CEcensys
Exposure Management

List attack surface risk events

Changed on

Retrieve risk state-transition events (opened, resolved, reopened) of your attack surface. Events are returned in commit order. When polling for new events, always pass inserted_after_time, starting from the time the sync begins (or 1970-01-01T00:00:00Z for full history), and follow next_page_token until it is empty; events are then returned in insert order. For the next poll, pass the inserted_at and id of the last event processed as inserted_after_time and inserted_after_event_id. Without inserted_after_time, events are not returned in insert order, so the last event is not a reliable cursor. Restarting from an earlier event returns events again, so events should be deduplicated by id.<br><br>This endpoint does not cost credits to execute.

get/v1/attacksurfaces/{attack_surface_id}/risk-events

Request

  • Base URL
    https://api.platform.censys.io
  • URL
    https://api.platform.censys.io/v1/attacksurfaces/{attack_surface_id}/risk-events
  • Auth
    HTTP bearer

Path parameters

attack_surface_idstring required

The ID of the attack surface, or the literal 'default' for your organization's attack surface. Obtain the attack surface ID using the list attack surfaces endpoint.

Example:11111111-2222-3333-4444-555555555555

Query parameters

organization_idstring uuid required

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information.

Example:11111111-2222-3333-4444-555555555555
change_typesstring[] nullable

Filter to one or more change types. For multiple values, include comma-separated values.

severitystring[] nullable

Filter to one or more severities. For multiple values, include comma-separated values. Connectors are expected to default to HIGH,CRITICAL for alerting use cases.

risk_type_idsstring[] nullable

Filter to one or more risk type IDs, up to 100, e.g. CVE-2021-44228. For multiple values, include comma-separated values.

[
  "CVE-2021-44228"
]
rapid_response'true' | 'false'

Filter to risk events flagged (or not flagged) for rapid response. Omit to include both.

page_sizeinteger

Maximum number of risk events to return per page.

start_timestring date-time

Only return events that occurred at or after this time. Must be a valid RFC3339 string, must be provided together with end_time, and cannot be combined with inserted_after_time.

Example:2026-09-01T00:00:00Z
end_timestring date-time

Only return events that occurred at or before this time. Must be a valid RFC3339 string, must be provided together with start_time, must not be before start_time, and cannot be combined with inserted_after_time.

Example:2026-10-01T00:00:00Z
page_tokenstring

Pagination token from a previous response to retrieve the next page of results. When paginating, provide the same filters, start_time, end_time, inserted_after_time and inserted_after_event_id as the request that returned the token.

inserted_after_timestring date-time

Only return events inserted after this time. Must be a valid RFC3339 string. When polling for new events, always include this, starting from the time the sync begins (or 1970-01-01T00:00:00Z for full history), then continue from the inserted_at of the last event processed. Cannot be combined with start_time and end_time.

Example:2026-10-01T00:00:00Z
inserted_after_event_idstring

The id of the last event processed, used together with inserted_after_time. Of the events inserted at exactly inserted_after_time, only those whose id sorts after this one are returned. Requires inserted_after_time.

Headers

X-Organization-IDstring uuid

The ID of a Censys organization to associate the request with. See the Getting Started docs for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

Example:11111111-2222-3333-4444-555555555555

Response

Risk events returned successfully

Changes