--- title: "List Entity Risk" method: POST path: "/security-entity-risk/get-list" tags: ["Entity Risk"] --- # List Entity Risk `POST /security-entity-risk/get-list` ## Request - Base URL: `https://oneuptime.com/api` - URL: `https://oneuptime.com/api/security-entity-risk/get-list` - Auth: API key in header `APIKey` - TypeScript: (a function with typed inputs; its response is checked against the schema) Endpoint to list all Entity Risk items ## Request body - object - `query` SecurityEntityRiskQuerySchema: Query schema for SecurityEntityRisk. A field takes a value, which it matches exactly, or an operator its type allows. A relation is filtered by the fields of the record it names, {"": {"": }}, and a resource with owners by who owns it, {"owners": {"_type": "OwnedBy", "userIds": [...], "teamIds": [...]}}. - `_id` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `createdAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `updatedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `deletedAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `projectId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `entityType` union: A filter on a Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `entityValue` union: A filter on a Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `entityKey` union: A filter on a Long Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `riskScore` union: A filter on a Number field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. - number - object - `_type` 'EqualTo', required - `value` number, required - object - `_type` 'NotEqual', required - `value` number, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` number, required - object - `_type` 'GreaterThan', required - `value` number, required - object - `_type` 'LessThan', required - `value` number, required - object - `_type` 'GreaterThanOrEqual', required - `value` number, required - object - `_type` 'LessThanOrEqual', required - `value` number, required - object - `_type` 'InBetween', required - `startValue` number, required - `endValue` number, required - `criticality` union: A filter on a Text field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes. - string - object - `_type` 'EqualTo', required - `value` string, required - object - `_type` 'NotEqual', required - `value` string, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, required - object - `_type` 'Search', required - `value` string, required - object - `_type` 'Includes', required - `value` string[], required - `contributorCount` union: A filter on a Number field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. - number - object - `_type` 'EqualTo', required - `value` number, required - object - `_type` 'NotEqual', required - `value` number, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` number, required - object - `_type` 'GreaterThan', required - `value` number, required - object - `_type` 'LessThan', required - `value` number, required - object - `_type` 'GreaterThanOrEqual', required - `value` number, required - object - `_type` 'LessThanOrEqual', required - `value` number, required - object - `_type` 'InBetween', required - `startValue` number, required - `endValue` number, required - `contributions` union: A filter on a JSON field, by key: {"": {"": }}. A key takes a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. IsNull and NotNull on the field itself ask whether it holds anything. - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `mitreTactics` union: A filter on a JSON field, by key: {"": {"": }}. A key takes a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. IsNull and NotNull on the field itself ask whether it holds anything. - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `mitreTechniques` union: A filter on a JSON field, by key: {"": {"": }}. A key takes a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. IsNull and NotNull on the field itself ask whether it holds anything. - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `firstRiskAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `lastRiskAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `riskExpiresAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `riskCaseAt` union: A filter on a Date field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. Times are ISO-8601, such as 2026-01-01T00:00:00.000Z. - string, date-time - object - `_type` 'EqualTo', required - `value` string, date-time, required - object - `_type` 'NotEqual', required - `value` string, date-time, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, date-time, required - object - `_type` 'GreaterThan', required - `value` string, date-time, required - object - `_type` 'LessThan', required - `value` string, date-time, required - object - `_type` 'GreaterThanOrEqual', required - `value` string, date-time, required - object - `_type` 'LessThanOrEqual', required - `value` string, date-time, required - object - `_type` 'InBetween', required - `startValue` string, date-time, required - `endValue` string, date-time, required - `riskHistory` union: A filter on a JSON field, by key: {"": {"": }}. A key takes a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Search, Includes, GreaterThan, LessThan, GreaterThanOrEqual, LessThanOrEqual, InBetween. IsNull and NotNull on the field itself ask whether it holds anything. - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `deletedByUserId` union: A filter on a Object ID field: a value, which it matches exactly, or one of these operators: EqualTo, NotEqual, IsNull, NotNull, EqualToOrNull, Includes. - string, uuid - object - `_type` 'EqualTo', required - `value` string, uuid, required - object - `_type` 'NotEqual', required - `value` string, uuid, required - object - `_type` 'IsNull', required - object - `_type` 'NotNull', required - object - `_type` 'EqualToOrNull', required - `value` string, uuid, required - object - `_type` 'Includes', required - `value` string[], required - `select` SecurityEntityRiskSelectSchema: Select schema for SecurityEntityRisk. Set fields to true to include them in the response. - `_id` boolean - `createdAt` boolean - `updatedAt` boolean - `deletedAt` boolean - `projectId` boolean - `entityType` boolean - `entityValue` boolean - `entityKey` boolean - `riskScore` boolean - `criticality` boolean - `contributorCount` boolean - `contributions` boolean - `mitreTactics` boolean - `mitreTechniques` boolean - `firstRiskAt` boolean - `lastRiskAt` boolean - `riskExpiresAt` boolean - `riskCaseAt` boolean - `riskHistory` boolean - `deletedByUserId` boolean - `sort` SecurityEntityRiskSortSchema: Sort schema for SecurityEntityRisk. Only sortable fields are included. - `_id` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `createdAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `updatedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `deletedAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `projectId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `entityType` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `entityValue` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `entityKey` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `riskScore` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `criticality` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `contributorCount` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `firstRiskAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `lastRiskAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `riskExpiresAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `riskCaseAt` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `deletedByUserId` 'ASC' | 'DESC': The order of a sort: ASC (ascending) or DESC (descending). - `limit` number: Maximum number of items to return. Defaults to 10. - `skip` number: Number of items to skip for pagination. Defaults to 0. ## Response `200` Successful response - object - `data` SecurityEntityRisk[] - `_id` string, uuid: ID of this object. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `createdAt` object: Date and Time when the object was created. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `updatedAt` object: Date and Time when the object was updated. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `deletedAt` object: Date and Time when the object was deleted. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `version` number: Object version - `projectId` string, uuid, required: ID of the project this entity's risk belongs to. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `entityType` 'User' | 'Host' | 'IP Address' | 'Domain' | 'URL' | 'File Hash' | 'Process' | 'Data Store' | 'Other', required: What the entity is: a User, a Host, an IP Address or a Data Store. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `entityValue` string, required: The user's sign-in name, the host's name or the address, as the first finding about it named it. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `entityKey` string, required: The entity's value, trimmed and in lower case: one entity's risk, whatever case its findings write it in. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `riskScore` number, required: What its sources of the last 7 days add up to, weighted by how much it matters. A case opens at the project's threshold. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `criticality` 'Low' | 'High' | 'Extreme': How much it matters, from the project's Entity Criticality list: Low (x0.5), High (x1.5) or Extreme (x2). Empty counts as it is. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `contributorCount` number, required: How many different detection rules, threat intel feeds and connected products' rules add to its risk. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `contributions` object: What adds to its risk: each source with its severity, its points, how often it fired and when. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `mitreTactics` object: ATT&CK tactic ids (TA0006) its sources are tagged with. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `mitreTechniques` object: ATT&CK technique ids (T1110) its sources are tagged with. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `firstRiskAt` object: When the sources that count now began counting. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `lastRiskAt` object: When a finding last added to its risk. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `riskExpiresAt` object: When its score next falls, as the first of its sources stops counting. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `riskCaseAt` object: When its risk last reached the threshold and opened a case, or joined the open case about it. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `riskHistory` object: Its risk score at the end of each of the last 30 days. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `deletedByUserId` string, uuid: ID of the person who reset this entity's risk. Permissions - Create: [No access - you don't have permission for this operation], Read: [Project Owner, Project Admin, Security Admin, Security Member, Security Viewer, Read Security Detection], Update: [No access - you don't have permission for this operation] - `count` number ## Other responses - `400`: Bad request. This response indicates that the request was malformed or contained invalid data. - `401`: Unauthorized. This response indicates that the request requires user authentication. - `402`: Payment Required. This response indicates that the request requires payment or a valid subscription. - `403`: Forbidden. This response indicates that the server understood the request, but refuses to authorize it. - `405`: Project not found. This response indicates that the requested project does not exist or is not accessible. - `408`: Request Timeout. This response indicates that the server timed out waiting for the request. - `415`: Unable to reach server. This response indicates that the server is currently unreachable or down. - `422`: Not authorized. This response indicates that the user does not have permission to access the requested resource. - `500`: Internal Server Error. This response indicates that the server encountered an unexpected condition that prevented it from fulfilling the request. --- [API](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification.md) - [All operations](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/llms.txt) - [OpenAPI document](https://skmtc.dev/oneuptime/apis/oneuptime-openapi-specification/revisions/ba3307d00304?raw)