scf_custom_risk_write
Destructive
Manage custom organization risks: create, update, or delete risk definitions and add, update, or remove linked controls via method-based actions.
Instructions
Manage custom risks (editor+): create, update or delete a risk (destructive); add, update or remove a linked control. Pick with method.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| title | No | Risk title (required, max 100 chars) [create] | New risk title (max 100 chars) [update] Used by: create, update. | |
| method | Yes | create: Create a custom org-defined risk (write — editor+ role). Auto-generates an R-ORG-N code and creates the matching risk assessment record. update: Update a custom risk definition's metadata — title, description, category (write — editor+ role). Only provided fields are applied. delete: Delete a custom risk definition, its assessment record, and every control mapping (destructive write — editor+ role). Irreversible. add_control: Link a control to a custom risk (write — editor+), optionally with the document whose standard it is an exception against. Changing an accepted exception's links clears its approval. update_control: Set or clear the standard's document on a custom risk's control link (write — editor). A changed document clears an accepted exception's approval. remove_control: Unlink a control from a custom risk (write — editor+ role). The control and risk both remain; only the mapping is removed. Unlinking clears an accepted exception's approval. | |
| org_id | Yes | Organization UUID — obtain from scf_list_organizations | |
| scf_id | No | SCF control ID to link (e.g., 'AST-01') — obtain from scf_list_scoped_controls [add_control] | SCF control ID of an existing link — obtain from scf_list_custom_risk_controls [update_control] | SCF control ID to unlink (e.g., 'AST-01') — obtain from scf_list_custom_risk_controls [remove_control] Used by: add_control, update_control, remove_control. | |
| risk_code | No | Custom risk code in R-ORG-N format (e.g., 'R-ORG-1') — obtain from scf_list_custom_risks [update, delete, add_control, remove_control] | Custom risk code in R-ORG-N format — obtain from scf_list_custom_risks [update_control] Used by: update, delete, add_control, update_control, remove_control. | |
| description | No | Risk description (required) [create] | New risk description [update] Used by: create, update. | |
| document_id | No | Organisation document that sets the standard this risk is an exception against — obtain from scf_list_documents (404 if not this org's). A link with a document makes the custom risk a standards exception [add_control] | Organisation document whose standard this risk is an exception against (404 if not this org's), or null to clear. Required: the platform refuses a call without it (422) [update_control] Used by: add_control, update_control. | |
| category_name | No | Category label shown in UI (default 'Custom') [create] | New category label [update] Used by: create, update. | |
| category_color | No | Hex color for the category badge, e.g., '#6b7280' (default '#6b7280') [create] | New hex color for the category badge [update] Used by: create, update. |