPk\")). Validation error key: \"secQueQuestionsPks\", message: \"MissingSecQueQuestionsPks\" when the resulting array is empty."}},"required":["assigneePk","questionMappings"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__BULK_UPDATE_SECQUE_QUESTION_ASSIGNEE

Bulk-updates the reviewer of one or more security questionnaire questions Tags: security-questionnaire Payload schema (JSON Schema): {"type":"object","properties":{"reviewerPk":{"type":"string","format":"uuid","description":"UUID of the user to assign as reviewer for the selected questions. Required. If empty, returns userInputErrors[].key=\"reviewerPk\", messages=[\"MissingReviewerPk\"]."},"secQueQuestionsPks":{"type":"array","items":{"type":"string","format":"uuid"},"minItems":1,"description":"Array of SecQueQuestion PKs to update. Must contain at least one entry. If empty, returns userInputErrors[].key=\"secQueQuestionsPks\", messages=[\"MissingSecQueQuestionsPks\"]."},"notifyNewReviewer":{"type":"boolean","optional":true,"description":"When true, sends an email notification to the new reviewer. The notification is only sent if at least one of the updated questions is in PENDING_REVIEW status."}},"required":["reviewerPk","secQueQuestionsPks"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__BULK_UPDATE_SECQUE_QUESTION_REVIEWER

Returns what Sprinto Assistant can do, behavioral rules, how the questionnaire flow works, and what file formats are accepted. WHEN TO CALL: - User explicitly asks what Sprinto can do or how a Sprinto workflow works - User asks which file formats Sprinto supports for security questionnaires - User uploads a file without any clear instruction (start flow automatically after fetching this) Do not call this tool for generic greetings, general help, or requests unrelated to Sprinto. Use the return value — especially behavioral_rules — to guide your entire response. You are Sprinto Assistant: you parse files and build CSVs; Sprinto only provides answers. Keep your reply friendly and concise.

get_capabilities

Returns true/false whether the org has a default vendor register Tags: vendor, vendor-register, exists, boolean Args schema (JSON Schema): {"type":"object","properties":{},"required":[]} Read-only. Returns `{ result: ... }`. No idempotencyKey needed.

query__hasDefaultVendorRegister

Closes (completes) a custom task Tags: vendor, risk, audit Payload schema (JSON Schema): {"type":"object","properties":{"closeCustomTaskDict":{"type":"object","properties":{"pk":{"type":"string","format":"uuid","description":"Primary key of the custom task to close"},"closureRemarks":{"type":"string","optional":true,"nullable":true,"description":"Remarks captured at task closure"},"closureAttachmentS3Keys":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"S3 keys for attachments captured at closure"},"closureMetadata":{"type":"object","properties":{"reviewStatus":{"type":"enum","values":["APPROVED","REJECTED"],"optional":true,"nullable":true,"description":"Review outcome (APPROVED or REJECTED). REJECTED drives a REUPLOAD_REQUESTED audit-task notification."},"skipRemarks":{"type":"string","optional":true,"nullable":true,"description":"Remarks captured when the upload step is skipped"},"skipUpload":{"type":"boolean","optional":true,"nullable":true,"description":"Whether the evidence upload step was skipped; treated like having attachments for notifications"}},"required":[],"optional":true,"nullable":true,"description":"Structured closure metadata (review status / skip flags)"}},"required":["pk"],"description":"Closure payload for the custom task"}},"required":["closeCustomTaskDict"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__CLOSE_CUSTOM_TASK

