Sprinto

Marks a batch of framework recommendation changes (FrameworkPolicyUpdate.allChanges entries, identified by requirementPk) as RESOLVED or DETECTED for a given policyLogPk. Use this after successfully applying one or more approved framework recommendations into a policy draft via Update Policy Draft, passing every requirementPk you actually applied with status RESOLVED. Do not mark a change resolved before its content has actually been written into the draft. Tags: policy, compliance, framework Payload schema (JSON Schema): {"type":"object","properties":{"policyLogPk":{"type":"string","format":"uuid","description":"Primary key (policyLogPk) of the policy whose framework recommendation changes are being updated."},"requirementPks":{"type":"array","items":{"type":"string"},"minItems":1,"description":"requirementPk values of the framework recommendation changes to update, e.g. every change you confirmed you applied into the policy draft in this same conversation. Only include a requirementPk here once you have actually created/updated the draft with its recommendedContent."},"status":{"type":"enum","values":["RESOLVED","DETECTED"],"description":"New status for every listed change. Use RESOLVED once the change has genuinely been applied to a policy draft."}},"required":["policyLogPk","requirementPks","status"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__SET_MULTIPLE_FRAMEWORK_POLICY_CHANGE_STATUS

Archives a DPIA, or restores an archived one. Requires admin authorization, the DPIA workflow feature flag, and the PRIVACY + DPIA plan features. Sets the DPIA to the isActive you pass. If it is already in that state nothing is written and data.unchanged is true, so a retry is safe. Only DPIAs are accepted; a QAIP or RoPA pk is rejected as not found. The product asks the user to confirm before archiving, so confirm intent with the user first. Archiving is not destructive — documents, runs and reports are retained, and an archived DPIA can be restored. While archived, a DPIA cannot be updated and no workflow can be run on it. data.impactAssessment.isActive in the response is the resulting state. Tags: dpia Payload schema (JSON Schema): {"type":"object","properties":{"impactAssessmentPk":{"type":"string","format":"uuid","description":"Pk of the DPIA to archive or restore. Resolve it via getImpactAssessments. Only DPIA pks are accepted."},"isActive":{"type":"boolean","description":"Target state: false archives the DPIA, true restores an archived one."}},"required":["impactAssessmentPk","isActive"],"description":"Action data: the DPIA and the state to set it to"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__TOGGLE_IMPACT_ASSESSMENT

Restores an archived manual evidence record back into the active evidence library, along with its version history and existing control/audit-item mappings. Fails if the evidence is not currently archived. Admin only. Tags: evidence, audit Payload schema (JSON Schema): {"type":"object","properties":{"orgManualEvidencePk":{"type":"string","format":"uuid","description":"The archived manual evidence record to restore. Get one from listManualEvidences with isArchived: true."}},"required":["orgManualEvidencePk"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__UN_ARCHIVE_ORG_MANUAL_EVIDENCE

Updates a DPIA's details (name, description, department, owner, approver). Requires admin authorization, the DPIA workflow feature flag, and the PRIVACY + DPIA plan features. Partial update: only the fields you send are changed. Archived DPIAs cannot be updated — the handler returns a NOT_FOUND user input error. Owner and approver are each a user-or-security-role choice; when changing one, send both of its fields together (one set, the other null), matching what the product form does. A security role must be one the org has (getInfosecSystemGroupOfficers) and a user must be active in the org. Only DPIAs are accepted; a QAIP or RoPA pk is rejected as not found. Status and metadata are deliberately not settable here: the product form never sets them, and metadata holds the generated report pointer. Custom-field values are not updated here either — use UPDATE_ENTITY_CUSTOM_ATTRIBUTE_VALUE with scope ImpactAssessment, which is the second call the product form makes alongside this one. Tags: dpia Payload schema (JSON Schema): {"type":"object","properties":{"impactAssessmentPk":{"type":"string","format":"uuid","description":"Pk of the DPIA to update. Resolve it via getImpactAssessments. The DPIA must not be archived."},"name":{"type":"string","optional":true,"description":"New name for the DPIA. Trimmed before saving."},"description":{"type":"string","optional":true,"nullable":true,"description":"New description. Pass null to clear it."},"department":{"type":"string","optional":true,"nullable":true,"description":"New owning department. Stored verbatim — pass it already trimmed, the handler does not trim this field."},"ownerPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"New owner user pk; must be an active user in this org. When changing owner, send both owner fields together (one set, the other null)."},"ownerSystemGroup":{"type":"string","optional":true,"nullable":true,"description":"New owning security role; must be one of the org's security roles from getInfosecSystemGroupOfficers. When changing owner, send both owner fields together (one set, the other null)."},"approverPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"New approver user pk; must be an active user in this org. When changing approver, send both approver fields together (one set, the other null)."},"approverSystemGroup":{"type":"string","optional":true,"nullable":true,"description":"New approving security role; must be one of the org's security roles from getInfosecSystemGroupOfficers. When changing approver, send both approver fields together (one set, the other null)."}},"required":["impactAssessmentPk"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__UPDATE_IMPACT_ASSESSMENT

Updates one record in the organization Manual Evidence library — its title, collection date, mapped controls/audit items, or the evidence file itself. Pass fileUrl (Sprinto downloads and stores the file) or evidenceFileLink (recorded as an external link) to supply a corrected file; either one records a NEW VERSION and preserves the previous one in the history, so this is the action for "the evidence on this control is wrong, here is the right one". To change mappings, pass mappedEntities together with entityModelNameToUpdate — mappedEntities is the complete replacement set for that one entity type, so omitted mappings are removed. When replacing a file, also pass evidenceCollectionDate (or evidenceDate, which it falls back to) so the new version carries the date the evidence was actually collected. Admin only. Tags: evidence, audit Payload schema (JSON Schema): {"type":"object","properties":{"orgManualEvidencePk":{"type":"string","format":"uuid","description":"The manual evidence record to update. Get one from listManualEvidences."},"title":{"type":"string","optional":true,"description":"New human-readable title/name for this evidence. Omit to leave unchanged."},"evidenceDate":{"type":"string","optional":true,"description":"New ISO-8601 date the evidence was collected/effective (e.g. \"2026-06-11\"). Omit to leave unchanged."},"evidenceCollectionDate":{"type":"string","optional":true,"description":"ISO-8601 collection date recorded on the NEW version created by fileUrl/evidenceFileLink. Defaults to evidenceDate when omitted. This date decides whether audit item mappings on AUTO_UPDATE_VERSION advance to the new version, so when replacing a file on an evidence inside an open audit window, pass this (or evidenceDate) rather than relying on the previous value."},"fileUrl":{"type":"string","format":"url","optional":true,"nullable":true,"description":"Public https URL of a REPLACEMENT evidence file. Sprinto downloads it and stores a copy, then records it as a NEW VERSION of this evidence — earlier versions stay in the history rather than being overwritten. Use this to correct evidence that was uploaded against the wrong control or was simply wrong."},"evidenceFileLink":{"type":"string","format":"url","optional":true,"nullable":true,"description":"Replacement external https URL, recorded as a LINK. Sprinto stores the URL as-is and does not fetch or re-host it. Also cuts a new version. Use fileUrl instead when the evidence is a file that should live in Sprinto."},"evidenceVersionNote":{"type":"string","optional":true,"nullable":true,"description":"Note explaining what changed, shown on the new version in the history."},"mappedEntities":{"type":"array","items":{"type":"object","properties":{"entityModelName":{"type":"enum","values":["Control","AuditItem"],"description":"Type of entity to map this evidence to."},"entityPk":{"type":"string","format":"uuid","description":"Primary key (UUID) of the entity to map. Resolve via search_sprinto."}},"required":["entityModelName","entityPk"]},"optional":true,"nullable":true,"description":"The COMPLETE set of entities of type entityModelNameToUpdate that this evidence should be mapped to — this REPLACES the existing mappings for that type, so mappings you omit are removed. Ignored unless entityModelNameToUpdate is also supplied."},"entityModelNameToUpdate":{"type":"enum","values":["Control","AuditItem"],"optional":true,"nullable":true,"description":"Which mapping type mappedEntities applies to. Omit to leave all existing mappings untouched. Only mappings of this one type are reconciled — e.g. Control leaves AuditItem mappings alone."}},"required":["orgManualEvidencePk"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__UPDATE_ORG_MANUAL_EVIDENCE

Enables or disables a system (built-in) automated check for the requesting org. Required: monitorType and isDisabled. Tags: check, monitor Payload schema (JSON Schema): {"type":"object","properties":{"monitorType":{"type":"string","description":"The automated (system) check monitorType to enable/disable. Required."},"isDisabled":{"type":"boolean","description":"Target state: true disables the check, false enables it. Required."}},"required":["monitorType","isDisabled"],"description":"Action-specific data payload."} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__UPDATE_ORG_MONITOR_CONFIG_ACTIVATION_STATE

