POST
/api/v1/compliance/risk-acceptancesRecord an accepted risk
Records a deliberate exception for a control. ORG-ADMIN ONLY and audited — accepting risk on the organisation's behalf is a management act, so the person who could not implement a control cannot sign off their own exception. Rationale has a minimum length enforced both here and by a CHECK constraint.
Authentication
Send Authorization: Bearer YOUR_API_KEY on every request. Generate API keys at /dashboard/settings/api-keys.
Request body required
Example
{
"orgId": "00000000-0000-0000-0000-000000000000",
"projectId": "00000000-0000-0000-0000-000000000000",
"framework": "string",
"requirementId": "string",
"title": "string",
"rationale": "string",
"compensatingControls": "string",
"residualRisk": "low",
"ownerUserId": "00000000-0000-0000-0000-000000000000",
"reviewDueAt": "2026-01-01T00:00:00.000Z"
}Schema
{
"application/json": {
"schema": {
"type": "object",
"properties": {
"orgId": {
"type": "string",
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
},
"projectId": {
"nullable": true,
"type": "string",
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
},
"framework": {
"type": "string",
"pattern": "^[a-z0-9-]{1,64}$"
},
"requirementId": {
"type": "string",
"minLength": 1,
"maxLength": 200
},
"title": {
"type": "string",
"minLength": 3,
"maxLength": 200
},
"rationale": {
"type": "string",
"minLength": 40
},
"compensatingControls": {
"nullable": true,
"type": "string",
"maxLength": 4000
},
"residualRisk": {
"type": "string",
"enum": [
"low",
"medium",
"high",
"critical"
]
},
"ownerUserId": {
"type": "string",
"format": "uuid",
"pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$"
},
"reviewDueAt": {
"type": "string",
"format": "date-time",
"pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
}
},
"required": [
"orgId",
"framework",
"requirementId",
"title",
"rationale",
"residualRisk",
"ownerUserId",
"reviewDueAt"
],
"additionalProperties": false
}
}
}Response
201 example
{
"success": true
}All status codes
200OK.
201Risk acceptance created.
400(no description)
401(no description)
403Forbidden — insufficient role for this operation.
409Conflict — ACTIVE_ACCEPTANCE_EXISTS, CONFLICT.
429(no description)
500Internal Server Error — DB_ERROR.
Code samples
cURL
curl -X POST \
https://evalguard.ai/api/v1/compliance/risk-acceptances \
-H "Authorization: Bearer $EVALGUARD_API_KEY" \
-H "Content-Type: application/json" \
-d '{ "orgId": "00000000-0000-0000-0000-000000000000", "projectId": "00000000-0000-0000-0000-000000000000", "framework": "string", "requirementId": "string", "title": "string", "rationale": "string", "compensatingControls": "string", "residualRisk": "low", "ownerUserId": "00000000-0000-0000-0000-000000000000", "reviewDueAt": "2026-01-01T00:00:00.000Z" }'TypeScript
// The TypeScript SDK (@evalguard/sdk) exposes TYPED methods — runEval,
// getEval, runSecurityScan, checkFirewall, … — not a generic request().
// For an arbitrary endpoint, call it directly:
const res = await fetch("https://evalguard.ai/api/v1/compliance/risk-acceptances", {
method: "POST",
headers: {
Authorization: `Bearer ${process.env.EVALGUARD_API_KEY}`,
"Content-Type": "application/json",
},
body: JSON.stringify({
"orgId": "00000000-0000-0000-0000-000000000000",
"projectId": "00000000-0000-0000-0000-000000000000",
"framework": "string",
"requirementId": "string",
"title": "string",
"rationale": "string",
"compensatingControls": "string",
"residualRisk": "low",
"ownerUserId": "00000000-0000-0000-0000-000000000000",
"reviewDueAt": "2026-01-01T00:00:00.000Z"
}),
});
console.log(res.status, await res.json());Python
# The Python SDK (pip install evalguardai) exposes TYPED methods on
# EvalGuardClient — run_eval, get_eval, … — not a generic request().
# For an arbitrary endpoint, call it directly:
import os
import requests
headers = {"Authorization": f"Bearer {os.environ['EVALGUARD_API_KEY']}"}
headers["Content-Type"] = "application/json"
response = requests.request(
"POST",
"https://evalguard.ai/api/v1/compliance/risk-acceptances",
headers=headers,
json={
"orgId": "00000000-0000-0000-0000-000000000000",
"projectId": "00000000-0000-0000-0000-000000000000",
"framework": "string",
"requirementId": "string",
"title": "string",
"rationale": "string",
"compensatingControls": "string",
"residualRisk": "low",
"ownerUserId": "00000000-0000-0000-0000-000000000000",
"reviewDueAt": "2026-01-01T00:00:00.000Z"
},
)
print(response.status_code, response.json())Go
package main
import (
"context"
"fmt"
"net/http"
"os"
"strings"
)
func main() {
body := strings.NewReader(`{"orgId":"00000000-0000-0000-0000-000000000000","projectId":"00000000-0000-0000-0000-000000000000","framework":"string","requirementId":"string","title":"string","rationale":"string","compensatingControls":"string","residualRisk":"low","ownerUserId":"00000000-0000-0000-0000-000000000000","reviewDueAt":"2026-01-01T00:00:00.000Z"}`)
req, _ := http.NewRequestWithContext(context.Background(), "POST", "https://evalguard.ai/api/v1/compliance/risk-acceptances", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("EVALGUARD_API_KEY"))
req.Header.Set("Content-Type", "application/json")
resp, err := http.DefaultClient.Do(req)
if err != nil { panic(err) }
defer resp.Body.Close()
fmt.Println(resp.Status)
}Errors
400401403409429500