Closes a single incident for the org Tags: incident Payload schema (JSON Schema): {"type":"object","properties":{"incidentPk":{"type":"string","format":"uuid","description":"Primary key (UUID) of the incident to close. Must belong to the user's org and must NOT already be CLOSED, otherwise the action returns a userInput error with key 'incidentPk'."},"customerDataLossReported":{"type":"boolean","description":"Whether customer data loss was reported for this incident. Required. If true, informedToCustomers MUST also be true, otherwise closing fails with key \"informedToCustomers\" / message \"CanNotCloseWithOutInforming\"."},"informedToCustomers":{"type":"boolean","optional":true,"nullable":true,"description":"Whether customers were informed of the incident. Required (must be true) when customerDataLossReported is true; otherwise the action fails with the \"CanNotCloseWithOutInforming\" userInput error."},"closingNotes":{"type":"string","optional":true,"nullable":true,"description":"Notes documenting the incident closure, resolution, or lessons learned."},"affectedDataTypes":{"type":"array","items":{"type":"enum","values":["CUSTOMER_DATA","CONFIDENTIAL_CORPORATE_DATA","PII","PHI","CHD","OTHER"]},"optional":true,"nullable":true,"description":"Data types affected by the incident. Allowed values: CUSTOMER_DATA, CONFIDENTIAL_CORPORATE_DATA, PII, PHI, CHD, OTHER. NOTE: the GraphQL input accepts an array but the underlying DB column is a single-value ENUM, so pass at most one value."},"evidenceS3Keys":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"S3 keys of evidence files attached to the incident closure."}},"required":["incidentPk","customerDataLossReported"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__CLOSE_INCIDENT

Creates or updates a completed risk assessment snapshot Tags: risk, risk-assessment, risk-register, compliance, governance Payload schema (JSON Schema): {"type":"object","properties":{"riskAssessmentPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of an existing risk assessment to update. If provided, the assessment is updated in place rather than creating a new one. Omit to create a new risk assessment."},"riskAssessmentTitle":{"type":"string","description":"Title for the risk assessment. Required."},"riskAssessmentType":{"type":"enum","values":["ASSET_BASED","PROCESS_BASED"],"optional":true,"nullable":true,"description":"The assessment methodology. ASSET_BASED = risk scored per asset/system. PROCESS_BASED = risk scored per business process. Required when creating a register-based assessment (no riskProfileS3Key). Ignored when riskProfileS3Key is provided."},"riskProfileS3Key":{"type":"string","optional":true,"nullable":true,"description":"S3 key of a previously uploaded risk profile document to attach to the assessment. Optional."},"zonePk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the risk register zone to scope this assessment to. Use query__getOrgRiskCategories or the risk register query to find zone pks. Omit for the default zone."},"orgRiskRegisterPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the org risk register to associate this assessment with. Omit to use the default risk register. Use query__listRisks to find the orgRiskRegisterPk."}},"required":["riskAssessmentTitle"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__COMPLETE_RISK_ASSESSMENT

Returns the current compliance status for the organisation across all active checks. Shows which checks are passing, failing, pending evidence, or under review. If any checks are failing or pending, always show the user atleast some of those checks — don't just show the summary. Each entry in the response includes a monitor_pk field — an opaque database identifier. That monitor_pk is the required input for resolve_check. WHEN TO CALL: - At the start of any compliance session - When the user asks about their GDPR or compliance status - When the user asks to list, show, filter, or count checks — e.g. "show passing checks", "which checks are failing?", "how many checks are pending?" - Before calling resolve_check if you do not already have the monitor_pk for the requested control Examples: "What is our current GDPR compliance status?", "Show me all passing checks", "Which checks are still failing?"

get_compliance_status_details

Configures staff onboarding and sends enabled onboarding notifications Tags: people, onboarding Payload schema (JSON Schema): {"type":"object","properties":{"template":{"type":"string","optional":true,"nullable":true,"description":"Onboarding message template to send to new staff members."},"isEmailEnabled":{"type":"boolean","optional":true,"nullable":true,"description":"Whether to enable email notifications for onboarding."},"isSlackEnabled":{"type":"boolean","optional":true,"nullable":true,"description":"Whether to enable Slack notifications for onboarding."}},"required":[],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ORG_ONBOARDING_CONFIGURATION_KICKOFF

Creates a new compliance audit for the organization Tags: audit, governance Payload schema (JSON Schema): {"type":"object","properties":{},"required":[],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__CREATE_AUDIT

