---
title: "List attack surface risk events"
method: GET
path: "/v1/attacksurfaces/{attack_surface_id}/risk-events"
tags: ["Exposure Management"]
---

# List attack surface risk events

`GET /v1/attacksurfaces/{attack_surface_id}/risk-events`

## Request

- Base URL: `https://api.platform.censys.io`
- URL: `https://api.platform.censys.io/v1/attacksurfaces/{attack_surface_id}/risk-events`
- Auth: HTTP bearer

Retrieve risk state-transition events (opened, resolved, reopened) of your attack surface. Events are returned in commit order. When polling for new events, always pass inserted_after_time, starting from the time the sync begins (or 1970-01-01T00:00:00Z for full history), and follow next_page_token until it is empty; events are then returned in insert order. For the next poll, pass the inserted_at and id of the last event processed as inserted_after_time and inserted_after_event_id. Without inserted_after_time, events are not returned in insert order, so the last event is not a reliable cursor. Restarting from an earlier event returns events again, so events should be deduplicated by id.<br><br>This endpoint does not cost credits to execute.

## Path parameters

- `attack_surface_id` string, required: The ID of the attack surface, or the literal 'default' for your organization's attack surface. Obtain the attack surface ID using the list attack surfaces endpoint.

## Query parameters

- `organization_id` string, uuid, required: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.
- `change_types` string[], nullable: Filter to one or more change types. For multiple values, include comma-separated values.
- `severity` string[], nullable: Filter to one or more severities. For multiple values, include comma-separated values. Connectors are expected to default to HIGH,CRITICAL for alerting use cases.
- `risk_type_ids` string[], nullable: Filter to one or more risk type IDs, up to 100, e.g. CVE-2021-44228. For multiple values, include comma-separated values.
- `rapid_response` 'true' | 'false': Filter to risk events flagged (or not flagged) for rapid response. Omit to include both.
- `page_size` integer: Maximum number of risk events to return per page.
- `start_time` string, date-time: Only return events that occurred at or after this time. Must be a valid RFC3339 string, must be provided together with end_time, and cannot be combined with inserted_after_time.
- `end_time` string, date-time: Only return events that occurred at or before this time. Must be a valid RFC3339 string, must be provided together with start_time, must not be before start_time, and cannot be combined with inserted_after_time.
- `page_token` string: Pagination token from a previous response to retrieve the next page of results. When paginating, provide the same filters, start_time, end_time, inserted_after_time and inserted_after_event_id as the request that returned the token.
- `inserted_after_time` string, date-time: Only return events inserted after this time. Must be a valid RFC3339 string. When polling for new events, always include this, starting from the time the sync begins (or 1970-01-01T00:00:00Z for full history), then continue from the inserted_at of the last event processed. Cannot be combined with start_time and end_time.
- `inserted_after_event_id` string: The id of the last event processed, used together with inserted_after_time. Of the events inserted at exactly inserted_after_time, only those whose id sorts after this one are returned. Requires inserted_after_time.

## Headers

- `X-Organization-ID` string, uuid: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

## Response `200`

Risk events returned successfully

- ResponseEnvelopeAttackSurfaceListRiskEventsResponse
  - `result` AttackSurfaceListRiskEventsResponse
    - `next_page_token` string: Pagination token for the next page of results. Omitted on the last page.
    - `risk_events` AttackSurfaceRiskEvent[], required: Risk events in commit order, or in insert order when inserted_after_time is set.
      - `change_type` 'opened' | 'resolved' | 'reopened', required: The kind of change this event represents.
      - `id` string, required: The unique ID of the event. Used to deduplicate events and, with inserted_at, to continue polling via inserted_after_time and inserted_after_event_id.
      - `inserted_at` string, date-time: When this event was recorded in Censys. Differs from occurred_at, which is when the change occurred.
      - `occurred_at` string, date-time, required: When this change occurred.
      - `risk_instance` AttackSurfaceRiskInstance, required
        - `asset_type` string, required: Which asset type the locus fields describe, e.g. host or web.
        - `confidence` number, double, required: Confidence that this finding is real, from 0 to 1.
        - `created_at` string, date-time: When the instance record was created in Censys.
        - `description` string: Description of this risk.
        - `evidence` string: Evidence supporting the identification of this risk on this asset.
        - `first_detected_at` string, date-time: When this risk instance was first observed.
        - `host` AttackSurfaceRiskInstanceHost
          - `ip` string, required: IP address of the host this risk was observed on.
        - `id` string, required: Unique identifier of this risk instance.
        - `last_detected_at` string, date-time: Most recent time this risk instance was observed.
        - `rapid_response` boolean, required: Whether this risk type was authored as a rapid response to an emerging threat.
        - `remediations` string[], nullable: Recommended remediation steps for this risk, in the order they should be applied.
        - `resolve_reason` 'finding_removed' | 'service_removed' | 'web_property_removed' | 'asset_removed': Why this risk instance resolved. Present only when status is closed.
        - `resolve_time` string, date-time: When this risk instance resolved. Present only when status is closed.
        - `risk_category` 'VULNERABILITY' | 'EXPOSURE' | 'MISCONFIGURATION' | 'THREAT', required: Category of this risk.
        - `risk_name` string, required: Human-readable name of this risk, e.g. "Unencrypted HTTP Weak Auth".
        - `risk_type_id` string, required: Risk identifier shared across every instance of this risk, e.g. a CVE ID or a Censys catalog ID.
        - `score` number, double, required: Priority score from 0.0-10.0, derived from asset importance, severity, and exploitability.
        - `service` AttackSurfaceRiskInstanceService
          - `port` integer, required: Port the service runs on.
          - `protocol` string, required: Application protocol identified on the service, e.g. SSH, HTTP.
          - `transport_protocol` string, required: Transport protocol of the service, e.g. TCP, UDP, ICMP, QUIC.
        - `severity` 'UNSPECIFIED' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL', required: Severity of this risk.
        - `status` 'open' | 'closed', required: Status of this risk instance: open or closed.
        - `tags` SearchQueryTagInfo[], nullable: Tags applied to the parent asset as of when this risk was last observed.
          - `display_name` string, required: Name of the tag.
          - `id` string, uuid: ID of the tag.
        - `web` AttackSurfaceRiskInstanceWeb
          - `hostname` string, required: Hostname of the web property this risk was observed on.
          - `port` integer, required: Port of the web property this risk was observed on.

## Other responses

- `400`: Invalid page token
- `401`: Request does not contain a valid Authorization token
- `403`: User does not have permission to access this data
- `404`: Attack surface not found
- `409`: The Exposure Management API is not enabled, or the operation conflicts with the attack surface's current state.
- `422`: Invalid inputs
- `500`: Internal server error

## Changes

- **2026-11-03** `ec1686b0a36a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/censys/apis/censys-platform-api/changes/v1/attacksurfaces/:attack_surface_id/risk-events/get.md)

---

[API](https://skmtc.dev/censys/apis/censys-platform-api.md) - [All operations](https://skmtc.dev/censys/apis/censys-platform-api/llms.txt) - [OpenAPI document](https://skmtc.dev/censys/apis/censys-platform-api/revisions/ec1686b0a36a?raw)