---
title: "List risk events"
method: GET
path: "/v1/supplychains/{supply_chain_id}/risk-events"
tags: ["Supplier Risk"]
---

# List risk events

`GET /v1/supplychains/{supply_chain_id}/risk-events`

## Request

- Base URL: `https://api.platform.censys.io`
- URL: `https://api.platform.censys.io/v1/supplychains/{supply_chain_id}/risk-events`
- Auth: HTTP bearer

Retrieve risk state-transition events (opened, resolved, reopened). When polling for new events, always pass inserted_after_time, starting from the time the sync begins (or 1970-01-01T00:00:00Z for full history), and follow next_page_token until it is empty. For the next poll, pass the inserted_at and id of the last event processed as inserted_after_time and inserted_after_event_id. Without inserted_after_time, events are not returned in insert order, so the last event is not a reliable cursor. Restarting from an earlier event returns events again, so events should be deduplicated by id.<br><br>A single request can read events for at most 1000 suppliers. For a supply chain with more than 1000 suppliers, supplier_ids must be set to narrow the request to 1000 or fewer; omitting it returns a 400.<br><br>This endpoint does not cost credits to execute.

## Path parameters

- `supply_chain_id` string, required: The ID of a Censys supply chain, or the literal 'default' for your organization's primary supply chain. Obtain the supply chain ID using the [list supply chains endpoint](https://docs.censys.com/reference/v1-supply-chain-list-supply-chains#/) or from the Supplier Risk URL in the web console.

## Query parameters

- `organization_id` string, uuid, required: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.
- `supplier_ids` string[], nullable: Narrow results to one or more Censys suppliers, up to 1000. For multiple values, include comma-separated values. When omitted, every supplier in the supply chain is included, so a supply chain with more than 1000 suppliers must be narrowed with this parameter.
- `change_types` string[], nullable: Filter to one or more change types. For multiple values, include comma-separated values.
- `severity` string[], nullable: Filter to one or more severities. For multiple values, include comma-separated values. Connectors are expected to default to HIGH,CRITICAL for alerting use cases.
- `risk_type_ids` string[], nullable: Filter to one or more risk type IDs, up to 100, e.g. CVE-2021-44228. For multiple values, include comma-separated values.
- `rapid_response` 'true' | 'false': Filter to risk events flagged (or not flagged) for rapid response. Omit to include both.
- `page_size` integer: Maximum number of risk events to return per page.
- `start_time` string, date-time: Only return events that occurred at or after this time. Must be a valid RFC3339 string, must be provided together with end_time, and cannot be combined with inserted_after_time.
- `end_time` string, date-time: Only return events that occurred at or before this time. Must be a valid RFC3339 string, must be provided together with start_time, must not be before start_time, and cannot be combined with inserted_after_time.
- `page_token` string: Pagination token from a previous response to retrieve the next page of results. When paginating, provide the same filters, start_time, end_time, inserted_after_time and inserted_after_event_id as the request that returned the token.
- `inserted_after_time` string, date-time: Only return events inserted after this time. Must be a valid RFC3339 string. When polling for new events, always include this, starting from the time the sync begins (or 1970-01-01T00:00:00Z for full history), then continue from the inserted_at of the last event processed. Cannot be combined with start_time and end_time.
- `inserted_after_event_id` string: The id of the last event processed, used together with inserted_after_time. Of the events inserted at exactly inserted_after_time, only those whose id sorts after this one are returned. Requires inserted_after_time.

## Headers

- `X-Organization-ID` string, uuid: The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