Creates a single custom control Tags: control, compliance Payload schema (JSON Schema): {"type":"object","properties":{"number":{"type":"string","description":"Control number/identifier. Required by the GraphQL contract. Max 255 characters, else userInput error key=\"number\". If numeric and \"order\" is omitted, the number is parsed into the order column."},"statement":{"type":"string","description":"Control statement text. Required, persisted to a NOT NULL column."},"order":{"type":"number","optional":true,"nullable":true,"description":"Sort order. If omitted and number is numeric, order is derived from number."},"controlOwnerPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the user who owns the control"},"ownedBySystemGroup":{"type":"string","optional":true,"nullable":true,"description":"System group that owns the control (e.g. \"IT_ADMIN\")"},"domain":{"type":"enum","values":["ACCESS_CONTROL","CHANGE_MANAGEMENT","ASSET_MANAGEMENT","PERSONNEL_SECURITY","PHYSICAL_AND_ENVIRONMENTAL_PROTECTION","PRIVACY","RISK_ASSESSMENT","VULNERABILITY_AND_PATCH_MANAGEMENT","THIRD_PARTY_RISK_MANAGEMENT","CONTINGENCY_PLANNING","CAPACITY_AND_PERFORMANCE_PLANNING","CRYPTOGRAPHIC_PROTECTIONS","ENDPOINT_SECURITY","NETWORK_SECURITY","SECURE_ENGINEERING","COMPLIANCE_ASSESSMENT","SYSTEM_AND_SERVICES_ACQUISITION","INCIDENT_RESPONSE","MAINTENANCE","AWARENESS_AND_TRAINING","DATA_CLASSIFICATION_AND_MEDIA_PROTECTION","GOVERNANCE_AND_PROGRAM_MANAGEMENT","CONTINUOUS_MONITORING","SYSTEM_AND_INFORMATION_INTEGRITY","THREAT_MANAGEMENT","CLOUD_SECURITY","DATA_MANAGEMENT","CUSTOMER_MANAGEMENT","ARTIFICIAL_AND_AUTONOMOUS_SYSTEMS","EMBEDDED_AND_CONNECTED_SYSTEMS","ASSESSMENT_AUTHORIZATION_AND_MONITORING","OTHERS"],"optional":true,"nullable":true,"description":"Control domain. Defaults to OTHERS on the DB column when omitted."},"shortText":{"type":"string","optional":true,"nullable":true,"description":"Short name of the control. Max 255 characters, else userInput error key=\"shortText\"."},"entityCustomAttributeValues":{"type":"array","items":{"type":"object","properties":{"entityCustomAttributeDefinitionPk":{"type":"string","format":"uuid","description":"Primary key of the custom attribute definition"},"value":{"type":"unknown","optional":true,"nullable":true,"description":"Value for the custom attribute (JSON)"},"unit":{"type":"string","optional":true,"nullable":true,"description":"Optional unit for the custom attribute value"}},"required":["entityCustomAttributeDefinitionPk"]},"optional":true,"nullable":true,"description":"Custom field values. Only persisted when the org has the CONTROL_CUSTOM_FIELDS feature flag; otherwise silently ignored."}},"required":["number","statement"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__CREATE_CONTROL

Attaches a piece of evidence to a control Tags: evidence, control Payload schema (JSON Schema): {"type":"object","properties":{"controlPk":{"type":"string","format":"uuid","description":"Primary key (UUID) of the Control to attach evidence to. Must belong to the user's org. Resolve via search_sprinto."},"title":{"type":"string","description":"Human-readable title/name for this piece of evidence."},"evidenceDate":{"type":"string","description":"ISO-8601 date the evidence was collected/effective (e.g. \"2026-06-11\")."},"fileUrl":{"type":"string","format":"url","description":"Public, directly-downloadable https URL of the file (may be a pre-authed/presigned link). Sprinto fetches and stores it; <=10MB; allowed types: .jpeg, .jpg, .png, .gif, .tiff, .bmp, .txt, .doc, .docx, .xls, .xlsx, .csv, .pdf, .zip, .tar, .odt, .ods, .msg, .json."}},"required":["controlPk","title","evidenceDate","fileUrl"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__CREATE_CONTROL_EVIDENCE

