---
updatedAt: 2026-05-27T12:53:27.000Z
agentTools:
  projectIndex: https://developer.onetrust.com/onetrust/llms.txt
---

# Update Risk Stage

Use this API to assign a risk to a stage in a workflow.
> 🗒 Things to Know
> 
> - This API will move the risk to the specified stage in the workflow.
> - The risk must be in a valid stage to be moved to the target stage.

# OpenAPI definition

```json
{
  "openapi": "3.1.0",
  "info": {
    "title": "Tech Risk & Compliance - IT Risk Management",
    "description": "The IT Risk Management API provides comprehensive REST endpoints for managing enterprise security controls, threats, vulnerabilities, and their implementations with OAuth2 security and extensive customization capabilities.",
    "version": "1.0",
    "contact": {
      "name": "OneTrust Support",
      "url": "https://my.onetrust.com/s/contactsupport"
    },
    "license": {
      "name": "Apache 2.0",
      "url": "https://www.apache.org/licenses/LICENSE-2.0"
    }
  },
  "servers": [
    {
      "url": "https://{hostname}",
      "variables": {
        "hostname": {
          "default": "hostname",
          "description": "The OneTrust hostname such as app.onetrust.com, app-eu.onetrust.com, app-de.onetrust.com, app-uk.onetrust.com, app-apac.onetrust.com, trial.onetrust.com, or uat.onetrust.com."
        }
      }
    }
  ],
  "tags": [
    {
      "name": "Risk Management",
      "description": "APIs to manage risk configurations, scoring settings, categories, and metadata used across the risk management system.",
      "externalDocs": {
        "description": "OpenAPI 3.1.0 - Download Definition",
        "url": "https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-it-risk-management.json"
      },
      "x-displayName": "Risk Management"
    }
  ],
  "paths": {
    "/api/risk/v2/risks/{id}/assign-stage": {
      "post": {
        "operationId": "changeRiskStageUsingPOST",
        "summary": "Update Risk Stage",
        "description": "Use this API to assign a risk to a stage in a workflow.\n> 🗒 Things to Know\n> \n> - This API will move the risk to the specified stage in the workflow.\n> - The risk must be in a valid stage to be moved to the target stage.",
        "tags": [
          "Risk Management"
        ],
        "x-onetrust": {
          "spec-label": "https://developer.onetrust.com/onetrust/openapi/tech-risk-compliance-it-risk-management.json"
        },
        "parameters": [
          {
            "name": "id",
            "in": "path",
            "description": "Risk unique Identifier",
            "required": true,
            "schema": {
              "type": "string",
              "format": "uuid"
            }
          }
        ],
        "requestBody": {
          "required": true,
          "content": {
            "application/json": {
              "schema": {
                "$ref": "#/components/schemas/TechRiskCompliance-Risk_WorkflowStageNavigationInstructionInformation"
              }
            }
          }
        },
        "responses": {
          "200": {
            "description": "Risk stage changed successfully",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/TechRiskCompliance-Risk_WorkflowStageListInformation"
                }
              }
            }
          },
          "400": {
            "description": "Bad Request"
          },
          "401": {
            "description": "Unauthorized"
          },
          "403": {
            "description": "Forbidden"
          },
          "429": {
            "description": "Too Many Requests. \nFor more information, see [API Rate Limits](https://developer.onetrust.com/onetrust/reference/rate-limits-overview).",
            "headers": {
              "Retry-After": {
                "schema": {
                  "description": "The number of seconds after which requests will be allowed again.",
                  "format": "int32"
                }
              },
              "ot-period": {
                "schema": {
                  "description": "The unit of time for which the rate limit applies",
                  "enum": [
                    "HOUR",
                    "MINUTE"
                  ]
                }
              },
              "ot-ratelimit-event-id": {
                "schema": {
                  "description": "The unique identifier for the rate-limiting event.",
                  "format": "uuid"
                }
              },
              "ot-request-made": {
                "schema": {
                  "description": "The number of requests made within the specified period.",
                  "format": "int32"
                }
              },
              "ot-requests-allowed": {
                "schema": {
                  "description": "The number of requests allowed within the specified period.",
                  "format": "int32"
                }
              }
            }
          },
          "500": {
            "description": "Internal Server Error"
          }
        },
        "security": [
          {
            "TechRiskCompliance-Risk_OAUTH2": [
              "RISK"
            ]
          }
        ]
      }
    }
  },
  "components": {
    "schemas": {
      "TechRiskCompliance-Risk_AdvanceStageActionInformation": {
        "type": "object",
        "properties": {
          "id": {
            "description": "Advance Stage Action Identifier",
            "type": "string",
            "format": "uuid"
          },
          "actionType": {
            "description": "Advance Stage Action Type",
            "type": "string",
            "enum": [
              "ATTRIBUTES, ATTACHMENT"
