RiskRecon

Record your RiskRecon connection as vendor procurement evidence. Automated collection is not available for this provider yet.

Connect with an API token

1. In RiskRecon:

   1. Log in to the RiskRecon web portal (https://auth.riskrecon.com/users/sign_in) as an administrator. Administrator privileges are required to create an API key.
   2. Select System Administration from the My Account drop-down list.
   3. Select the API Keys tab on the System Administrator page.
   4. Select the New API Key button.
   5. Enter the purpose of the key (for example "Safeguard") in the Description box.
   6. Choose how long the key is valid from the Select key expiration drop-down list (at most one year).
   7. Click Create API Key. The key is generated in JWT format and listed in the API Keys section of the System Administrator page.
   8. Click the Copy icon next to the listed API key to copy and save it.

   RiskRecon is a Mastercard company and its API docs live on Mastercard Developers. The API key is a long-lived OAuth 2.0 bearer token (JWT) valid for at most one year, with no refresh token; RiskRecon emails a reminder 7 days before it expires, after which a new key must be created. RiskRecon documents no scopes or read-only option for API keys. Portal access, and therefore API access, is provisioned by RiskRecon's sales team at onboarding; users without portal access must ask RiskRecon customer care (support@riskrecon.com) to create an account. The tutorial does not say whether the key stays visible after creation (it is listed with a Copy icon). Verification (2026-10-07): the base URL entry (api.riskrecon.com / api.sandbox.riskrecon.com) came from the API reference page, which was not re-fetched (three-source limit) and is not stated on the fetched pages, so it was removed.

   Source: developer.mastercard.com, developer.mastercard.com, developer.mastercard.com, developer.mastercard.com, checked 2026-10-07.

2. On Compliance › Connectors, open RiskRecon, click Connect, choose API token and fill in:

   Field	What to enter
   API token / Personal access token	Required. Stored encrypted and never shown again.
   Base URL (optional)	—
   Account / Org / Workspace (optional)	—

3. Click Connect with token.

Frameworks

RiskRecon publishes no API for what these tests check, so its evidence is an attestation: connect it to record the connection, then attest the result. An accepted attestation counts toward each control below.

These tests are switched on per workspace by the Safeguard team.

Related

• Vendor Procurement connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks