Updating Resources

The Risk & Control Matrix controls and risks are read-only.

Assurance projects cannot be created, renamed, or deleted through the API, but two things about a project can change, each using the update style that fits it:

• The project’s scope documentation (its scopingRationale and the set of attached Workiva files) is updated with PATCH /assuranceProjects/{id}, using a JSON Patch document (RFC 6902, media type application/json-patch+json): an array of operations. This API supports replace on /scopingRationale and /scopingFiles; include an operation only for the field you want to change. /scopingFiles is replace-set (the array you supply becomes the complete attached set, so omitting a file detaches it, and [] detaches all).

• The controls in scope are changed with three behavioral POST operations, because putting a control in or out of scope is an action with downstream side effects (it creates or retires the control’s workpapers), not a simple field edit:

  • POST /assuranceProjects/{id}/scopedControls/addition — add controls by control id.

  • POST /assuranceProjects/{id}/scopedControls/removal — remove scope entries, with a rationale.

  • POST /assuranceProjects/{id}/scopedControls/reAddition — re-add removed entries, with a rationale.

All of these require the grc:write scope; everything else requires only grc:read.

Note

Because this is a preview, new operations can be added without a major version bump — see Versioning.