            ]
          },
          "actionMetadata": {
            "description": "Advance Stage Action metadata",
            "type": "object",
            "additionalProperties": {
              "type": "object"
            }
          }
        },
        "required": [
          "actionType",
          "id"
        ]
      },
      "TechRiskCompliance-Risk_StageExceptionInformation": {
        "type": "object",
        "properties": {
          "stageExceptionApprovers": {
            "description": "Workflow Stage Exception Approvers",
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/TechRiskCompliance-Risk_WorkflowStageApproverInformation"
            }
          },
          "exceptionGrantedTargetStageId": {
            "description": "Target stage for exception approval",
            "type": "string",
            "format": "uuid"
          },
          "workflowExceptionApprovalRequiredFromAll": {
            "description": "Is exception required from all approvers",
            "type": "boolean"
          }
        }
      },
      "TechRiskCompliance-Risk_WorkflowStageApproverInformation": {
        "type": "object",
        "properties": {
          "id": {
            "description": "Workflow Stage Approver Identifier",
            "type": "string",
            "format": "uuid"
          },
          "workFlowStageId": {
            "description": "Workflow Stage Id",
            "type": "string",
            "format": "uuid"
          },
          "approverType": {
            "description": "Workflow Stage Approver Type",
            "type": "string",
            "enum": [
              "SYSTEM_USER, USER_ATTRIBUTE"
            ]
          },
          "approverUserId": {
            "description": "Workflow Stage Approver User Id, User ID from Onetrust System",
            "type": "string",
            "format": "uuid"
          },
          "referenceApproverUserSourceId": {
            "description": "Reference identifier for approver' source. ie, fieldName from attribute Manager",
            "type": "string"
          },
          "referenceApproverUserSourceOwner": {
            "description": "Reference Source Owner. ie, schemaname from attribute manager",
            "type": "string"
          },
          "approverUserGroupId": {
            "description": "Workflow Stage Approver User Group Id, User Group ID from Onetrust System",
            "type": "string",
            "format": "uuid"
          },
          "approverCategory": {
            "description": "Field to indicate if the approver is for stage approval or exception",
            "type": "string"
          },
          "customFields": {
            "description": "Custom fields",
            "type": "object",
            "additionalProperties": {
              "type": "object"
            }
          }
        },
        "required": [
          "approverType",
          "id",
          "workFlowStageId"
        ]
      },
      "TechRiskCompliance-Risk_WorkflowStageListInformation": {
        "type": "object",
        "properties": {
          "id": {
            "description": "Workflow Stage Identifier",
            "type": "string",
            "format": "uuid",
            "example": "123e4567-e89b-12d3-a456-426614174000"
          },
          "name": {
            "description": "Workflow Stage Name",
            "type": "string",
            "example": "Investigation"
          },
          "nameKey": {
            "description": "Workflow Stage Name Key for translation purposes",
            "type": "string",
            "example": "workflow.stage.investigation"
          },
          "description": {
            "description": "Workflow Stage Description",
            "type": "string",
            "example": "Investigation stage for incident workflow"
          },
          "descriptionKey": {
            "description": "Workflow Stage Description Key for translation purposes",
            "type": "string",
            "example": "workflow.stage.investigation.description"
          },
          "sequence": {
            "description": "Workflow Stage Sequence number",
            "type": "integer",
            "format": "int32",
            "example": 2,
            "minimum": 1
          },
          "allowDeletion": {
            "description": "Indicates if Workflow Stage can be deleted",
            "type": "boolean",
            "example": true,
            "default": "false"
          },
          "badgeColor": {
            "description": "Workflow Stage Badge Color for UI purposes",
            "type": "string",
            "example": "blue"
          },
          "approvalStage": {
            "description": "Indicates if the stage is an approval stage",
            "type": "boolean",
            "example": true,
            "default": "false"
          },
          "exceptionStage": {
            "description": "Indicates if the stage is an exception approval stage",
            "type": "boolean",
            "example": false,
            "default": "false"
          },
          "autoAdvanceOnApproval": {
            "description": "Can Workflow Stage Auto-Advance on Approval?",
            "type": "boolean",
            "example": true,
            "default": "false"
          },
          "customFields": {
            "description": "Custom fields",
            "type": "object",
            "example": {
              "priority": "high",
              "category": "security"
            },
            "additionalProperties": {
              "type": "object"
            }
          },
          "stageApprovers": {
            "description": "Workflow Stage Approvers",
