Reassessments API

A reassessment (cbrsm_...) is a draft batch of assessments to run against a set of vendors, typically prompted by a radar event or alert. It lets you curate the vendor set and choose an assessment plan, then run it, without ever opening a case. A reassessment moves through four statuses:

Status	Meaning
`draft`	Newly created; awaiting review and vendor curation.
`confirmed`	Vendor set confirmed; ready to run.
`run`	Assessments have been created from the linked plan. Terminal.
`dismissed`	Closed without running. Terminal.

A reassessment in a terminal status (run or dismissed) is immutable. All endpoints are org-scoped to the API key. See API conventions for shared behavior.

Method	Path
`GET`	`/v1/reassessments`
`POST`	`/v1/reassessments`
`GET`	`/v1/reassessments/{reassessment_id}`
`PATCH`	`/v1/reassessments/{reassessment_id}`
`POST`	`/v1/reassessments/{reassessment_id}/vendors`
`POST`	`/v1/reassessments/{reassessment_id}/vendor_inclusion`
`POST`	`/v1/reassessments/{reassessment_id}/confirm`
`POST`	`/v1/reassessments/{reassessment_id}/dismiss`
`POST`	`/v1/reassessments/{reassessment_id}/run`
`GET`	`/v1/reassessment-rules`
`PUT`	`/v1/reassessment-rules`

None of these honor Idempotency-Key.

Create a reassessment

POST

POST /v1/reassessments

Returns 201 Created. Creates a draft reassessment from a radar event with an initial vendor set. The assessment plan is optional up front; set it later with a PATCH before running.

Request body

string

required

The radar event providing context for the reassessment (cbrevent_...).

string[]

required

Vendors to include (cbvndr_...). At least one; all must belong to the API key’s org.

string

Assessment plan to run (cbaspl_...). Optional; set later before running.

string

Reassessment title.

Example request

cURL

curl -X POST "https://api.coverbase.app/v1/reassessments" \
  -H "Authorization: Bearer ak_live_xxx" \
  -H "Content-Type: application/json" \
  -d '{
    "radar_event_id": "cbrevent_3333333333333333333333333333cccc",
    "vendor_ids": ["cbvndr_e448ba62882143f3ba0c140bb2e30162"],
    "title": "Reassess Acme after breach"
  }'

Returns the reassessment object.

Reassessment object

string

Reassessment ID (cbrsm_...).

string

draft, confirmed, run, or dismissed.

string | null

Title.

string | null

Linked assessment plan (cbaspl_...).

string | null

Source radar event (cbrevent_...).

string[]

Radar alerts that drove the reassessment.

object[]

Per-vendor entries; see below.

integer

Unix timestamp (seconds).

integer

Unix timestamp (seconds).

Each vendors[] entry:

string

Vendor (cbvndr_...).

string

How the vendor joined: matched (added at creation) or manual (added during review).

boolean

Whether the vendor is in the run set.

string | null

Assessment created for this vendor once the reassessment is run.

List reassessments

GET

GET /v1/reassessments

Query parameters

string

Filter by status (draft, confirmed, run, dismissed).

Returns an items array of reassessment objects, newest first, with total, limit, and offset. Every match is returned in one page.

Retrieve a reassessment

GET

GET /v1/reassessments/{reassessment_id}

Returns the reassessment object, or 404 reassessment_not_found.

Update a reassessment

PATCH

PATCH /v1/reassessments/{reassessment_id}

Update editable metadata. Only included fields change. Rejected with 422 reassessment_immutable once the reassessment is run or dismissed.

Request body

string

New title.

string

Assessment plan to run (cbaspl_...).

string

Re-link to a different radar event (cbrevent_...).

Curate the vendor set

POST

POST /v1/reassessments/{reassessment_id}/vendors

Add manually-selected vendors. Body: { "vendor_ids": ["cbvndr_..."] } (at least one).

POST

POST /v1/reassessments/{reassessment_id}/vendor_inclusion

Opt a single vendor in or out of the run set. Body: { "vendor_id": "cbvndr_...", "included": false }. Both return the refreshed reassessment object.

Confirm, dismiss, run

POST

POST /v1/reassessments/{reassessment_id}/confirm

Move a draft reassessment to confirmed (vendor set locked in, ready to run).

POST

POST /v1/reassessments/{reassessment_id}/dismiss

Close a reassessment without running it (dismissed).

POST

POST /v1/reassessments/{reassessment_id}/run

Create an assessment from the linked plan for each included vendor that does not have one yet, then mark the reassessment run. It can run from draft or confirmed. Requires assessment_plan_id to be set first; otherwise 400 missing_assessment_plan. This never creates a case. When the reassessment is linked to a radar event, running it also marks that event’s signal as triaged and applies the risk impact of the linked alerts (or, if none were recorded, the event’s active alerts) to the vendors.

Example request

cURL

curl -X POST "https://api.coverbase.app/v1/reassessments/cbrsm_1234/run" \
  -H "Authorization: Bearer ak_live_xxx"

All three return the refreshed reassessment object.

Error responses

Status	Body	When
400	`{"detail": {"code": "missing_assessment_plan", ...}}`	`run` called before an assessment plan is set.
404	`{"detail": {"code": "reassessment_not_found", ...}}`	Not found / not in the API key’s org.
422	`{"detail": {"code": "reassessment_immutable", ...}}`	Editing or running a `run`/`dismissed` reassessment.
422	`{"detail": {"code": "invalid_reassessment", ...}}`	The request was rejected, for example a vendor or plan that does not resolve.

Reassessment rules

GET

GET /v1/reassessment-rules

Returns how often vendors are reassessed: risk_basis, the organization’s default timeline in org_timeline, and for each assessment plan its rules (risk_level_ids and interval_months) and its own timeline. It also returns a revision. Reading needs org_settings:read:org. An API key gets 403 api_key_not_allowed unless its service-account role holds it.

PUT

PUT /v1/reassessment-rules

Replaces every rule and timeline. Send the revision from your last read, the risk_basis, and every plan in plans; send plans: [] to clear the rules. A revision that changed since you read it returns 409 revision_conflict, and a configuration Coverbase rejects returns 422 invalid_reassessment_rules. Replacing needs org_settings:update:org. An API key gets 403 api_key_not_allowed unless its service-account role holds it.

Radar API: the events and alerts that prompt reassessments.
Webhooks: subscribe to Reassessment.* events.

Getting started

API reference

Data import and export

Field reference

Integration workflows

AI, agents and MCP

Create a reassessment

Request body

Example request

Reassessment object

List reassessments

Query parameters

Retrieve a reassessment

Update a reassessment

Request body

Curate the vendor set

Confirm, dismiss, run

Example request

Error responses

Reassessment rules

​Create a reassessment

​Request body

​Example request

​Reassessment object

​List reassessments

​Query parameters

​Retrieve a reassessment

​Update a reassessment

​Request body

​Curate the vendor set

​Confirm, dismiss, run

​Example request

​Error responses

​Reassessment rules

​Related

Create a reassessment

Request body

Example request

Reassessment object

List reassessments

Query parameters

Retrieve a reassessment

Update a reassessment

Request body

Curate the vendor set

Confirm, dismiss, run

Example request

Error responses

Reassessment rules

Related