## Response `200`

Risk events returned successfully

- ResponseEnvelopeListRiskEventsResponse
  - `result` ListRiskEventsResponse
    - `next_page_token` string: Pagination token for the next page of results, if any.
    - `risk_events` RiskEvent[], nullable, required: Risk events in commit order.
      - `change_type` 'opened' | 'resolved' | 'reopened', required: The kind of change this event represents.
      - `id` string, required: The unique ID of the event. Used to deduplicate events and, with inserted_at, to continue polling via inserted_after_time and inserted_after_event_id.
      - `inserted_at` string, date-time: When this event was recorded in Censys. Differs from occurred_at, which is when the change occurred.
      - `occurred_at` string, date-time, required: When this change occurred.
      - `risk_instance` RiskInstance, required
        - `asset_type` string, required: Which asset type the locus fields describe, e.g. host or web.
        - `confidence` number, double, required: Confidence that this finding is real, from 0 to 1.
        - `created_at` string, date-time: When the instance record was created in Censys.
        - `description` string: Description of this risk.
        - `evidence` string: Evidence supporting the identification of this risk on this asset.
        - `first_detected_at` string, date-time: When this risk instance was first observed.
        - `host` SupplyChainRiskInstanceHost
          - `ip` string, required: IP address of the host this risk was observed on.
        - `id` string, required: Unique identifier of this risk instance.
        - `last_detected_at` string, date-time: Most recent time this risk instance was observed.
        - `platform_url` string, uri: Deep link to the asset this risk was observed on, in the context of this supply chain and supplier, if the asset type is recognized.
        - `rapid_response` boolean, required: Whether this risk type was authored as a rapid response to an emerging threat.
        - `remediations` string[], nullable: Recommended remediation steps for this risk, in the order they should be applied.
        - `resolve_reason` 'finding_removed' | 'service_removed' | 'web_property_removed' | 'asset_removed': Why this risk instance resolved. Present only when status is closed.
        - `resolve_time` string, date-time: When this risk instance resolved. Present only when status is closed; absent while open, and cleared again if the instance later reopens.
        - `risk_category` 'VULNERABILITY' | 'EXPOSURE' | 'MISCONFIGURATION' | 'THREAT', required: Category of this risk.
        - `risk_name` string, required: Human-readable name of this risk, e.g. "Unencrypted HTTP Weak Auth".
        - `risk_type_id` string, required: Risk identifier shared across every instance of this risk, e.g. a CVE ID or a Censys catalog ID.
        - `score` number, double, required: Priority score from 0.0-10.0, derived from asset importance, severity, and exploitability.
        - `service` SupplyChainRiskInstanceService
          - `port` integer, required: Port the service runs on.
          - `protocol` string, required: Application protocol identified on the service, e.g. SSH, HTTP.
          - `transport_protocol` string, required: Transport protocol of the service, e.g. TCP, UDP, ICMP, QUIC.
        - `severity` 'UNSPECIFIED' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL', required: Severity of this risk.
        - `status` 'open' | 'closed', required: Status of this risk instance: open or closed.
        - `suppliers` SupplyChainRiskInstanceSupplier[], nullable: Suppliers this risk instance's asset belongs to.
          - `display_name` string: Display name of the supplier.
          - `id` string, uuid, required: Unique ID of the supplier.
        - `supply_chain_id` string, uuid, required: The supply chain this risk instance belongs to.
        - `tags` SearchQueryTagInfo[], nullable: Tags applied to the parent asset as of when this risk was last observed.
          - `display_name` string, required: Name of the tag.
          - `id` string, uuid: ID of the tag.
        - `web` SupplyChainRiskInstanceWeb
          - `hostname` string, required: Hostname of the web property this risk was observed on.
          - `port` integer, required: Port of the web property this risk was observed on.
    - `supplier_ids` string[], nullable: The supplier(s) these events belong to. Omitted when the page has no events.
    - `supply_chain_id` string, uuid, required: The supply chain this listing was scoped to, resolved from 'default' if that was given.

## Other responses

- `400`: Invalid arguments
- `401`: Request does not contain a valid Authorization token
- `403`: User does not have permission to access this data
- `404`: Resource not found
- `409`: Conflict
- `422`: Invalid inputs
- `500`: Internal server error

## Changes

- **2026-11-03** `ec1686b0a36a`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/censys/apis/censys-platform-api/changes/v1/supplychains/:supply_chain_id/risk-events/get.md)

---

[API](https://skmtc.dev/censys/apis/censys-platform-api.md) - [All operations](https://skmtc.dev/censys/apis/censys-platform-api/llms.txt) - [OpenAPI document](https://skmtc.dev/censys/apis/censys-platform-api/revisions/ec1686b0a36a?raw)