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/TechRiskCompliance-Risk_WorkflowStageApproverInformation"
            }
          },
          "additionalFields": {
            "description": "Additional fields associated with Workflow Stage",
            "type": "object",
            "example": {
              "notificationEnabled": true
            },
            "additionalProperties": {
              "type": "object"
            }
          },
          "advanceStageActionEnabled": {
            "description": "Does Workflow Stage has advance stage action enabled?",
            "type": "boolean",
            "example": true,
            "default": "false"
          },
          "advanceStageActions": {
            "description": "Workflow Stage Advance Actions",
            "type": "array",
            "items": {
              "$ref": "#/components/schemas/TechRiskCompliance-Risk_AdvanceStageActionInformation"
            }
          },
          "stageExceptionConfiguration": {
            "description": "Workflow Stage Exception details",
            "$ref": "#/components/schemas/TechRiskCompliance-Risk_StageExceptionInformation"
          }
        },
        "example": {
          "id": "123e4567-e89b-12d3-a456-426614174000",
          "name": "Investigation",
          "nameKey": "workflow.stage.investigation",
          "description": "Investigation stage for incident workflow",
          "descriptionKey": "workflow.stage.investigation.description",
          "sequence": 2,
          "allowDeletion": true,
          "badgeColor": "blue",
          "approvalStage": true,
          "exceptionStage": false,
          "autoAdvanceOnApproval": true,
          "customFields": {
            "priority": "high",
            "category": "security"
          },
          "stageApprovers": [
            {
              "id": "abc-123",
              "name": "Security Approver"
            }
          ],
          "additionalFields": {
            "notificationEnabled": true
          },
          "advanceStageActionEnabled": true,
          "advanceStageActions": [
            {
              "id": "def-456",
              "name": "Approve"
            }
          ],
          "stageExceptionConfiguration": {
            "enabled": true,
            "approverCount": 2
          }
        },
        "required": [
          "id",
          "name",
          "sequence"
        ]
      },
      "TechRiskCompliance-Risk_WorkflowStageNavigationInstructionInformation": {
        "type": "object",
        "properties": {
          "nextStageId": {
            "description": "Next stage ID - Only required if the navigation direction is Specific",
            "type": "string",
            "format": "uuid",
            "example": "123e4567-e89b-12d3-a456-426614174000"
          },
          "direction": {
            "description": "Navigation direction",
            "type": "string",
            "example": "Next",
            "enum": [
              "First",
              "Next",
              "Previous",
              "Last",
              "Specific"
            ]
          },
          "parameters": {
            "description": "Additional parameters for workflow navigation customization",
            "additionalProperties": {
              "type": "object"
            },
            "example": {
              "skipValidation": true,
              "forceTransition": false,
              "notifyUsers": true
            },
            "type": "object"
          },
          "comment": {
            "description": "Comment describing the stage change",
            "type": "string",
            "example": "Moving to investigation stage due to new evidence",
            "maxLength": 4000,
            "minLength": 0
          }
        },
        "example": {
          "nextStageId": "123e4567-e89b-12d3-a456-426614174000",
          "direction": "Specific",
          "parameters": {
            "forceTransition": false,
            "notifyUsers": true,
            "reason": "Security incident triage complete",
            "skipValidation": true,
            "urgency": "high"
          },
          "comment": "Moving to investigation stage due to new evidence found during initial triage"
        },
        "required": [
          "direction"
        ]
      }
    },
    "securitySchemes": {
      "TechRiskCompliance-Risk_OAUTH2": {
        "type": "oauth2",
        "flows": {
          "clientCredentials": {
            "tokenUrl": "https://{hostname}/api/access/v1/oauth/token",
            "scopes": {
              "RISK": "Risk Scope",
              "RISK_READ": "Risk read scope",
              "INTEGRATION": "Integration scope"
            }
          }
        }
      }
    }
  },
  "x-readme": {
    "explorer-enabled": false,
    "proxy-enabled": false,
    "metrics-enabled": false
  },
  "x-onetrust": {
    "spec-label": "OpenAPI 3.1.0"
  }
}
```

# Sibling pages

* [Create or Update Risk](https://developer.onetrust.com/onetrust/reference/createupdateriskusingput.md)
* [Update Risk](https://developer.onetrust.com/onetrust/reference/updateriskusingput.md)
* [Delete Risk](https://developer.onetrust.com/onetrust/reference/deleteriskusingdelete.md)
* [Modify Risk](https://developer.onetrust.com/onetrust/reference/updateriskusingpatch.md)
* [Update Risk Approvers](https://developer.onetrust.com/onetrust/reference/updateriskapproversusingput.md)
* [Update Risk Categories](https://developer.onetrust.com/onetrust/reference/updateriskcategoriesusingput.md)
* [Update Risk Owners](https://developer.onetrust.com/onetrust/reference/updateriskownersusingput.md)