---
title: "This resource returns a collection of `BreachEvent` objects."
method: GET
path: "/v1/portfolio_data_loss_events"
tags: ["Data Loss Events"]
---

# This resource returns a collection of `BreachEvent` objects.

`GET /v1/portfolio_data_loss_events`

This resource returns a collection of `DataLossEvent` objects for a portfolio. This is for the entire portfolio and has pagination unlike the data_loss_events route.

## Query parameters

- `sort_attribute` 'breach_event_date' | 'public_event_date' | 'created_at'
- `breach_event_start_date` string, date
- `toe_id` string
- `created_at_start_date` string, date
- `page` integer
- `per_page` integer
- `public_event_start_date` string, date
- `risk_relationship_slugs[]` string[]
- `sort_method` 'ASC' | 'DESC'

## Response `200`

OK

- BreachEvents
  - `meta` PaginationMeta, required
    - `current_page` integer — The current page of paginated responses.
    - `next_page` integer, nullable — The next page of paginated responses if applicable.
    - `prev_page` integer, nullable — The previous page of paginated responses if applicable.
    - `total_count` integer — The total count of items.
    - `total_pages` integer — The total number of pages for paginated responses.
  - `data` object[], required — Data associated with response object.
    - `attributes` BreachEvent, required
      - `id` integer, required — The identifier associated with response object.
      - `uuid` string, uuid, nullable, required — The unique identifier for a data loss event.
      - `analysis_id` string, required — The analysis_id associated with the finding.
      - `updated_at` string, required — The date a data loss event was updated.
      - `toe_id` string, uuid, required — The unique identifier for the Target Of Evaluation (TOE).
      - `toe_short_name` string, required — The Company or entity name.
      - `internal_name` string[], nullable, required — The user defined names for the TOE.
      - `internal_id` string[], nullable, required — The user defined identifiers for the TOE. These can be used to query the TOE.
      - `threat_vector` string, nullable, required — The threat vector associated with the Data Loss or Breach event.
      - `threat_actor` string, nullable, required — The threat actor if available.
      - `threat_action` string[], required — The threat action if available.
      - `records_exposed` integer, nullable, required — The number of records exposed if applicable.
      - `public_event_date` string, nullable, required — The date the breach was made public.
      - `source_urls` string[], nullable, required — Source url for the Data Loss Event.
      - `description` string, required — A long description of data loss event.
      - `created_at` string, required — The date the data loss event was created.
      - `compromised_info` string[], required
      - `breach_event_date` string, nullable, required — The date of the breach.
    - `id` integer, required — The identifier associated with response object.
    - `type` string, required — The type of object returned.

## Other responses

- `400` — Something was wrong with the request
- `401` — Authentication information was missing or invalid or the user is not authorized to access resource or perform the associated action.

---

[API](https://skmtc.dev/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.dev/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-production.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/revisions/c8c2f68d8b60/schema)