Creates one or more critical access systems for login access control Tags: access-control, access-review Payload schema (JSON Schema): {"type":"object","properties":{"criticalAccessSystems":{"type":"array","items":{"type":"object","properties":{"provider":{"type":"string","description":"Provider identifier for the critical access system (e.g., GSUITE, AWS, OKTA, GITHUB, AZURE, GCP, MONGO_ATLAS, OFFICE365, BITBUCKET, GITLAB, SLACK, ZOHO, JENKINS, SALESFORCE, SPRINTO, etc.). Must be a valid autoCriticalAccessSystemType (DB column is NOT NULL — non-empty required). SPRINTO provider triggers special INTEGRATE_SPRINTO_AS_ACAS dispatch and has no vendor connection support."},"accessType":{"type":"enum","values":["WEB_CONSOLE_ACCESS","INSTANCE_ACCESS","API_ACCESS"],"description":"Type of access this critical system represents. WEB_CONSOLE_ACCESS: browser-based access to a web console. INSTANCE_ACCESS: direct access to compute instances (e.g., SSH, RDP). API_ACCESS: programmatic access via API keys or tokens."},"reviewType":{"type":"enum","values":["AUTO","MANUAL"],"description":"Determines the access review workflow AND which conveyor the handler runs. AUTO: vendor-integrated path — connects via vendor integration, auto-populates users, runs periodic access reviews. MANUAL: self-managed path (e.g., Jenkins, Notion) — users added manually, reviews are on-demand. The fields criticalSystemPk, criticalSystemModelName, vendorConnectionPk, and integrated are only used by the AUTO path; MANUAL silently ignores them."},"criticalSystemPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the actual system entity (e.g., IdentityProvider, InfraProvider, OAuthActiveConnection). AUTO-only — used to link the CAS to the underlying provider record. Silently ignored for MANUAL reviewType."},"criticalSystemModelName":{"type":"string","optional":true,"nullable":true,"description":"Sequelize model name of the critical system entity (e.g., GSuiteCustomer, OktaApp, EntraApp, IamApp, AwsUser, InfraProvider). AUTO-only — silently ignored for MANUAL. If the value is OktaApp, EntraApp, or IamApp, the system is treated as IAM-based, enabling Okta IAM flow dispatch and login protection monitors."},"integrated":{"type":"boolean","optional":true,"nullable":true,"description":"Whether to upsert access control entities for this system. AUTO-only — silently ignored for MANUAL. When true, triggers upsertAccessControlEntitiesForASystem with a maximum of 50 entities per system. When false or omitted, no entities are created during setup."},"vendorConnectionPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the VendorConnection record. AUTO-only — used to dispatch sync operations (determines whether flow-based or job-based entity refresh runs). Silently ignored for MANUAL. Not applicable for SPRINTO provider."},"isAuditScope":{"type":"boolean","optional":true,"nullable":true,"description":"Whether this system is in audit scope. Defaults to true in the database model if not provided. Set to false to explicitly exclude the system from audit scope."},"reviewFreqValue":{"type":"number","optional":true,"nullable":true},"reviewFreqUnit":{"type":"string","optional":true,"nullable":true}},"required":["provider","accessType","reviewType"]},"minItems":1,"description":"Array of critical access systems to create. Must contain at least one item — passing an empty array silently no-ops (handler reduces to empty AUTO/MANUAL groups and produces no records). Each item is routed to either the AUTO creation path (vendor-integrated with automatic sync and monitor evaluation) or the MANUAL creation path (self-managed with custom checks) based on its reviewType. Per-item errors are collected separately, so partial success is possible."},"saveAddCasPreferencesForFuture":{"type":"boolean","optional":true,"nullable":true,"description":"When true, after all systems are created successfully and the main transaction commits, persist add-details defaults from the first item in criticalAccessSystems (isAuditScope, reviewFreqValue, reviewFre… (truncated) Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__CREATE_CRITICAL_ACCESS_SYSTEMS