Trust Center: set the NDA status for an access-request batch. Use ndaStatus to toggle the NDA requirement (NOT_REQUIRED / REQUESTED) or to record a signature: ACCEPTED (signed via a Sprinto NDA model) or ACCEPTED_EXTERNALLY (signed outside Sprinto; ndaSigningTimestamp is required and the signed document can be attached by passing its public https URL in fileUrl, which is fetched and recorded on the NDA status log — this action does not itself email the visitor). A REQUESTED status may trigger the configured NDA provider's signing request. Appends an NDA status-log entry for the batch. Tags: trust-center, access-request, nda Payload schema (JSON Schema): {"type":"object","properties":{"trustProfilePk":{"type":"string","format":"uuid","description":"Primary key of the trust profile the access request belongs to."},"accessRequestPk":{"type":"string","format":"uuid","description":"Primary key of the access-request batch (TrustProfileSectionItemAccessBatch) to update."},"ndaStatus":{"type":"enum","values":["NOT_REQUIRED","REQUESTED","ACCEPTED","ACCEPTED_EXTERNALLY"],"nullable":true,"optional":true,"description":"NDA status to record: NOT_REQUIRED (no NDA needed), REQUESTED (require a signature), ACCEPTED (signed via a Sprinto NDA model), or ACCEPTED_EXTERNALLY (signed outside Sprinto; ndaSigningTimestamp is required and the signed document can be attached via fileUrl)."},"signedNdaModel":{"type":"string","nullable":true,"optional":true,"description":"Model name of the signed NDA record. Used when ndaStatus is ACCEPTED."},"signedNdaModelPk":{"type":"string","format":"uuid","nullable":true,"optional":true,"description":"Primary key of the signed NDA record. Used when ndaStatus is ACCEPTED."},"ndaSigningTimestamp":{"type":"string","nullable":true,"optional":true,"description":"ISO 8601 timestamp of when the NDA was signed. REQUIRED for ACCEPTED_EXTERNALLY (the document is optional but the sign date is not) and must not be in the future. For other statuses it defaults to now when omitted."},"fileUrl":{"type":"string","format":"url","nullable":true,"optional":true,"description":"Public, directly-downloadable https URL of the file (may be a pre-authed/presigned link). Sprinto fetches and stores it; <=10MB; allowed types: .pdf. Attaches the externally-signed NDA document: the URL is fetched, stored, and recorded as externalNdaS3Key on the NDA status log. This is how an agent supplies the signed PDF for ACCEPTED_EXTERNALLY (the document is optional; only ndaSigningTimestamp is required). It is not automatically emailed to the visitor from this action."},"isNdaSigned":{"type":"boolean","nullable":true,"optional":true,"description":"Deprecated — use ndaStatus. Only applied when a batch status change is also supplied."}},"required":["trustProfilePk","accessRequestPk"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__UPDATE_TRUST_PROFILE_SECTION_ITEM_ACCESS_BATCH_NDA

Trust Center: allow (GRANTED) or deny (REJECTED) a SINGLE access-request item. Always provide a rejectionReason when denying so the visitor is told why. Granting notifies the visitor and (for granted items) triggers watermark preparation and any configured NDA signing request; an omitted accessExpiresAt falls back to the trust profile default expiry. To allow-all / deny-all a request, enumerate its pending items with trustProfileSectionItemAccessByBatchPk and call this action once per item. Requires Trust Center admin authorization. Tags: trust-center, access-request Payload schema (JSON Schema): {"type":"object","properties":{"trustProfileSectionItemAccessPk":{"type":"string","format":"uuid","description":"Primary key of the TrustProfileSectionItemAccess row (a single requested item) to allow or deny."},"status":{"type":"enum","values":["GRANTED","REJECTED"],"description":"GRANTED to allow the item, REJECTED to deny it."},"accessExpiresAt":{"type":"string","format":"datetime","nullable":true,"optional":true,"description":"ISO 8601 expiry for a GRANTED item. Optional: when omitted on a grant, the trust profile config default access expiry (if enabled) is applied. Ignored for REJECTED."},"rejectionReason":{"type":"string","nullable":true,"optional":true,"description":"Reason shown to the visitor when denying. Required when status is REJECTED."}},"required":["trustProfileSectionItemAccessPk","status"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__UPDATE_TRUST_PROFILE_SECTION_ITEM_ACCESS_V2

Adds a file, generated document, or existing policy file to an audit Tags: audit, document, upload, compliance, soc2, iso27001 Payload schema (JSON Schema): {"type":"object","properties":{"auditPk":{"type":"string","format":"uuid","description":"Primary key of the audit to attach this document to. Use query__listAudits to find the pk."},"documentType":{"type":"enum","values":["SYSTEM_DESCRIPTION","CONTROL_MAPPING_SHEET","STATEMENT_OF_APPLICABILITY","OTHERS"],"description":"Type of audit document. Allowed values: SYSTEM_DESCRIPTION, CONTROL_MAPPING_SHEET, STATEMENT_OF_APPLICABILITY, OTHERS. SYSTEM_DESCRIPTION is typical for SOC 2 audits. CONTROL_MAPPING_SHEET documents control coverage. STATEMENT_OF_APPLICABILITY is used for ISO 27001."},"documentDescription":{"type":"string","optional":true,"nullable":true,"description":"Optional free-text description of the document."},"documentFileUrl":{"type":"string","format":"url","optional":true,"nullable":true,"description":"Public URL of the document file to upload. Public, directly-downloadable https URL of the file (may be a pre-authed/presigned link). Sprinto fetches and stores it; <=10MB; allowed types: .jpeg, .jpg, .png, .gif, .tiff, .bmp, .txt, .doc, .docx, .odt, .pdf, .zip, .csv, .xls, .xlsx, .msg, .json. Provide either documentFileUrl OR content (HTML string), not both. documentFileUrl takes precedence."},"content":{"type":"string","optional":true,"nullable":true,"description":"HTML content to convert to a DOCX document. Used when no documentFileUrl is provided. Converted to DOCX server-side and stored in S3. Mutually exclusive with documentFileUrl."},"policyFileS3Key":{"type":"string","optional":true,"nullable":true,"description":"S3 key of an existing policy file to use as the document source. Takes precedence over content when provided."}},"required":["auditPk","documentType"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__CREATE_AUDIT_DOCUMENT

Bulk creates multiple organization risk items from templates Tags: risk Payload schema (JSON Schema): {"type":"object","properties":{"riskItemTemplatePksBySourceType":{"type":"array","items":{"type":"object","properties":{"riskItemTemplatePk":{"type":"string","format":"uuid","description":"Unique identifier for the risk item template"},"sourceType":{"type":"string","description":"Source type for risk categorization (e.g., PROCESS_BASED, ASSET_BASED)"}},"required":["riskItemTemplatePk","sourceType"]},"optional":true,"description":"Array of risk item templates with their source types for multi-source tracking"},"riskItemTemplatePks":{"type":"array","items":{"type":"string","format":"uuid"},"optional":true,"description":"Legacy array of risk item template PKs (used when source types are not specified)"},"zonePk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Zone identifier to which the risk items belong (null for organization-wide risks)"},"orgRiskRegisterPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Risk register identifier (defaults to organization's default register if not provided)"},"riskOwnerSystemGroup":{"type":"string","optional":true,"nullable":true,"description":"System group for risk ownership (defaults to INFOSEC_OFFICER if not specified)"}},"required":[],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_BULK_ORG_RISK_ITEMS

Maps a control to an org framework Tags: control Payload schema (JSON Schema): {"type":"object","properties":{"controlPk":{"type":"string","format":"uuid","description":"Primary key (UUID) of the Control to map. Must belong to the user's org. Resolve via search_sprinto (type:'entity', control)."},"orgFrameworkPk":{"type":"string","format":"uuid","description":"Primary key (UUID) of the OrgFramework (the org's enabled instance of a framework) to map the control to. Resolve via search_sprinto (type:'entity', orgFramework)."}},"required":["controlPk","orgFrameworkPk"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_CONTROL_FRAMEWORK_MAP

Adds a single control as an audit requirement to a custom audit Tags: audit Payload schema (JSON Schema): {"type":"object","properties":{"auditPk":{"type":"string","format":"uuid","description":"Primary key of the audit to add the control to. The audit must not be in COMPLETED or ARCHIVED status (returns userInputErrors[].messages=[\"AuditCompletedOrArchived\"] otherwise). For the AI workflow, set auditType to BASED_ON_CONTROLS via UPDATE_AUDIT before calling this action — note the handler itself does NOT validate auditType, only status."},"controlPk":{"type":"string","format":"uuid","description":"Primary key of the control to add. The control must belong to the same organization as the requester and the audit (returns userInputErrors[].messages=[\"OrgDoesNotMatch\"] otherwise). The control must not already be mapped to this audit (returns userInputErrors[].messages=[\"ControlAlreadyPresent\"] otherwise). Call this action once per control you want to add."}},"required":["auditPk","controlPk"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_CONTROL_TO_AUDIT

