Batch get risks by id

Description

Return the full representations of up to 250 risks in a single request. The response data array preserves the order of the requested ids. The request is all-or-nothing: if any id is missing or not accessible, the whole request fails with 400 and a per-id error list (see the error details); no partial results are returned.

POST /risks/batchRetrieval

Required OAuth Scopes

grc:read

Parameters

Parameter	In	Type	Required	Description
X-Version	header	string	true	Version of the API (2026-09-01.grc.preview)
body	body	BatchRetrievalRequest	true	The set of resource ids to retrieve.
Wk-Workspace	header	string	true	The id of the Workiva workspace to operate in. Authorization is enforced against the authenticated user’s access within this workspace.

Body parameter example

{
  "data": [
    "d9c09501-214c-432e-85c9-8cd1009b9660",
    "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"
  ]
}

Code Samples

curl

curl -X POST 'https://api.app.wdesk.com/risks/batchRetrieval' \
    -H 'Content-Type: application/json' \
    -H 'Accept: application/json' \
    -H 'Wk-Workspace: 1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d' \
    -H 'Authorization: Bearer {access-token}' \
    -H 'X-Version: 2026-09-01.grc.preview' \
    --data-raw '{"data":["d9c09501-214c-432e-85c9-8cd1009b9660","a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"]}'

httpie

echo '{"data":["d9c09501-214c-432e-85c9-8cd1009b9660","a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"]}' | http POST https://api.app.wdesk.com/risks/batchRetrieval \
    X-Version:2026-09-01.grc.preview \
    Content-Type:application/json \
    Accept:application/json \
    Wk-Workspace:1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d \
    Authorization:"Bearer {access-token}"

wget

wget --method=POST "https://api.app.wdesk.com/risks/batchRetrieval" \
    --output-document - \
    --header 'Content-Type: application/json' \
    --header 'Accept: application/json' \
    --header 'Wk-Workspace: 1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d' \
    --header 'Authorization: Bearer {access-token}' \
    --header 'X-Version: 2026-09-01.grc.preview' \
    --body-data='{"data":["d9c09501-214c-432e-85c9-8cd1009b9660","a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"]}'

python

import requests

headers = {
  'X-Version': '2026-09-01.grc.preview',
  'Content-Type': 'application/json',
  'Accept': 'application/json',
  'Wk-Workspace': '1a2b3c4d-5e6f-4a7b-8c9d-0e1f2a3b4c5d',
  'Authorization': 'Bearer {access-token}'
}

body = {
  "data": [
    "d9c09501-214c-432e-85c9-8cd1009b9660",
    "a1b2c3d4-e5f6-4a7b-8c9d-0e1f2a3b4c5d"
  ]
}

r = requests.post('https://api.app.wdesk.com/risks/batchRetrieval', headers = headers, json=body)

print(r.json())

Returns

200 - The requested risks, in request order.

The risks requested by a batch get, in request order. Batch results are not paginated.

400 - The request was invalid.

Error response indicating the service could not process the request.

401 - Authentication is missing or invalid.

Error response indicating the service could not process the request.

403 - The caller is not permitted to access this resource.

Error response indicating the service could not process the request.

429 - The rate limit has been exceeded.

Error response indicating the service could not process the request.

500 - An unexpected error occurred.

Error response indicating the service could not process the request.

Example Responses

The requested risks, in request order.

{
  "data": [
    {
      "customFields": [
        {
          "enumValue": "High",
          "id": "8f3c1a2b-4d5e-4f6a-8b7c-9d0e1f2a3b4c",
          "name": "Risk Rating",
          "type": "singleSelectEnum"
        },
        {
          "id": "3c4d5e6f-7a8b-4c9d-0e1f-2a3b4c5d6e7f",
          "name": "Review Notes",
          "stringValue": "Reviewed by internal audit.",
          "type": "string"
        }
      ],
      "description": "Risk that account balances are materially misstated.",
      "id": "9a8b7c6d-5e4f-4a3b-2c1d-0e9f8a7b6c5d",
      "mitigatingControls": [
        {
          "controlId": "BEN.001",
          "id": "d9c09501-214c-432e-85c9-8cd1009b9660",
          "name": "General Ledger Reconciliation"
        }
      ],
      "name": "Misstated account balances",
      "owner": {
        "id": "u_4cc9f9128a684f45a7a37b08b70b54c1"
      },
      "process": {
        "id": "2b1e5a7c-3d4f-4a1b-9c2d-6e7f8a9b0c1d",
        "name": "Financial Reporting"
      },
      "riskId": "R.001",
      "subProcess": {
        "id": "3c2f6b8d-4e5a-4b2c-8d3e-7f8a9b0c1d2e",
        "name": "Account Reconciliation"
      }
    }
  ]
}

The request was invalid.

{
  "code": "invalidFilter",
  "message": "The $filter value could not be parsed.",
  "target": "$filter"
}

Authentication is missing or invalid.

{
  "code": "unauthenticated",
  "message": "Authentication credentials were missing or invalid."
}

The caller is not permitted to access this resource.

{
  "code": "permissionDenied",
  "message": "You do not have permission to access this resource."
}

The rate limit has been exceeded.

{
  "code": "rateLimitExceeded",
  "message": "Rate limit exceeded. Retry after the period indicated in the response headers."
}

An unexpected error occurred.

{
  "code": "internalError",
  "message": "An unexpected error occurred. Please try again later."
}