Creates a new custom compliance framework for the org Tags: framework Payload schema (JSON Schema): {"type":"object","properties":{"name":{"type":"string","description":"Framework name. Required, non-empty after trimming (handler rejects with key=\"name\", messages=[\"Framework name cannot be empty\"])."},"description":{"type":"string","optional":true,"nullable":true,"description":"Free-text framework description. Optional."},"geolocation":{"type":"string","optional":true,"nullable":true,"description":"Region for the framework (e.g. \"Global\", \"EU\", \"UK\"). Optional. Column defaults to \"Global\" when omitted."},"category":{"type":"enum","values":["ALL","PRIVACY","SECURITY","QMS","CUSTOM"],"optional":true,"nullable":true,"description":"Framework category. One of ALL, PRIVACY, SECURITY, QMS, CUSTOM. Optional. Column defaults to CUSTOM when omitted."}},"required":["name"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__CREATE_CUSTOM_FRAMEWORK

Creates a new custom task for vendor and risk workflows Tags: vendor, risk Payload schema (JSON Schema): {"type":"object","properties":{"createCustomTaskDict":{"type":"object","properties":{"entityPk":{"type":"string","format":"uuid","description":"Primary key of the entity the custom task is associated with"},"entityModelName":{"type":"string","description":"Sequelize model name of the entity this task is associated with (e.g. \"OrgRiskItem\", \"Vendor\", \"ManagementReview\"). Required, non-empty."},"secondaryEntityPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of secondary entity if applicable"},"secondaryEntityModelName":{"type":"string","optional":true,"nullable":true,"description":"Model name of secondary entity if applicable"},"type":{"type":"enum","values":["ACCESS_REVIEW","ACCESS_REVIEW_CUSTOM_USER_ACCESS","ACCESS_REVIEW_REVOKE_USER_ACCESS","ACCESS_REVIEW_DOWNGRADE_USER_ACCESS","ACCESS_REVIEW_DONE_BY_MANAGER","ACCESS_USER_REVIEW_BY_DELEGATED_REVIEWER","ACCESS_REVIEW_APPROVAL","AUDIT_TASK","AUDIT_CONTROL_TASK","RISK_MITIGATION_TREATMENT_ACCEPT","RISK_MITIGATION_TREATMENT_TRANSFER","RISK_MITIGATION_TREATMENT_FURTHER_MITIGATE","RISK_MITIGATION_TREATMENT_AVOID","RISK_MITIGATION_TREATMENT_NOT_SELECTED","UPLOAD_EVIDENCE_REQUEST","REVIEW_EVIDENCE_REQUEST","VENDOR_TASK","POLICY_LOG_TASK","CONTROL_TASK","CONTROL_EFFECTIVENESS_SCORE_UPDATE","CONTROL_FINDING_TASK","CONTROL_TEST_FINDING_TASK","POLICY_APPROVAL","RISK_APPROVAL","VENDOR_REQUEST_APPROVAL","VENDOR_DD_APPROVAL","VENDOR_APPROVAL","WORKFLOW_CHECK_APPROVAL","RDP_VULNERABILITY","WORKFLOW_STEP_TASK","WORKFLOW_STEP_USER_TASK","OUTCOME_GATE"],"description":"Type of custom task (e.g., AUDIT_TASK, VENDOR_TASK, RISK_MITIGATION, etc.)"},"state":{"type":"enum","values":["DRAFT","ACTIVE","CLOSED"],"optional":true,"description":"State of the custom task (DRAFT, ACTIVE, CLOSED). Defaults to DRAFT if omitted."},"name":{"type":"string","description":"Name/title of the custom task. Required, non-empty (the underlying name column is non-null)."},"description":{"type":"string","optional":true,"nullable":true,"description":"Description of the custom task"},"dueDate":{"type":"string","description":"Due date for the task (ISO 8601 datetime string). Required."},"assignedToPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the user assigned to the task. Provide either this OR assignedSystemGroup — at least one is required (the handler rejects with \"Cannot create a custom task without assignee\" otherwise). When provided, the user is also runtime-validated to be an admin or collaborator."},"assignedSystemGroup":{"type":"string","optional":true,"nullable":true,"description":"System group to assign the task to (e.g. \"IT_ADMIN\"). Provide either this OR assignedToPk — at least one is required."},"attachmentS3Keys":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"S3 keys for attachments"},"contextMetadata":{"type":"record","valueType":{"type":"unknown"},"optional":true,"nullable":true,"description":"Context metadata for the task"},"zonePks":{"type":"array","items":{"type":"string","format":"uuid"},"optional":true,"nullable":true,"description":"Zone primary keys to assign this task to. If omitted, the handler auto-determines zones based on entity context (createdWithZonePks=undefined path)."},"findingPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the finding this task is linked to"},"customTaskAction":{"type":"enum","values":["ENSURE_ACCESS_USER_REVIEW","ENSURE_RISK_APPROVAL_STATUS"],"optional":true,"nullable":true,"description":"Optional action to execute after task creation (e.g., ENSURE_ACCESS_USER_REVIEW, ENSURE_RISK_APPROVAL_STATUS)"},"source":{"type":"enum","values":["MANUAL","AUTOMATED"],"optional":true,"nullable":true,"description":"Source of the task. Allowed values: MANUAL, AUTOMATED. Defaults to MANUAL on the DB column when omitted."},"taskSyncEnabled":{"type":"boolean","optional":true,"nullable":true,"d… (truncated) Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__CREATE_CUSTOM_TASK