Creates a single workflow (custom) check Tags: workflow-check, custom-check Payload schema (JSON Schema): {"type":"object","properties":{"checkType":{"type":"string","description":"Workflow (custom) check type. A CustomCheckTypes enum value (e.g. \"RISK_ASSESSMENT\", \"INTERNAL_AUDIT\", \"VULNERABILITY_SCANNING_AND_RESOLUTION\"). Required. For org-defined checks use \"CUSTOM_USER_DEFINED\"."},"title":{"type":"string","description":"Check title. Required, non-empty (DB column is NOT NULL)."},"description":{"type":"string","description":"Check description. Required, non-empty (DB column is NOT NULL)."},"uploadInstructions":{"type":"string","description":"Instructions shown to the assignee for uploading evidence. Required by the mutation contract."},"ownedByPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"User PK responsible for uploading evidence. Provide either ownedByPk OR ownedBySystemGroup; at least one is required (handler returns userInputErrors[].messages=[\"MissingOwner\"] otherwise). When set, the user is runtime-validated for the required system-group membership."},"ownedBySystemGroup":{"type":"string","optional":true,"nullable":true,"description":"System group (SystemGroupName) responsible for uploading evidence. Provide either this OR ownedByPk; at least one is required."},"reviewByPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"User PK who reviews uploaded evidence. Must differ from ownedByPk, else rejected with [\"SameAssigneeReviewer\"]."},"reviewBySystemGroup":{"type":"string","optional":true,"nullable":true,"description":"System group reviewing evidence. Must differ from ownedBySystemGroup, else rejected with [\"SameAssigneeReviewer\"]."},"repeatFreqValue":{"type":"number","description":"Repeat frequency value (integer). Required. Paired with repeatFreqUnit."},"repeatFreqUnit":{"type":"enum","values":["weeks","months"],"description":"Repeat frequency unit. Required. The custom-check edit UI only supports weeks/months."},"isActive":{"type":"boolean","description":"Whether the check is active on creation. Required."},"activationDate":{"type":"string","optional":true,"nullable":true,"description":"Activation date (ISO 8601 datetime). When WORKFLOW_CHECKS_2_ENABLED (or WF_CHECK_EVIDENCE_DATE_ENHANCEMENT + windowed uploads) is on, past dates from the previous year onward are allowed; earlier dates are rejected with [\"InvalidActivationDate\"]. Otherwise the date is normalized."},"area":{"type":"string","optional":true,"nullable":true,"description":"Optional area/category label for the check."},"zonePks":{"type":"array","items":{"type":"string","format":"uuid"},"optional":true,"nullable":true,"description":"Zone PKs to scope the check to."},"entityCustomAttributeValues":{"type":"array","items":{"type":"unknown"},"optional":true,"nullable":true,"description":"Custom attribute values (EntityCustomAttributeValueInput) to set on the new check."},"uploadReminderWindowOffset":{"type":"number","optional":true,"nullable":true,"description":"Reminder window offset. Validated only under WORKFLOW_CHECKS_2_ENABLED. All three reminder fields (uploadReminderWindowOffset, escalationReminderWindowOffset, nonComplianceOffset) must be supplied together or rejected with [\"All reminder fields ... must be provided together.\"]."},"escalationReminderWindowOffset":{"type":"number","optional":true,"nullable":true,"description":"Escalation reminder offset. See uploadReminderWindowOffset for the all-or-none rule (WORKFLOW_CHECKS_2_ENABLED only)."},"nonComplianceOffset":{"type":"number","optional":true,"nullable":true,"description":"Non-compliance offset. See uploadReminderWindowOffset for the all-or-none rule (WORKFLOW_CHECKS_2_ENABLED only)."},"taskLifecycleConfig":{"type":"object","properties":{"dueStart":{"type":"object","properties":{"days":{"type":"number","description":"Whole days from the anchor. Never negative — direction is carried by the anchor."},"anchor":{"type":"enum","values":["BEFORE_PERIOD_START","AFTER_PERIOD_START","BEFORE_PERIOD_END","AFTER_PERIOD_END"],"description":"Which end of the evidence period the day count is measured from. Anchors must not move backwards across dueStart -> dueEnd -> criticalEnd."}},"required":["days","anchor"],"description":"When the task becomes DUE."},"dueEnd":{"type":"object","properties":{"days":{"type":"number","description":"Whole days from the anchor. Never negative — direction is carried by the anchor."},"anchor":{"type":"enum","values":["BEFORE_PERIOD_START","AFTER_PERIOD_START","BEFORE_PERIOD_END","AFTER_PERIOD_END"],"description":"Which end of the evidence period the day count is measured from. Anchors must not move backwards across dueStart -> dueEnd -> criticalEnd."}},"required":["days","anchor"],"description":"When the task becomes CRITICAL."},"criticalEnd":{"type":"object","properties":{"days":{"type":"number","description":"Whole days from the anchor. Never negative — direction is carried by the anchor."},"anchor":{"type":"enum","values":["BEFORE_PERIOD_START","AFTER_PERIOD_START","BEFORE_PERIOD_END","AFTER_PERIOD_END"],"description":"Which end of the evidence period the day count is measured from. Anchors must not move backwards across dueStart -> dueEnd -> criticalEnd."}},"required":["days","anchor"],"description":"When the task becomes FAILING."}},"required":["dueStart","dueEnd","criticalEnd"],"description":"Anchored task lifecycle. Requires WF_CHECK_ANCHORED_TASK_LIFECYCLE_V2; silently ignored otherwise. When accepted it is stored AND projected onto uploadReminderWindowOffset / escalationReminderWindowOffset / nonComplianceOffset, overwriting any values supplied alongside it.","optional":true,"nullable":true}},"required":["checkType","title","description","uploadInstructions","repeatFreqValue","repeatFreqUnit","isActive"],"description":"Action-specific data payload."} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_CUSTOM_CHECK

Creates a new custom organizational risk item Tags: risk, risk-assessment, compliance, policy, vendor, staff, asset Payload schema (JSON Schema): {"type":"object","properties":{"orgRiskTypePk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the risk type (required for asset-based risk assessment)"},"name":{"type":"string","optional":true,"nullable":true,"description":"Name of the risk (required for process-based risk assessment)"},"description":{"type":"string","optional":true,"nullable":true,"description":"Description of the risk (required for process-based risk assessment)"},"category":{"type":"string","description":"REQUIRED. Category label string for this risk (e.g. \"Access Control\", \"Unauthorized Technology\"). You MUST provide this — do not omit or pass null. To get valid category values for the org, call the getOrgRiskCategories query first and use the name field from the result. Set isCustomCategory=true only if using a custom string not returned by that query."},"isCustomCategory":{"type":"boolean","optional":true,"nullable":true,"description":"Set to true when the category value is a custom string not from the predefined list"},"categories":{"type":"array","items":{"type":"string","format":"uuid"},"optional":true,"nullable":true,"description":"Array of additional category PKs (UUIDs) to associate with this risk. These are OrgRiskCategory PKs, not label strings."},"orgAssetGroupPk":{"type":"string","format":"uuid","description":"REQUIRED. Primary key of the asset group this risk belongs to. You MUST provide this — do not omit or pass null. For asset-based risks, use the relevant asset group pk. For process-based risks with no specific asset, first call the OrgAssetGroup query to find the group named \"Others\" for this org, then use its pk here."},"riskOwnerPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the user who owns this risk"},"riskOwnerSystemGroup":{"type":"string","optional":true,"nullable":true,"description":"System group that owns this risk"},"profileAttributes":{"type":"record","valueType":{"type":"unknown"},"optional":true,"nullable":true,"description":"Additional org-specific profile attributes (e.g. { applicableCIA: \"Confidentiality\" }). Pass an empty object {} if not applicable."},"mappedControls":{"type":"array","items":{"type":"string","format":"uuid"},"optional":true,"nullable":true,"description":"Array of control primary keys mapped to this risk"},"orgRiskItemEvaluationCriteria":{"type":"array","items":{"type":"object","properties":{"evaluationType":{"type":"enum","values":["PRE_SMB","SMB_DEFAULT"],"description":"Scoring evaluation type for this criterion. Must match the top-level evaluationType. Valid values: SMB_DEFAULT, PRE_SMB."},"riskEvaluationCriteriaKey":{"type":"enum","values":["PRE_LIKELIHOOD","PRE_IMPACT","INHERENT_RISK","POST_LIKELIHOOD","POST_IMPACT","RESIDUAL_RISK"],"description":"Which criterion this entry represents"},"riskEvaluationCriteriaValue":{"type":"union","options":[{"type":"string"},{"type":"number"}],"nullable":true,"description":"Value for this criterion (stored as string in DB); pass a number or numeric string, or null if not yet scored"}},"required":["evaluationType","riskEvaluationCriteriaKey","riskEvaluationCriteriaValue"]},"optional":true,"nullable":true,"description":"Scoring criteria for this risk. Pass all 6 keys for SMB_DEFAULT: PRE_LIKELIHOOD, PRE_IMPACT, INHERENT_RISK, POST_LIKELIHOOD, POST_IMPACT, RESIDUAL_RISK — each with evaluationType matching the top-level evaluationType and riskEvaluationCriteriaValue set to null if not yet scored. Omit entirely if not scoring."},"evaluationNotes":{"type":"string","optional":true,"nullable":true,"description":"Notes about the risk evaluation"},"evaluationType":{"type":"enum","values":["PRE_SMB","SMB_DEFAULT"],"description":"REQUIRED. Scoring method for this risk. You MUST provide this — do not omit or pass null. Default to \"SMB_DEFAULT\" (standard likelihood × impact) unless you have confirmed the org uses \"PRE_SMB\". Must match the evaluationType in each orgRisk… (truncated) Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_CUSTOM_ORG_RISK_ITEM

Adds a single criterion (principle) to a custom framework Tags: framework Payload schema (JSON Schema): {"type":"object","properties":{"frameworkPk":{"type":"string","format":"uuid","description":"Primary key of the custom framework to add the criterion (principle) to. Required."},"code":{"type":"string","optional":true,"nullable":true,"description":"Criterion code/identifier. Optional (column is nullable)."},"statement":{"type":"string","description":"Criterion statement text. Required, non-empty (handler rejects empty with key=\"statement\", messages=[\"InvalidStatement\"])."},"order":{"type":"number","optional":true,"nullable":true,"description":"Display order of the criterion within the framework. Optional integer."}},"required":["frameworkPk","statement"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_FRAMEWORK_PRINCIPLE

