---
title: "Get a list of available risks in the platform"
method: GET
path: "/available_risks/v2"
tags: ["risks"]
---

# Get a list of available risks in the platform

`GET /available_risks/v2`

## Request

- Base URL: `https://cyber-risk.upguard.com/api/public`
- URL: `https://cyber-risk.upguard.com/api/public/available_risks/v2`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/docs/available_risks/v2/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns a list of available risks in the UpGuard platform with detailed info.

Some risks in the platform are generic risks like "exposed_service:*". The values of some of the fields for these risks
depends on the details of the risk, e.g. which particular service is exposed. As such these fields are omitted from the response.

To get the full details for a specific risk, e.g. "exposed_service:FTP", use the risk details endpoint which will return
the full information for the particular service.

Required API key permissions: `Platform` (select when creating API key in Account Settings)

## Query parameters

- `category` string
- `severity` 'info' | 'low' | 'medium' | 'high' | 'critical'

## Response `200`

Available risks

- AvailableRiskV2[]
  - `category` string: The category of the risk. This field will be omitted for generic risks
  - `description` string: Description or context surrounding the risk. This field will be omitted for generic risks
  - `finding` string: Description of the finding. This field will be omitted for generic risks
  - `generic` boolean: Flag indicating whether the risks is a generic risk, i.e. a risk where severity, category, finding etc. depend on other parameters
  - `group` string: The risk group
  - `id` string: The ID of the risk
  - `remediation` string: Remediation recommendation. This field will be omitted for generic risks
  - `risk` string: The risk title
  - `riskDetails` string: Detailed description of the risk. This field will be omitted for generic risks
  - `riskSubtype` string: The subtype of the risk, e.g. the subtype of the verified_vuln:CVE-2021-34473 is CVE-2021-34473. This field will be empty if the risk has no subtype, e.g. for wp_version_exposed, or for generic risks like verified_vuln:* where the subtype is only determined when the full risk is specified.
  - `riskType` string: The type of the risk, e.g. the type of the verified_vuln:CVE-2021-34473 is verified_vuln
  - `severity` 'pass' | 'info' | 'low' | 'medium' | 'high' | 'critical': The severity of the risk. This field will be omitted for generic risks

## Other responses

- `422`: An invalid parameter was supplied or a mandatory parameter was missing
- `429`: Too many requests have been made to this endpoint.
- `500`: An internal system error occurred

## Changes

- **2026-11-07** `d044bf6dc61e`: 2 info
  - added the new optional `query` request parameter `category`
  - added the new optional `query` request parameter `severity`

[Operation history](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/changes/available_risks/v2/get.md)

---

[API](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api.md) - [All operations](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/llms.txt) - [OpenAPI document](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/revisions/d044bf6dc61e?raw)