---
title: "List risk events"
method: GET
path: "/v1/risk/events"
tags: ["Risk Engine"]
---

# List risk events

`GET /v1/risk/events`

## Request

- Base URL: `https://api.1claw.co`
- URL: `https://api.1claw.co/v1/risk/events`
- Auth: HTTP bearer

Returns risk events detected by the risk engine, ordered by most recent first.
Filter by severity or principal type.

## Query parameters

- `severity` 'low' | 'medium' | 'high' | 'critical'
- `principal_type` 'user' | 'agent'
- `limit` integer
- `offset` integer

## Response `200`

Risk event list

- RiskEventListResponse
  - `events` RiskEvent[], required
    - `id` string, uuid, required
    - `occurred_at` string, date-time, required
    - `principal_type` 'user' | 'agent', required
    - `principal_id` string, uuid, required
    - `org_id` string, uuid, required
    - `event_type` string, required: Risk event type (e.g. first_seen, geo_velocity, honeytoken_access)
    - `ip` string, nullable
    - `asn` integer, nullable
    - `asn_org` string, nullable
    - `country_code` string, nullable
    - `region` string, nullable
    - `city` string, nullable
    - `latitude` number, nullable
    - `longitude` number, nullable
    - `user_agent` string, nullable
    - `severity` string, nullable: Computed severity at event time (low, medium, high, critical)
    - `payload` object, required
    - `created_at` string, date-time, required

## Other responses

- `401`: Authentication required or invalid

---

[API](https://skmtc.dev/1claw/apis/1claw-api.md) · [All operations](https://skmtc.dev/1claw/apis/1claw-api/llms.txt) · [OpenAPI document](https://skmtc.dev/1claw/apis/1claw-api/revisions/ae109b496830?raw)