Records a manually-collected background check report for a user Tags: evidence, people, background-check Payload schema (JSON Schema): {"type":"object","properties":{"forUserPk":{"type":"string","format":"uuid","description":"Primary key (UUID) of the user this background check is for. Must belong to the requester's org. Resolve via search_sprinto."},"fileUrl":{"type":"string","format":"url","description":"Public, directly-downloadable https URL of the file (may be a pre-authed/presigned link). Sprinto fetches and stores it; <=10MB; allowed types: .jpeg, .jpg, .png, .gif, .tiff, .bmp, .txt, .doc, .docx, .odt, .pdf, .zip, .xls, .xlsx."},"completedOn":{"type":"string","description":"ISO-8601 date the background check was completed (e.g. \"2026-06-01T18:30:00.000Z\")."}},"required":["forUserPk","fileUrl","completedOn"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_MANUAL_BG_CHECK

Uploads manual evidence for a compliance check Tags: evidence, manual-evidence, compliance, check, upload, audit Payload schema (JSON Schema): {"type":"object","properties":{"evidencePeriodType":{"type":"enum","values":["Interval","Snapshot"],"description":"How the evidence period is expressed. \"Snapshot\" = point-in-time (requires evidenceAsOf). \"Interval\" = a date range (requires evidenceIntervalFrom and evidenceIntervalTo)."},"fileUrls":{"type":"array","items":{"type":"string","format":"url"},"minItems":1,"description":"Array of file URLs for the evidence. Public, directly-downloadable https URL of the file (may be a pre-authed/presigned link). Sprinto fetches and stores it; <=10MB; allowed types: .jpeg, .jpg, .png, .gif, .tiff, .bmp, .txt, .doc, .docx, .xls, .xlsx, .csv, .pdf, .zip, .tar, .odt, .ods, .msg, .json. At least one URL required."},"evidenceAsOf":{"type":"string","optional":true,"nullable":true,"description":"ISO 8601 date when the evidence was captured. Required when evidencePeriodType is Snapshot."},"evidenceIntervalFrom":{"type":"string","optional":true,"nullable":true,"description":"ISO 8601 start date of the evidence interval. Required when evidencePeriodType is Interval."},"evidenceIntervalTo":{"type":"string","optional":true,"nullable":true,"description":"ISO 8601 end date of the evidence interval. Required when evidencePeriodType is Interval. Must be after evidenceIntervalFrom."},"manualEvidenceType":{"type":"string","optional":true,"nullable":true,"description":"Type identifier for the manual evidence check (e.g. 'backgroundCheckPolicy'). Use query__listManualEvidences to see available types."}},"required":["evidencePeriodType","fileUrls"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_MANUAL_EVIDENCE

Attaches custom evidence files to a custom check monitor Tags: evidence, monitor, custom-check Payload schema (JSON Schema): {"type":"object","properties":{"monitorPk":{"type":"string","format":"uuid","description":"Primary key (UUID) of the monitor (check instance) to attach custom evidence to. Resolve via search_sprinto."},"fileUrls":{"type":"array","items":{"type":"string","format":"url"},"minItems":1,"maxItems":20,"description":"Public, directly-downloadable https URL of the file (may be a pre-authed/presigned link). Sprinto fetches and stores it; <=10MB; allowed types: .jpeg, .jpg, .png, .gif, .tiff, .bmp, .svg, .doc, .docx, .xls, .xlsx, .pdf, .zip, .tar, .odt, .ods, .mp4, .mov, .wmv, .json, .csv, .txt, .msg."},"expiresOn":{"type":"string","optional":true,"nullable":true,"description":"Optional ISO-8601 date when this evidence expires (e.g. \"2026-12-31\")."}},"required":["monitorPk","fileUrls"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_MONITOR_CUSTOM_EVIDENCE

Marks an already-failing monitor as a special case Tags: monitor Payload schema (JSON Schema): {"type":"object","properties":{"monitorPk":{"type":"string","format":"uuid","description":"Primary key of the monitor to add an exception (special case) for. The monitor must already be failing."},"reason":{"type":"enum","values":["ADDITIONAL_TIME_NEEDED","EMPLOYEE_ON_LEAVE","EMPLOYEE_OWNED_DEVICE","NO_CUSTOMER_DATA","NO_DEVICE_ASSIGNED_TO_EMPLOYEE","NO_SENSITIVE_DATA","OLD_DEVICE","NON_PRODUCTION_SYSTEM","OTHER","EMPLOYEE_IS_CONTRACTOR_INTERN_PART_TIMER","EMPLOYEE_DOES_NOT_HAVE_ACCESS_TO_CUSTOMER_DATA","EMPLOYEE_DEVICE_REQUIRED_AN_OS_UPGRADE","EMPLOYEE_ACCOUNT_IS_ENABLED_THROUGH_AN_MDM_TOOL","EMPLOYEE_HAS_LEFT_THE_ORGANIZATION","EMPLOYEE_BACKGROUND_CHECK_IS_IN_PROGRESS","EMPLOYEE_REGION_DOES_NOT_SUPPORT_BACKGROUND_CHECKS","EMPLOYEE_HAS_A_GROUP_EMAIL_ID_OR_SERVICE_EMAIL_ID","EMPLOYEE_CURRENT_OS_IS_STILL_SUPPORTED","EMPLOYEE_DOES_NOT_HAVE_ACCESS_TO_PRODUCTION_SERVERS","EMPLOYEE_USES_MAC","EMPLOYEE_DOCUMENTATION_IS_DELAYED","EMPLOYEE_MFA_API_IS_UNAVAILABLE","EMPLOYEE_MFA_IS_ALREADY_ENABLED_THROUGH_SSO","CAS_TBAC_MIGRATION","ACCESS_VALIDATED_BY_TICKET","TOLERABLE_RISK","INACURATE_ALERT","UNUSED_CODE","DEVICE_NOT_IN_SCOPE","PREAPPROVED_ON_EXTERNAL_INTEGRATION","PREAPPROVED_INTERNAL","BRANCH_PROTECTION_RULES_NOT_YET_APPLIED","EMERGENCY_FIX"],"description":"Exception reason code. The reason must be one allowed for the monitor type (monitorExceptionReasonsMap) OR be OTHER with non-empty additionalNotes; otherwise the handler returns userInput error key \"reason\" message \"InvalidExceptionReason\". Examples: ADDITIONAL_TIME_NEEDED, NO_CUSTOMER_DATA, EMPLOYEE_ON_LEAVE, NO_DEVICE_ASSIGNED_TO_EMPLOYEE, OTHER."},"customReason":{"type":"string","optional":true,"nullable":true,"description":"Optional free-text custom reason persisted for audit. Note: this is NOT used by the OTHER-reason validation (that checks additionalNotes), and the product UI does not send it."},"additionalNotes":{"type":"string","optional":true,"nullable":true,"description":"Required (non-empty) when reason is OTHER; for other reasons it is optional justification persisted on the exception."},"expiresOn":{"type":"string","format":"datetime","optional":true,"nullable":true,"description":"ISO 8601 datetime when the exception expires. Omit or null to make the exception valid forever (isValidForever is derived as expiresOn == null; isValidForever sent in input is ignored). Must be today or later; an expiry already in the past is rejected with \"InvalidExpiry\"."},"documentS3Key":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"S3 keys of supporting documents for the exception. Each key is checked for existence; if any key is invalid the handler returns userInput error key \"rawStateFiles\" message \"InvalidFile\"."}},"required":["monitorPk","reason"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_MONITOR_EXCEPTION

Creates a new custom policy for the org Tags: policy, compliance, governance Payload schema (JSON Schema): {"type":"object","properties":{"policyName":{"type":"string","description":"Name of the policy to be created. Must be non-empty: when policyType is omitted it is derived from this name, and an empty name resolves to an empty policyType which the handler rejects with key=\"policyName\" messages=[\"PolicyTypeExists\"]."},"uploadedPolicyLink":{"type":"string","optional":true,"nullable":true,"description":"S3 key for the uploaded policy document"},"ownedByPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the user who owns this policy"},"ownedBySystemGroup":{"type":"enum","values":["INFOSEC_OFFICER","PRIVACY_OFFICER","PEOPLE_OPERATIONS","INFRA_OPERATIONS","SMT","COMPLIANCE_PROGRAM_MANAGER","EXCEPTION_ANALYST"],"optional":true,"nullable":true,"description":"System group that owns this policy. Valid values: \"INFOSEC_OFFICER\" (security/compliance policies), \"PRIVACY_OFFICER\" (privacy/data protection policies), \"PEOPLE_OPERATIONS\" (HR policies), \"INFRA_OPERATIONS\" (infrastructure policies), \"SMT\" (executive/governance policies), \"COMPLIANCE_PROGRAM_MANAGER\" (compliance program policies), \"EXCEPTION_ANALYST\" (exception policies). Either ownedByPk or ownedBySystemGroup MUST be provided — unlike the UI/GraphQL path, this action does NOT auto-default the owner, and omitting both fails with key=\"\" messages=[\"MissingOwner\"]."},"documentType":{"type":"enum","values":["POLICY","PROCEDURE","ISMS_DOCUMENT","ISMS_RECORD","CUSTOM_DOC","AIMS_DOCUMENT","QMS_DOCUMENT"],"description":"Type of document. Valid values: \"POLICY\" for policy documents, \"PROCEDURE\" for procedure documents, \"ISMS_DOCUMENT\" for ISMS documents, \"ISMS_RECORD\" for ISMS records, \"CUSTOM_DOC\" for custom documents, \"AIMS_DOCUMENT\" for AIMS documents."},"policyType":{"type":"enum","values":["AcceptableUsage","AccessControl","BreachNotification","DataBreachNotificationPolicy","BusinessContinuity","ChangeManagement","CoC","Confidentiality","DataBackup","DataClassification","DataDeletion","DataProtection","DisasterRecovery","Encryption","EndpointSecurity","HrSecurity","IncidentManagement","Infosec","MediaDisposal","Password","PhysicalSecurity","RiskManagement","VendorManagement","VulManagement","CardHolderDataManagement","NetworkSetup","CloudSecurityPolicy","PrivacyDesign","AssetManagement","Compliance","OperationSecurity","OrganizationOfInformationSecurity","SDLC","AccessControlProcedure","AssetManagementProcedure","ComplianceProcedure","HrSecurityProcedure","IncidentManagementProcedure","NetworkSecurityProcedure","PhysicalAndEnvironmentalSecurityProcedure","SdlcProcedure","OperationsSecurityProcedure","VendorManagementProcedure","BusinessContinuityPlanProcedure","PhiDataBreachNotificationProcedure","PersonalDataBreachNotificationProcedure","AISDLCPolicyAndProcedure","AIAcceptableUsagePolicy","AIDataManagementPolicyAndProcedure","AISystemImpactAssessmentPolicy","AISystemImpactAssessmentProcedure","AIMSCommunicationPlan","AISecurityPolicy","AuditLogManagementProcedure","ConfigurationManagementPolicy","ConfigurationManagementProcedure","ControlledMaintenancePolicy","QualityPolicy","ResourceManagementPolicy","IsmsScopeDocument","IsmsManual","IsmsInfosec","PciCharter","SystemDescription","AIRolesAndResponsibilities","AIMSManual","AIMSScopeDocument","AILifeCyclePhase","QMSManual","QMSScopeDocument"],"optional":true,"nullable":true,"description":"Type of policy from the predefined list (auto-generated from policy name for user-defined policies)"},"externalPolicyPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of external policy if linking to one"},"policyProviderPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of policy provider if using external provider"}},"required":["policyName","documentType"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_POLICY