Creates a custom user-authored policy Tags: policy Payload schema (JSON Schema): {"type":"object","properties":{"orgPk":{"type":"string","format":"uuid","description":"Organization identifier the policy is created for."},"hasCustomMarkdown":{"type":"literal","value":true,"description":"Must be true for CREATE_EDITABLE_CUSTOM_POLICY. Selects the custom-markdown generation path that creates an editable custom policy."},"policyTypeKey":{"type":"string","optional":true,"nullable":true,"description":"Policy type key. For custom policies this mirrors customMarkdownPolicyData.policyName."},"includeInitialDraft":{"type":"boolean","optional":true,"nullable":true,"description":"Whether to create the initial draft PolicyLog from the provided markdown. The custom path always generates the initial draft."},"customMarkdownPolicyData":{"type":"object","properties":{"policyName":{"type":"string","description":"Display name of the custom policy. Used as both policyType and policyName on the created OrgPolicyType."},"customMarkdown":{"type":"string","description":"Markdown body of the initial policy draft. Validated against embedded iframe/script tags; returns errors[].messages=\"Invalid data format, malicious data detected\" if malicious content is detected."},"documentType":{"type":"string","description":"Document type for the custom policy. System values: POLICY, PROCEDURE, ISMS_DOCUMENT, ISMS_RECORD, CUSTOM_DOC, AIMS_DOCUMENT (or an org custom CUSTOM_DOC_* value). Validated via validateDocumentTypeForCustomPolicy; an invalid or conflicting value exits with userInputErrors."},"ownedByPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the user who owns the policy. Provide this OR ownedBySystemGroup."},"ownedBySystemGroup":{"type":"string","optional":true,"nullable":true,"description":"System group that owns the policy (e.g. \"INFOSEC_OFFICER\"). The GraphQL layer defaults this to INFOSEC_OFFICER when both owner fields are omitted."}},"required":["policyName","customMarkdown","documentType"],"description":"Custom policy content and ownership for the editable draft."}},"required":["orgPk","hasCustomMarkdown","customMarkdownPolicyData"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__CREATE_EDITABLE_CUSTOM_POLICY

