Analyses and knowledge capitalization #

Available

The /analysis-workspace route structures risk analyses over time and preserves their governed deliverables.

Create a versioned analysis #

An analysis has a stable key, title, method (EBIOS_RM, ISO_27005 or SIMPLIFIED), version, status and linked scenarios. Risk managers create and revise analyses; administrators provide final approval.

Quality and comparison #

The service calculates completeness and supports an explicit quality check. Versions can be compared to identify method, scenario or result changes. A revision retains history rather than silently overwriting the previous version.

Governed artifacts #

An analysis accepts structured artifacts such as evidence, simulations, roadmaps and other typed deliverables. Each artifact has a title, JSON payload and idempotency key; approval is separate from creation. Imports begin with a preview so content can be reviewed before integration.

Security and oversight #

Analyses, versions and artifacts remain scoped to the current organization. Administration metrics help monitor volume and quality without replacing expert review of scope and assumptions.

Complete workflow #

A Risk manager creates a draft with stable key, method, objectives, team, milestones, scenarios, scale and scope. Use the revision endpoint to create a version instead of overwriting an approved analysis. Quality checks require objectives, team and scenarios and flag missing or foreign scenarios. Administrator approval returns INVALID_APPROVAL until quality and separation-of-duties conditions pass.

Comparison takes left and right, returning added and removed scenarios, completeness delta and rule EXPLICIT_SET_DIFFERENCE_V1. Artifacts are filterable by kind and paginated from 1 to 100. Their idempotency key prevents duplicate creation.

Artifact kinds #

METHOD_STEP, EVIDENCE, CONTROL_EFFECTIVENESS, TREATMENT_SCENARIO, ROADMAP_OPTION, ACL_GRANT, ACTIVITY, IMPORT_BATCH, LIBRARY_UPDATE, SUPPLIER_TIER and PRODUCT_METRIC cover method steps, evidence, simulations, access decisions, imports and metrics. Do not use free JSON to bypass an existing business register.

Analysis API #

Method	Endpoint	Purpose
`GET	POST`	`/api/analysis-workspace/analyses`	paginated list; Risk manager create
`PUT`	`/api/analysis-workspace/analyses/{id}`	edit a draft
`POST`	`/api/analysis-workspace/analyses/{id}/revisions`	create a version
`POST`	`/api/analysis-workspace/analyses/{id}/quality`	run quality controls
`POST`	`/api/analysis-workspace/analyses/{id}/approve`	administrator approval
`GET`	`/api/analysis-workspace/compare?left=1&right=2`	compare visible versions
`GET	POST`	`/api/analysis-workspace/analyses/{id}/artifacts`	list or create deliverables
`POST`	`/api/analysis-workspace/artifacts/{id}/approve`	approve an artifact
`POST`	`/api/analysis-workspace/imports/preview`	validate up to 1,000 rows
`GET`	`/api/analysis-workspace/metrics`	administrator metrics

Import preview requires a unique externalId per row and persists nothing. It returns MISSING_ID or DUPLICATE for each rejection.