Creates a policy exception and notifies the assigned analyst Tags: policy, exception, compliance, risk-acceptance Payload schema (JSON Schema): {"type":"object","properties":{"title":{"type":"string","description":"Title of the policy exception. Required, non-empty."},"description":{"type":"string","description":"Description explaining why an exception to the policy is needed. Required, non-empty."},"businessJustification":{"type":"string","optional":true,"nullable":true,"description":"Business justification for the exception. Explains the risk accepted or the compensating control."},"remidiationUserPk":{"type":"string","format":"uuid","description":"Primary key of the user responsible for remediating or owning the exception. Required. Use query__getActiveStaffPaginated to look up the user pk."},"reportedByPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the user reporting the exception. Defaults to the acting user. Only admins / InfoSec-role users may set this to another user (file on behalf of). Use query__getActiveStaffPaginated to look up the user pk."},"documentUploadS3Keys":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"Optional S3 keys for supporting documents uploaded with the exception. Each key must be a valid S3 key for a previously uploaded file. Omit if no supporting documents."},"entityCustomAttributeValues":{"type":"array","items":{"type":"object","properties":{"attributeDefinitionPk":{"type":"string","format":"uuid"},"value":{"type":"unknown"}},"required":["attributeDefinitionPk"]},"optional":true,"nullable":true,"description":"Optional custom attribute values for the exception entity."}},"required":["title","description","remidiationUserPk"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_POLICY_EXCEPTION

Creates an automated check that runs over a chosen entity model Tags: check, monitor Payload schema (JSON Schema): {"type":"object","properties":{"title":{"type":"string","description":"Title of the automated check. Required, non-empty (the underlying title column is non-null)."},"description":{"type":"string","optional":true,"nullable":true,"description":"Description of what the check verifies."},"fixInstruction":{"type":"string","optional":true,"nullable":true,"description":"Remediation guidance shown when the check fails."},"entityModelName":{"type":"string","description":"Sequelize model name of the entity the check runs over (e.g. \"Vendor\"). Required, non-empty."},"entityFilter":{"type":"record","valueType":{"type":"unknown"},"optional":true,"nullable":true,"description":"JSON filter to narrow the check to specific entities."},"ownedByPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the owning user. Provide this or ownedBySystemGroup."},"ownedBySystemGroup":{"type":"string","optional":true,"nullable":true,"description":"System group that owns the check (e.g. \"IT_ADMIN\"). Provide this or ownedByPk."},"evalRule":{"type":"record","valueType":{"type":"unknown"},"optional":true,"nullable":true,"description":"JSON rule defining the failure condition evaluated per entity."},"filterRule":{"type":"record","valueType":{"type":"unknown"},"optional":true,"nullable":true,"description":"JSON rule that pre-filters entities before evaluation."},"escalatedToSystemGroups":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"System groups the failing todo escalates to. Defaults to [] when omitted."},"escalationWindow":{"type":"object","properties":{"value":{"type":"number","description":"Numeric duration value. Required."},"valueType":{"type":"enum","values":["minutes","businessHours","businessDays","days","months","weeks"],"optional":true,"nullable":true,"description":"Time unit for the value (TimeUnit enum)."}},"required":["value"],"description":"Escalation window. When it (or dueWindow) differs from defaults, an org process config is ensured.","optional":true,"nullable":true},"dueWindow":{"type":"object","properties":{"value":{"type":"number","description":"Numeric duration value. Required."},"valueType":{"type":"enum","values":["minutes","businessHours","businessDays","days","months","weeks"],"optional":true,"nullable":true,"description":"Time unit for the value (TimeUnit enum)."}},"required":["value"],"description":"Due-date window. When it (or escalationWindow) differs from defaults, an org process config is ensured.","optional":true,"nullable":true},"subSchema":{"type":"string","optional":true,"nullable":true,"description":"Sub-schema name from the entity flat-list, stored for UI display."},"isUserCreated":{"type":"boolean","description":"Whether the check is user-created (true) vs internal (false). Required (NOT NULL on the model, controls the edit flow)."}},"required":["title","entityModelName","isUserCreated"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_PROGRAMMABLE_MONITOR

Adds a mitigating note to a risk-to-asset mapping Tags: risk, risk-register, risk-management, mitigating-note, compliance Payload schema (JSON Schema): {"type":"object","properties":{"entityPk":{"type":"string","format":"uuid","description":"Primary key of the risk-to-asset mapping (OrgRiskItemToAsset) to annotate. Use query__listRisks or query__getMappedAssetsToRisk to find the mapping pk."},"entityModelName":{"type":"string","description":"Model name of the entity. Typically 'OrgRiskItemToAsset' when annotating a risk-to-asset mapping."},"orgRiskItemToAssetPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Explicit OrgRiskItemToAsset pk — can be provided instead of entityPk/entityModelName when already known."},"mitigationNoteText":{"type":"string","description":"Text of the mitigating note to add. Required, non-empty. Whitespace is trimmed."}},"required":["entityPk","entityModelName","mitigationNoteText"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_ORG_RISK_MITIGATING_NOTE

Creates a new custom staff role for the organization Tags: staff, people, org-structure Payload schema (JSON Schema): {"type":"object","properties":{"name":{"type":"string","description":"Name of the staff role to be created (e.g. \"Security Engineer\", \"DevOps Lead\"). Required and non-empty (GQL: name: String!, persisted to NOT NULL column). The unique role key is auto-derived from this name (whitespace stripped, lowercased), so the name must be unique within the org."},"jd":{"type":"string","description":"Job description for the staff role. Required and non-empty (GQL: jd: String!, persisted to NOT NULL column)."}},"required":["name","jd"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_STAFF_ROLE

Adds one or more documents to a vendor as a manual upload Tags: vendor, document Payload schema (JSON Schema): {"type":"object","properties":{"vendorPk":{"type":"string","format":"uuid","description":"Primary key of the vendor to which documents are being added"},"documents":{"type":"array","items":{"type":"object","properties":{"documentType":{"type":"string","description":"Type of the vendor document (free-text label, e.g., CONTRACT, SECURITY_POLICY, CERTIFICATION). NOT NULL on the model."},"documentName":{"type":"string","description":"Name of the document. NOT NULL on the model."},"fileS3Key":{"type":"string","optional":true,"nullable":true,"description":"S3 key for a single attached file. Mutually exclusive with fileS3Keys — if both are supplied, fileS3Keys wins."},"fileS3Keys":{"type":"array","items":{"type":"string"},"maxItems":5,"optional":true,"nullable":true,"description":"S3 keys for multi-file uploads (capped at 5). When supplied, the VendorDocument.fileS3Key column is left null and individual files are written to VendorDocumentFile child rows. Handler rejects with error key=\"TooManyFiles\" if the cap is exceeded."},"fileUrl":{"type":"string","optional":true,"nullable":true,"description":"External URL of the document (used when the document lives outside S3)"},"expiryDate":{"type":"string","optional":true,"nullable":true,"description":"Expiry date of the document (ISO 8601 datetime). Not stored on the VendorDocument row directly — when present, the handler upserts an EntityExpiry row tracking VendorDocument.pk + expiryDate."},"remarks":{"type":"string","optional":true,"nullable":true,"description":"Free-text remarks persisted on the VendorDocument.remarks column."}},"required":["documentType","documentName"]},"minItems":1,"description":"Array of vendor document data to create (at least one)"}},"required":["vendorPk","documents"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_VENDOR_DOCUMENTS

Creates one or more vendors in the organization. Do not use riskLevel=CRITICAL unless Critical vendor risk is enabled for the organization. Tags: vendor, vendor-discovery Payload schema (JSON Schema): {"type":"object","properties":{"vendors":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Name of the vendor (non-empty). Duplicate active-vendor names are rejected unless skipDuplicateCheck is true."},"type":{"type":"enum","values":["THIRD_PARTY_VENDOR","INTERNAL_LEGAL_ORGANIZATION"],"description":"Type of vendor (e.g., THIRD_PARTY_VENDOR, INTERNAL_LEGAL_ORGANIZATION)"},"description":{"type":"string","optional":true,"nullable":true,"description":"Free-text description of the vendor"},"category":{"type":"enum","values":["Analytics","Artificial Intelligence","Collaboration & Productivity","Content Management Systems","Customer Service","Data Privacy","Design","Development software","Digital Advertising Tech","Finance","Hosting Providers","HRMS","IAM providers","IoT Management Platforms","IT infrastructure","IT Management","Marketing","Product management tools","Sales","Security Software","Training","Others","Collaboration","MDM","Ticketing Softwares","Web conferencing","HRMS Providers","Background Check Services","Vulnerability Scanning Providers","Workflow Automation","Version Control Systems","Identity Providers","Survey Tools","Cloud Providers","Datastore Providers","Infra Monitoring Providers"],"optional":true,"nullable":true,"description":"Category/industry classification of the vendor"},"websiteUrl":{"type":"string","description":"Vendor website URL (required, NOT NULL on Vendor table). Trailing slashes are normalised server-side."},"ownerPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"User assigned as the vendor owner; defaults to the requesting user"},"vendorAdminPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"User assigned as the vendor admin. If both vendorAdminPk and vendorAdminSystemGroup are null, a default admin is auto-assigned."},"vendorAdminSystemGroup":{"type":"enum","values":["ADMIN","SMT","BOARD_MEMBER","INFOSEC_OFFICER","PRIVACY_OFFICER","PEOPLE_OPERATIONS","INFRA_OPERATIONS","COMPLIANCE_PROGRAM_MANAGER","AUDITOR","STAFF","SPRINTO_SUPPORT","COLLABORATOR","INTERNAL_AUDITOR","EXCEPTION_ANALYST","AI_COMPLIANCE_MANAGER","VIEWER","TRUST_CENTER_ADMIN","SEC_QUE_ADMIN","SEC_QUE_CONSUMER","SEC_QUE_EDITOR","SERVICE_PROVIDER","VENDOR_CONTACT","VENDOR_BUSINESS_OWNER"],"optional":true,"nullable":true,"description":"System group assigned as the vendor admin (alternative to vendorAdminPk)"},"internalBusinessContactPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Internal business contact user identifier"},"internalBusinessContactSystemGroup":{"type":"enum","values":["ADMIN","SMT","BOARD_MEMBER","INFOSEC_OFFICER","PRIVACY_OFFICER","PEOPLE_OPERATIONS","INFRA_OPERATIONS","COMPLIANCE_PROGRAM_MANAGER","AUDITOR","STAFF","SPRINTO_SUPPORT","COLLABORATOR","INTERNAL_AUDITOR","EXCEPTION_ANALYST","AI_COMPLIANCE_MANAGER","VIEWER","TRUST_CENTER_ADMIN","SEC_QUE_ADMIN","SEC_QUE_CONSUMER","SEC_QUE_EDITOR","SERVICE_PROVIDER","VENDOR_CONTACT","VENDOR_BUSINESS_OWNER"],"optional":true,"nullable":true,"description":"System group assigned as the internal business contact"},"internalContacts":{"type":"array","items":{"type":"object","properties":{"pk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of an existing internal contact (omit when creating)"},"userPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Internal user assigned as the contact"},"systemGroup":{"type":"enum","values":["ADMIN","SMT","BOARD_MEMBER","INFOSEC_OFFICER","PRIVACY_OFFICER","PEOPLE_OPERATIONS","INFRA_OPERATIONS","COMPLIANCE_PROGRAM_MANAGER","AUDITOR","STAFF","SPRINTO_SUPPORT","COLLABORATOR","INTERNAL_AUDITOR","EXCEPTION_ANALYST","AI_COMPLIANCE_MANAGER","VIEWER","TRUST_CENTER_ADMIN","SEC_QUE_ADMIN","SEC_QUE_CONSUMER","SEC_QUE_EDITOR","SERVICE_PROVIDER","VENDOR_CONTACT","VENDOR_BUSINESS_OWNER"],"optional":true,"nullable":true,"description":"System group assigned as the internal contact"}},"required":[]},"optional":true,"nullable":true,"description":"Internal contacts associated with the vendor"},"riskLevel":{"type":"enum","values":["CRITICAL","HIGH","MEDIUM","LOW","NA"],"optional":true,"nullable":true,"description":"Risk level associated with the vendor. Use HIGH, MEDIUM, LOW, or NA. Use CRITICAL only when Critical vendor risk is enabled for the organization."},"dataAccessTypes":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"Types of data the vendor has access to"},"logoS3Key":{"type":"string","optional":true,"nullable":true,"description":"S3 key for the vendor logo image"},"contactName":{"type":"string","optional":true,"nullable":true,"description":"Name of the primary vendor contact person"},"contactEmail":{"type":"string","optional":true,"nullable":true,"description":"Email of the primary vendor contact person"},"externalContacts":{"type":"array","items":{"type":"object","properties":{"pk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of an existing external contact (omit when creating)"},"name":{"type":"string","optional":true,"nullable":true,"description":"Name of the external contact at the vendor"},"email":{"type":"string","optional":true,"nullable":true,"description":"Email of the external contact at the vendor"}},"required":[]},"optional":true,"nullable":true,"description":"Additional external contacts at the vendor"},"metadata":{"type":"record","valueType":{"type":"unknown"},"optional":true,"nullable":true,"description":"Additional metadata associated with the vendor (arbitrary key/value data)"},"source":{"type":"enum","values":["SPRINTO","ZIPHQ_VENDORS","AI_GOVERNANCE_CONNECTOR","FRAPPE_VENDORS"],"optional":true,"nullable":true,"description":"Source from which the vendor was added (e.g., SPRINTO for manually/internally managed, ZIPHQ_VENDORS for ZIP-sourced). Defaults to SPRINTO when omitted."},"vendorSuggestionPks":{"type":"array","items":{"type":"string","format":"uuid"},"optional":true,"nullable":true,"description":"Optional. Array of VendorSuggestion primary keys to link to this newly created vendor — only used for the \"add discovered vendor\" flow, where the user is onboarding a vendor surfaced by vendor discovery. Passing this archives those suggestions and re-evaluates the vendor suggestion monitor. Leave empty/omit for a regular (manually initiated) vendor add."},"entityCustomAttributeValues":{"type":"array","items":{"type":"object","properties":{"attributePk":{"type":"string","format":"uuid","description":"Unique identifier for the custom attribute"},"value":{"type":"unknown","description":"Value assigned to the custom attribute (can be string, number, boolean, etc.)"}},"required":["attributePk"]},"optional":true,"nullable":true,"description":"Custom attribute values specific to this vendor"},"stage":{"type":"enum","values":["INTAKE","IN_REVIEW","ACTIVE","OFFBOARDING","INACTIVE"],"optional":true,"nullable":true,"description":"Vendor lifecycle stage. Defaults to ACTIVE. Use INTAKE to route the vendor through an intake review (records requestedByPk/requestedOn and triggers intake notifications unless skipNotifications=true)."},"requestReason":{"type":"string","optional":true,"nullable":true,"description":"Reason for requesting/intake of the vendor. Persisted regardless of stage, but meaningful primarily when stage is INTAKE."}},"required":["name","type","websiteUrl"]},"description":"Array of vendor data to create"},"skipDuplicateCheck":{"type":"boolean","optional":true,"description":"When true, skips the duplicate-name validation against existing active vendors. Defaults to false."},"skipNotifications":{"type":"boolean","optional":true,"description":"When true, suppresses the intake notification emails to vendor admins. Defaults to false."}},"required":["vendors"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_VENDORS

Registers vulnerability scanning providers for the organization Tags: vulnerability, security, scanning, infra, provider, pentest Payload schema (JSON Schema): {"type":"object","properties":{"vulnerabilityScanningProviders":{"type":"array","items":{"type":"object","properties":{"provider":{"type":"enum","values":["Dependabot","SLScan","Snyk","AWSINSPECTOR","RAPID_FORT","CODACY","TENABLE","SOCKET","DEEPSOURCE","INTRUDER","AWS_SECURITY_HUB","JIRA_VULN_PROVIDER","CROWDSTRIKE_SPOTLIGHT","MICROSOFT_DEFENDER_ENDPOINT","MICROSOFT_DEFENDER_VMS","MICROSOFT_DEFENDER_CLOUD","CROWDSTRIKE_EDR","GITLAB_VULN_SCANNER","HALO_SECURITY","SENTINEL_ONE","SENTINEL_ONE_VMS","RAPID7_INSIGHTVM","RAPID7_INSIGHTAPPSEC","AWS_GUARDDUTY","CHECKMARX","CORTEX","SAFEOPS","AZURE_DEFENDER","WIZ_CLOUD","WIZ_CODE","GOOGLE_SECURITY_CENTER","SEMGREP","SONARCLOUD","SONARQUBE","QUALYS","AIKIDO"],"description":"The vulnerability scanning source. Examples: AWS_SECURITY_HUB, GOOGLE_SECURITY_CENTER, AZURE_DEFENDER, AWSINSPECTOR, SNYK, SLScan. Use query__listInfraProviders to see which infra providers are already connected."},"providerType":{"type":"enum","values":["INFRASTRUCTURE","CHANGE_MANAGEMENT","OTHERS"],"description":"Category of scanning provider. INFRASTRUCTURE = cloud/infra provider (requires infraProviderPk). CHANGE_MANAGEMENT = CI/CD pipeline scanner (requires changeManagementProviderPk). OTHERS = standalone scanners like Snyk."},"infraProviderPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the infra provider record. Required when providerType is INFRASTRUCTURE. Use query__listInfraProviders to find the pk."},"changeManagementProviderPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the change management provider. Required when providerType is CHANGE_MANAGEMENT. Use query__listInfraProviders to find the pk."}},"required":["provider","providerType"]},"minItems":1,"description":"One or more vulnerability scanning provider configurations to add. At least one entry required."}},"required":["vulnerabilityScanningProviders"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_VULNERABILITY_SCANNING_PROVIDERS

Approves an organization risk item Tags: risk Payload schema (JSON Schema): {"type":"object","properties":{"orgRiskItemPk":{"type":"string","format":"uuid","description":"Unique identifier of the organization risk item to approve"},"riskApproverPks":{"type":"array","items":{"type":"string","format":"uuid"},"minItems":1,"description":"List of risk approver primary keys, we use the riskApprover.pk and not approverPk"}},"required":["orgRiskItemPk","riskApproverPks"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__APPROVE_RISK_V2

Archives an evidence request without permanently deleting it Tags: evidence-request, audit, compliance Payload schema (JSON Schema): {"type":"object","properties":{"orgEvidenceRequestPk":{"type":"string","format":"uuid","description":"Primary key of the evidence request to archive"}},"required":["orgEvidenceRequestPk"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ARCHIVE_ORG_EVIDENCE_REQUEST

Archives 1-50 vendors or AI systems in one call (stage INACTIVE). Use this, not action__UPDATE_VENDOR, to archive or deactivate vendors, even a single one. All-or-nothing: any missing or failed vendor rejects the batch; already-archived vendors are skipped. If the error says the batch took too long, retry with fewer vendors; for more than 50, call again with the next 50. Requires an admin, plus the Archive vendor permission when role-based access control is enabled; if refused, do not archive the vendors another way, tell the user. Closes each vendor's open tasks and syncs to external providers. Tags: vendor Payload schema (JSON Schema): {"type":"object","properties":{"vendorPks":{"type":"array","items":{"type":"string","format":"uuid"},"minItems":1,"maxItems":50,"description":"Pks of the vendors (or AI systems) to archive, 1 to 50 per call, copied from a read result. If any pk is not found nothing is archived."},"archivedReason":{"type":"string","description":"Why these vendors are being archived; recorded on every vendor in the batch."}},"required":["vendorPks","archivedReason"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ARCHIVE_VENDORS

Assigns policy acknowledgement requests to selected employees and can notify them Tags: people, policy Payload schema (JSON Schema): {"type":"object","properties":{"name":{"type":"string","description":"Name/label for the acknowledgment request."},"orgPolicyTypePks":{"type":"array","items":{"type":"string","format":"uuid"},"minItems":1,"description":"Policy type PKs the employees must acknowledge (at least one)."},"userPks":{"type":"array","items":{"type":"string","format":"uuid"},"minItems":1,"description":"Individual employee (user) PKs to assign the acknowledgment to (at least one)."},"sendPolicyAckNotification":{"type":"boolean","optional":true,"nullable":true,"description":"Whether to send acknowledgment notification emails (defaults to false)."}},"required":["name","orgPolicyTypePks","userPks"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ASSIGN_POLICY_ACK_TO_EMPLOYEES

Assigns a user to a system group and may replace the current unique role holder Tags: people, staff, role, system-group, privacy-officer, infosec, gdpr Payload schema (JSON Schema): {"type":"object","properties":{"userPk":{"type":"string","format":"uuid","description":"Primary key of the user to assign. Must be an active user in the same organization. Use query__getUsersPaginated or query__getUsers to look up the user's pk. Returns UserNotFound error if the user does not belong to the org."},"systemGroupName":{"type":"enum","values":["ADMIN","SMT","BOARD_MEMBER","INFOSEC_OFFICER","PRIVACY_OFFICER","PEOPLE_OPERATIONS","INFRA_OPERATIONS","COMPLIANCE_PROGRAM_MANAGER","AUDITOR","STAFF","SPRINTO_SUPPORT","COLLABORATOR","INTERNAL_AUDITOR","EXCEPTION_ANALYST","AI_COMPLIANCE_MANAGER","VIEWER","TRUST_CENTER_ADMIN","SEC_QUE_ADMIN","SEC_QUE_CONSUMER","SEC_QUE_EDITOR","SERVICE_PROVIDER","VENDOR_CONTACT","VENDOR_BUSINESS_OWNER"],"description":"System group to assign the user to. Examples: PRIVACY_OFFICER, INFOSEC_OFFICER, SMT (Senior Management), ADMIN, LIMITED_ADMIN. PRIVACY_OFFICER and INFOSEC_OFFICER enforce a UniqueInOrg constraint — assigning a new holder automatically removes the previous one. SMT also enforces UniqueInOrg. Returns SystemGroupMemberAlreadyExists if the user is already in the group, or SystemGroupMemberNotAdded if the user is already in SMT or INFOSEC_OFFICER and the target group is also SMT or INFOSEC_OFFICER."}},"required":["userPk","systemGroupName"]} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__ADD_SYSTEM_GROUP_MEMBERSHIP

Answers security questionnaire questions using the Knowledge Hub. Send ALL questions at once — the tool batches internally, no limit per call. This tool only returns answers from Sprinto — it does not parse files or create CSVs. You (the assistant) do the parsing and CSV creation using Code Interpreter. Returns a structured result per question: answer text, confidence, needs_review, sources. ALWAYS display sources from each result in your response. Show citations below each answer. Supported formats (you parse these with Code Interpreter): - CSV (.csv) — pandas.read_csv() - Excel (.xlsx) — pandas.read_excel() - Word (.docx) — python-docx, extract tables or paragraphs - PDF (.pdf) — try pdfplumber or camelot; if no clean table, ask to re-upload as CSV/Excel - Old Word (.doc) or any other format — ask user to re-upload as CSV or Excel Flow (do all of this automatically — do NOT ask permission at any step): 1. Parse the uploaded file with Code Interpreter immediately. 2. Silently detect the question column: a. Exact name match: "Question", "Question Text", "Security Question", "Requirement" b. Column name contains "question" or "requirement" (case-insensitive) c. Column with the longest average text length Only ask if two columns are genuinely indistinguishable in size. 3. Silently detect or create the answer column (Response, Answer, Vendor Response, Comments). If none found, create "Answer". Only ask if two equally plausible candidates exist. 4. Call get_workspace_context once silently before generating answers. 5. Call this tool with ALL questions in a single call — the tool handles batching internally. Show a brief progress message like "Fetching answers from your Knowledge Hub..." 6. IMMEDIATELY generate the completed CSV using Code Interpreter — do not ask first. Preserve original columns/rows, write answers into the chosen column. Provide the CSV for download and say "Your completed questionnaire is ready to download." 7. Show a summary: "Finished. Total: [Y] | Answered: [X] | Needs review: [Z]" Include citations (sources) for any questions that had supporting documents. If PDF parsing fails (scanned/image PDF): tell the user and ask to re-upload as CSV or Excel. If .doc or unsupported format: ask the user to re-upload as CSV or Excel. If most questions are flagged for review: "Your Knowledge Hub may not have enough documentation yet. You can add policies at Sprinto → Knowledge Hub to improve coverage."

batch_answer_questions

Bulk-approves or revokes approval for security questionnaire questions Tags: security-questionnaire Payload schema (JSON Schema): {"type":"object","properties":{"questionMappings":{"type":"array","items":{"type":"object","properties":{"secQueQuestionPk":{"type":"string","format":"uuid","description":"UUID of the SecQueQuestion to approve or revoke approval for."},"autoRespQuestionPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"UUID of the associated auto-response question, used to build deep-link URLs in approval notifications."}},"required":["secQueQuestionPk"]},"minItems":1,"description":"Mappings of SecQueQuestion PKs to their optional auto-response question PKs. Must contain at least one entry with a valid secQueQuestionPk. If the derived secQueQuestionsPks list is empty, returns userInputErrors[].key=\"secQueQuestionsPks\", messages=[\"MissingSecQueQuestionsPks\"]."},"shouldApprove":{"type":"boolean","optional":true,"nullable":true,"description":"When true: approves questions by setting status to REVIEWED. Unanswered (UNANSWERED) questions are silently skipped. When false: revokes approval by setting status back to ANSWERED. Only questions currently in REVIEWED status are processed; all others are skipped. Approval notifications are sent to question owners only when shouldApprove is true."}},"required":["questionMappings"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__BULK_APPROVE_SECQUE_QUESTIONS

Closes multiple open incidents in bulk Tags: incident Payload schema (JSON Schema): {"type":"object","properties":{"isAllSelected":{"type":"boolean","description":"When true, close ALL currently-open incidents for the org (optionally narrowed by `source`). When false, close only the open incidents whose pks are in incidentPksToClose."},"incidentPksToClose":{"type":"array","items":{"type":"string","format":"uuid"},"optional":true,"description":"UUID primary keys of incidents to close. Used when isAllSelected is false. Only pks that correspond to currently-OPEN incidents in the org are closed; pks that are already closed or do not exist are silently skipped. An empty or omitted array is a no-op when isAllSelected is false."},"closingNotes":{"type":"string","optional":true,"nullable":true,"description":"Optional closing notes (Incident.closingNotes, a nullable text column) applied to every incident closed by this action."},"source":{"type":"string","optional":true,"nullable":true,"description":"Optional single incident source to filter by (applied as Incident.source = source). Valid base values: \"GuardDuty\", \"StaffReported\", \"MicrosoftDefender\", \"GoogleSecurityCenter\", \"PagerDuty\", \"Jira\", \"OpsGenie\" (additional orchestra-provider sources may also exist). When omitted/null, incidents of all sources are eligible. NOTE: this is read regardless of isAllSelected, but only meaningfully changes behaviour when isAllSelected is true."}},"required":["isAllSelected"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__BULK_CLOSE_INCIDENTS

Creates or updates multiple vendor records in a single dispatch. Do not use overallRiskLevel=CRITICAL unless Critical vendor risk is enabled for the organization. Tags: vendor, bulk Payload schema (JSON Schema): {"type":"object","properties":{"vendors":{"type":"array","items":{"type":"object","properties":{"name":{"type":"string","description":"Vendor name. Required."},"websiteUrl":{"type":"string","description":"Vendor website URL. Required. Trailing slashes are normalised server-side."},"category":{"type":"string","optional":true,"nullable":true,"description":"Vendor category (e.g., CLOUD_SERVICES, SAAS)"},"description":{"type":"string","optional":true,"nullable":true,"description":"Short description of the vendor"},"overallRiskLevel":{"type":"enum","values":["CRITICAL","HIGH","MEDIUM","LOW","NA"],"optional":true,"nullable":true,"description":"Overall risk level. Use HIGH, MEDIUM, LOW, or NA. Use CRITICAL only when Critical vendor risk is enabled for the organization. Normalized to internal enum values before saving."},"vendorAdminEmail":{"type":"string","optional":true,"nullable":true,"description":"Email of the vendor's admin contact in Sprinto"},"vendorAdminSystemGroup":{"type":"string","optional":true,"nullable":true,"description":"System group identifier for the vendor admin"},"internalBusinessContactEmail":{"type":"string","optional":true,"nullable":true,"description":"Email of the internal business owner for this vendor"},"contactName":{"type":"string","optional":true,"nullable":true,"description":"Name of the primary vendor contact"},"contactEmail":{"type":"string","optional":true,"nullable":true,"description":"Email of the primary vendor contact"},"externalContactEmails":{"type":"array","items":{"type":"string"},"optional":true,"nullable":true,"description":"Additional external contact emails for this vendor"},"entityCustomAttributeValues":{"type":"array","items":{"type":"object","properties":{"entityCustomAttributeDefinitionPk":{"type":"string","format":"uuid","description":"PK of the custom attribute definition"},"value":{"type":"unknown","description":"Value for the custom attribute"}},"required":["entityCustomAttributeDefinitionPk"]},"optional":true,"nullable":true,"description":"Custom attribute values for this vendor"},"riskDimensions":{"type":"array","items":{"type":"object","properties":{"orgVendorRiskDimensionPk":{"type":"string","format":"uuid","description":"PK of the org-level risk dimension"},"values":{"type":"array","items":{"type":"string"},"description":"Selected values for this risk dimension"}},"required":["orgVendorRiskDimensionPk","values"]},"optional":true,"nullable":true,"description":"Risk dimension values scoped to this vendor"}},"required":["name","websiteUrl"]},"description":"Array of vendor records to create or update. Each row is matched against existing vendors by normalised websiteUrl + name within the org: a match updates that vendor in place, otherwise a new vendor is created. websiteUrl is required on every row."}},"required":["vendors"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__BULK_IMPORT_VENDORS

Atomically bulk-updates access control entity–user connections Tags: access-control, access-review Payload schema (JSON Schema): {"type":"object","properties":{"accessUserMappings":{"type":"array","items":{"type":"object","properties":{"accessControlEntityPk":{"type":"string","format":"uuid","description":"Primary key (UUID) of the AccessControlEntity record to update. Each pk must appear at most once in the batch — duplicate accessControlEntityPks are rejected upfront with DuplicateAccessUserMapping."},"decision":{"type":"enum","values":["ADD_AS_A_NEW_USER","NOT_A_USER","NO_CONNECTION","USER"],"description":"How to resolve this access user's connection to a Sprinto staff user. One of:\n- USER: link to an existing Sprinto user via connectedUserPk (requires connectedUserPk).\n- ADD_AS_A_NEW_USER: create a new Sprinto staff user from userToAdd, then link to them (requires userToAdd).\n- NOT_A_USER: mark the entry as a non-person/service account (sets notAUser=true, clears connection).\n- NO_CONNECTION: clear the connection without marking as non-user."},"connectedUserPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key (UUID) of the existing Sprinto User to link. REQUIRED when decision is USER; ignored otherwise."},"userToAdd":{"type":"object","properties":{"firstName":{"type":"string","description":"New user's first name. Must be non-empty (the underlying User.firstName column is NOT NULL)."},"lastName":{"type":"string","optional":true,"nullable":true,"description":"New user's last name"},"email":{"type":"string","format":"email","description":"New user's email address. Must be a valid email format. Must not match any active user already in the organisation — if it does, the action returns success:false with errors. When multiple mappings in the same batch share the same userToAdd.email, only one new user is created; the remaining mappings are rewritten to a USER decision pointing at that new user."},"employmentType":{"type":"enum","values":["EMPLOYEE","CONTRACTOR","NHI"],"optional":true,"nullable":true,"description":"Employment classification of the new user. One of: EMPLOYEE, CONTRACTOR, NHI. Optional — the handler defaults a missing/empty value to EMPLOYEE."},"employmentStartDate":{"type":"string","optional":true,"nullable":true,"description":"ISO date string for the new user's employment start date"},"employmentIsNew":{"type":"boolean","optional":true,"description":"Whether the user is brand new to the organisation (true) or is an existing person being formally added (false)"},"createdVia":{"type":"string","optional":true,"nullable":true,"description":"Source or channel through which this user record is being created (e.g., integration name)"}},"required":["firstName","email"],"optional":true,"nullable":true,"description":"Data for the new staff user to create and link. REQUIRED when decision is ADD_AS_A_NEW_USER; ignored otherwise."}},"required":["accessControlEntityPk","decision"]},"description":"List of per-entity connection mappings to apply in a single atomic batch. Each mapping specifies one AccessControlEntity and the decision to apply. An empty array is a no-op: returns success with empty results. The entire batch is all-or-nothing — any single failure rolls back all writes."}},"required":["accessUserMappings"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__BULK_UPDATE_ACCESS_USER_CONNECTION

Bulk-reassigns the owner of one or more security questionnaire questions Tags: security-questionnaire Payload schema (JSON Schema): {"type":"object","properties":{"assigneePk":{"type":"string","format":"uuid","description":"Primary key of the user to assign as the new owner (ownedByPk) for all specified questions. Validation error key: \"assigneePk\", message: \"MissingAssigneePk\" when omitted."},"questionMappings":{"type":"array","items":{"type":"object","properties":{"secQueQuestionPk":{"type":"string","format":"uuid","description":"Primary key of the SecQueQuestion to reassign (UUID, NOT NULL)."},"autoRespQuestionPk":{"type":"string","format":"uuid","optional":true,"nullable":true,"description":"Primary key of the corresponding SecQueAutoRespQuestion, if any. Used for notification deep-link routing."}},"required":["secQueQuestionPk"]},"minItems":1,"description":"Non-empty list of question mappings. The handler extracts secQueQuestionPks from this array via _.compact(_.map(questionMappings, \"secQueQuestionPk\")). Validation error key: \"secQueQuestionsPks\", message: \"MissingSecQueQuestionsPks\" when the resulting array is empty."}},"required":["assigneePk","questionMappings"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__BULK_UPDATE_SECQUE_QUESTION_ASSIGNEE

Bulk-updates the reviewer of one or more security questionnaire questions Tags: security-questionnaire Payload schema (JSON Schema): {"type":"object","properties":{"reviewerPk":{"type":"string","format":"uuid","description":"UUID of the user to assign as reviewer for the selected questions. Required. If empty, returns userInputErrors[].key=\"reviewerPk\", messages=[\"MissingReviewerPk\"]."},"secQueQuestionsPks":{"type":"array","items":{"type":"string","format":"uuid"},"minItems":1,"description":"Array of SecQueQuestion PKs to update. Must contain at least one entry. If empty, returns userInputErrors[].key=\"secQueQuestionsPks\", messages=[\"MissingSecQueQuestionsPks\"]."},"notifyNewReviewer":{"type":"boolean","optional":true,"description":"When true, sends an email notification to the new reviewer. The notification is only sent if at least one of the updated questions is in PENDING_REVIEW status."}},"required":["reviewerPk","secQueQuestionsPks"],"description":"Action-specific data payload"} Write action. Requires idempotencyKey. Returns `{ result: ... }`.

action__BULK_UPDATE_SECQUE_QUESTION_REVIEWER

Returns what Sprinto Assistant can do, behavioral rules, how the questionnaire flow works, and what file formats are accepted. WHEN TO CALL: - User explicitly asks what Sprinto can do or how a Sprinto workflow works - User asks which file formats Sprinto supports for security questionnaires - User uploads a file without any clear instruction (start flow automatically after fetching this) Do not call this tool for generic greetings, general help, or requests unrelated to Sprinto. Use the return value — especially behavioral_rules — to guide your entire response. You are Sprinto Assistant: you parse files and build CSVs; Sprinto only provides answers. Keep your reply friendly and concise.

get_capabilities