---
title: "Get zone protected asset score"
method: GET
path: "/api/v2/asset-scores/zone-protected-asset-score"
tags: ["Asset Scores", "Enterprise"]
---

# Get zone protected asset score

`GET /api/v2/asset-scores/zone-protected-asset-score`

## Request

- Base URL: `/` (relative, and the document was published on a file host, not at the API’s origin)
- URL: `/api/v2/asset-scores/zone-protected-asset-score`
- Auth: one of:
  - HTTP bearer
  - API key in header `Authorization` and API key in header `RequestDate` and API key in header `Signature`

Gets a per-day series describing how much of a zone is free of open findings
over the requested time range. For each day in the range, the score is the
number of objects in the zone without an open finding divided by the total
number of objects in the zone. Zones that attack path analysis does not run
against yield an empty series.

## Query parameters

- `environments` string[], required
- `asset_group_tag_id` integer, required
- `start` string, date-time
- `end` string, date-time

## Response `200`

OK

- object
  - `data` object
    - `start` string, date-time: The RFC-3339 timestamp to describe the beginning of a time range
    - `end` string, date-time: The RFC-3339 timestamp to describe the end of a time range
    - `environments` string[]: The environment IDs the caller has access to out of those requested
    - `asset_group_tag_id` integer: The asset group tag id of the zone requested
    - `data` object[]
      - `date` string, date-time
      - `exposed_count` integer: Number of objects in the zone holding an open finding
      - `protected_count` integer: Number of objects in the zone without an open finding
      - `total_count` integer: Total number of objects in the zone
      - `value` number, double: The protected share of the zone, `protected_count` divided by `total_count`

## Other responses

- `400`: **Bad Request** This could be due to one of the following reasons: - JSON payload is missing or malformed - Path or query parameters are missing or invalid/malformed - The data sent is not valid (ex- sending a `string` in an `integer` field)
- `401`: **Unauthorized** This endpoint failed an authentication requirement. Either the client tried to access a protected endpoint without being authenticated, or an auth validation failed (ex- invalid credentials or expired token).
- `403`: **Forbidden** This is most commonly caused by an authenticated client trying to access a resource that it does not have permission for.
- `429`: **Too Many Requests** The client has sent too many requests within a certain time window and tripped the rate limiting middleware.
- `500`: **Internal Server Error** This is usually the result of either an unexpected database or application error. The client may try modifying or resending the request, but the error is likely not related to the client doing something wrong.

## Changes

- **2026-08-25** `e767fab0587f`: 1 info
  - endpoint added

[Operation history](https://skmtc.dev/specterops/apis/bloodhound-api/changes/api/v2/asset-scores/zone-protected-asset-score/get.md)

---

[API](https://skmtc.dev/specterops/apis/bloodhound-api.md) - [All operations](https://skmtc.dev/specterops/apis/bloodhound-api/llms.txt) - [OpenAPI document](https://skmtc.dev/specterops/apis/bloodhound-api/revisions/b11d31b4c176?raw)