Skip to content

feat: risk scores #378

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gusfcarvalho merged 4 commits into from
Apr 14, 2026
Merged

feat: risk scores #378

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
52ebc97
feat: risk scores
gusfcarvalho Apr 13, 2026
4e113cb
Merge branch 'main' into codex/risk-score
gusfcarvalho Apr 13, 2026
ba7abf9
Harden risk score timestamps and timeseries validation
gusfcarvalho Apr 14, 2026
dd8afca
Document paginated risk score history
gusfcarvalho Apr 14, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
364 changes: 364 additions & 0 deletions docs/docs.go
View file
Open in desktop

Large diffs are not rendered by default.

364 changes: 364 additions & 0 deletions docs/swagger.json
View file
Open in desktop

Large diffs are not rendered by default.

236 changes: 236 additions & 0 deletions docs/swagger.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -571,6 +571,14 @@ definitions:
$ref: '#/definitions/handler.poamItemResponse'
type: array
type: object
handler.GenericDataListResponse-handler_riskScoreTimeseriesResponse:
properties:
data:
description: Items from the list response
items:
$ref: '#/definitions/handler.riskScoreTimeseriesResponse'
type: array
type: object
handler.GenericDataListResponse-handler_selectableUserResponse:
properties:
data:
Expand Down Expand Up @@ -2051,6 +2059,46 @@ definitions:
updated-at:
type: string
type: object
handler.riskScoreResponse:
properties:
actor-user-id:
type: string
baseline-score:
type: integer
created-at:
type: string
id:
type: string
impact:
type: string
likelihood:
type: string
occurred-at:
type: string
open-baseline-score:
type: integer
open-residual-score:
type: integer
residual-score:
type: integer
risk-id:
type: string
source-event-type:
type: string
ssp-id:
type: string
status:
type: string
type: object
handler.riskScoreTimeseriesResponse:
properties:
bucket-start:
type: string
open-baseline-score:
type: integer
open-residual-score:
type: integer
type: object
handler.selectableUserResponse:
properties:
displayName:
Expand Down Expand Up @@ -7468,6 +7516,21 @@ definitions:
totalPages:
type: integer
type: object
service.ListResponse-handler_riskScoreResponse:
properties:
data:
items:
$ref: '#/definitions/handler.riskScoreResponse'
type: array
limit:
type: integer
page:
type: integer
total:
type: integer
totalPages:
type: integer
type: object
service.ListResponse-handler_threatIDResponse:
properties:
data:
Expand Down Expand Up @@ -21559,6 +21622,52 @@ paths:
summary: List risk audit trail for SSP
tags:
- Risks
/oscal/system-security-plans/{sspId}/risks/{id}/score-history:
get:
description: Lists score snapshots for a risk scoped to an SSP.
parameters:
- description: SSP ID
in: path
name: sspId
required: true
type: string
- description: Risk ID
in: path
name: id
required: true
type: string
- description: Page number
in: query
name: page
type: integer
- description: Page size
in: query
name: limit
type: integer
produces:
- application/json
responses:
"200":
description: OK
schema:
$ref: '#/definitions/service.ListResponse-handler_riskScoreResponse'
"400":
description: Bad Request
schema:
$ref: '#/definitions/api.Error'
"404":
description: Not Found
schema:
$ref: '#/definitions/api.Error'
"500":
description: Internal Server Error
schema:
$ref: '#/definitions/api.Error'
security:
- OAuth2Password: []
summary: List risk score history for SSP
tags:
- Risks
/oscal/system-security-plans/{sspId}/risks/{id}/threat-ids:
get:
description: Lists threat references linked to a risk scoped to an SSP.
Expand Down Expand Up @@ -21783,6 +21892,52 @@ paths:
summary: Update risk threat reference for SSP
tags:
- Risks
/oscal/system-security-plans/{sspId}/risks/score-timeseries:
get:
description: Returns aggregate open baseline and residual score time series
for an SSP.
parameters:
- description: SSP ID
in: path
name: sspId
required: true
type: string
- description: Start timestamp (RFC3339)
in: query
name: from
type: string
- description: End timestamp (RFC3339)
in: query
name: to
type: string
- description: Bucket size; only day is supported
in: query
name: bucket
type: string
produces:
- application/json
responses:
"200":
description: OK
schema:
$ref: '#/definitions/handler.GenericDataListResponse-handler_riskScoreTimeseriesResponse'
"400":
description: Bad Request
schema:
$ref: '#/definitions/api.Error'
"404":
description: Not Found
schema:
$ref: '#/definitions/api.Error'
"500":
description: Internal Server Error
schema:
$ref: '#/definitions/api.Error'
security:
- OAuth2Password: []
summary: Get risk score timeseries for SSP
tags:
- Risks
/poam-items:
get:
parameters:
Expand Down Expand Up @@ -23462,6 +23617,47 @@ paths:
summary: List risk audit trail
tags:
- Risks
/risks/{id}/score-history:
get:
description: Lists score snapshots for a risk.
parameters:
- description: Risk ID
in: path
name: id
required: true
type: string
- description: Page number
in: query
name: page
type: integer
- description: Page size
in: query
name: limit
type: integer
produces:
- application/json
responses:
"200":
description: OK
schema:
$ref: '#/definitions/service.ListResponse-handler_riskScoreResponse'
"400":
description: Bad Request
schema:
$ref: '#/definitions/api.Error'
"404":
description: Not Found
schema:
$ref: '#/definitions/api.Error'
"500":
description: Internal Server Error
schema:
$ref: '#/definitions/api.Error'
security:
- OAuth2Password: []
summary: List risk score history
tags:
- Risks
/risks/{id}/subjects:
get:
description: Lists subjects linked to a risk.
Expand Down Expand Up @@ -23742,6 +23938,46 @@ paths:
summary: Update risk threat reference
tags:
- Risks
/risks/score-timeseries:
get:
description: Returns aggregate open baseline and residual score time series.
parameters:
- description: SSP ID
in: query
name: sspId
type: string
- description: Start timestamp (RFC3339)
in: query
name: from
type: string
- description: End timestamp (RFC3339)
in: query
name: to
type: string
- description: Bucket size; only day is supported
in: query
name: bucket
type: string
produces:
- application/json
responses:
"200":
description: OK
schema:
$ref: '#/definitions/handler.GenericDataListResponse-handler_riskScoreTimeseriesResponse'
"400":
description: Bad Request
schema:
$ref: '#/definitions/api.Error'
"500":
description: Internal Server Error
schema:
$ref: '#/definitions/api.Error'
security:
- OAuth2Password: []
summary: Get risk score timeseries
tags:
- Risks
/users/{id}:
get:
description: Get minimal user details by user ID
Expand Down
Loading
Loading