Defines a new custom field for one or more entity types Tags: custom-field, entity-custom-attribute Payload schema (JSON Schema): {"type":"object","properties":{"name":{"type":"string","description":"Display name of the custom field. Required."},"type":{"type":"enum","values":["SHORT_TEXT","LONG_TEXT","DATE","SINGLE_SELECT","MULTI_SELECT","USER_OR_ROLE","MULTI_USER_OR_ROLE","NUMBER","PERCENTAGE","FORMULA","ATTACHMENT"],"description":"Field type (e.g. SHORT_TEXT, NUMBER, DATE, SINGLE_SELECT, MULTI_SELECT, USER_OR_ROLE, FORMULA). Required."},"scopes":{"type":"array","items":{"type":"enum","values":["Vendor","CustomCheck","OrgRiskItem","OrgManualEvidence","User","OrgCustomAsset","TrustProfileSectionItem","TrustProfileView","OrgPolicyType","DataRightsRequest","Audit","Control","PolicyException","OrgEntityAssessmentTemplate","CustomRawState","FrameworkPrinciple","Finding","SecQue","SecQueQuestion","SecQueKbDocStore","OrgEvidenceRequirement","OrgEvidenceRequest","VendorRequest","AiSystemRequest","AiSystem","AccessRegister","ImpactAssessmentRun","ImpactAssessment"]},"minItems":1,"description":"Entity types the field applies to (e.g. Control, FrameworkPrinciple, Vendor). Required, at least one."},"description":{"type":"string","optional":true,"nullable":true,"description":"Optional description."},"helperText":{"type":"string","optional":true,"nullable":true,"description":"Optional helper text shown in the UI."},"options":{"type":"array","items":{"type":"object","properties":{"value":{"type":"string"},"description":{"type":"string","optional":true,"nullable":true}},"required":["value"]},"optional":true,"nullable":true,"description":"Choices for SINGLE_SELECT / MULTI_SELECT types."},"formula":{"type":"string","optional":true,"nullable":true,"description":"Formula expression. Required when type is FORMULA."},"withUnits":{"type":"boolean","optional":true,"nullable":true,"description":"For NUMBER fields, whether values carry a unit."}},"required":["name","type","scopes"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__CREATE_ENTITY_CUSTOM_ATTRIBUTE

Creates an assigned evidence request and notifies participants Tags: evidence-request, audit, compliance Payload schema (JSON Schema): {"type":"object","properties":{"title":{"type":"string","description":"Title of the evidence request"},"description":{"type":"string","optional":true,"nullable":true,"description":"Detailed description of what evidence is required"},"dueDate":{"type":"string","description":"ISO 8601 due date for the evidence submission (required)"},"assigneePk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the user assigned to submit the evidence"},"assigneeEmployeeGroupPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of an employee group to assign (alternative to assigneePk)"},"reviewerPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the user who will review the submitted evidence"},"taskSyncEnabled":{"type":"boolean","optional":true,"nullable":true,"description":"Whether to sync this request with integrated task management tools"},"entityCustomAttributeValues":{"type":"array","items":{"type":"object","properties":{"entityCustomAttributeDefinitionPk":{"type":"string","format":"uuid"},"value":{"type":"unknown"},"unit":{"type":"string","optional":true,"nullable":true}},"required":["entityCustomAttributeDefinitionPk"]},"optional":true,"nullable":true,"description":"Custom attribute values to set on the evidence request (requires EVIDENCE_REQUEST_CUSTOM_FIELDS feature)"}},"required":["title","dueDate"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__CREATE_ORG_EVIDENCE_REQUEST

Creates multiple evidence requests and notifies participants Tags: evidence-request, audit, compliance, bulk Payload schema (JSON Schema): {"type":"object","properties":{"orgEvidenceRequests":{"type":"array","items":{"type":"object","properties":{"title":{"type":"string","description":"Title of the evidence request"},"description":{"type":"string","optional":true,"nullable":true,"description":"Detailed description of what evidence is required"},"dueDate":{"type":"string","description":"ISO 8601 due date for evidence submission (required)"},"assigneePk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the user to assign"},"assigneeEmployeeGroupPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of an employee group to assign"},"reviewerPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the reviewer"}},"required":["title","dueDate"]},"minItems":1,"description":"List of evidence requests to create"}},"required":["orgEvidenceRequests"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__BULK_CREATE_ORG_EVIDENCE_REQUEST