--- title: "Get a list of risk changes for your account" method: GET path: "/risks/diff" tags: ["risks"] --- # Get a list of risk changes for your account `GET /risks/diff` ## Request - Base URL: `https://cyber-risk.upguard.com/api/public` - URL: `https://cyber-risk.upguard.com/api/public/risks/diff` - Auth: API key in header `Authorization` - TypeScript: (a function with typed inputs; its response is checked against the schema) Returns a list of the risks introduced and risks resolved for domains or IPs between two dates. The start_date must be in the last 2 years. Previously provisional risks that are now scored will appear in the list of risks introduced. Required API key permissions: `BreachRisk` (select when creating API key in Account Settings) ## Query parameters - `start_date` string, date-time, required - `end_date` string, date-time - `include_sources` boolean ## Response `200` Risks introduced and resolved - RisksDiffResponsePayloadBody - `risksIntroduced` SummaryDiffGroup[]: The risks introduced between start date and end date grouped by class - `diffs` SummaryDiff[]: The list of risk diffs in this group - `category` 'website_sec' | 'email_sec' | 'network_sec' | 'ip_domain_reputation' | 'brand_protect' | 'attack_surface' | 'dns' | 'vulnerability_management' | 'data_leakage' | 'encryption' | 'questionnaire_risks' | 'vulns' | 'typosquatting' | 'emailexposures' | 'dataleaks' | 'additional_evidence': The category of the risk group - `cloudscanDiffs` Diff[] - `dateA` string, date-time: The date of the first scan (RFC 3339 format) - `dateB` string, date-time: The date of the second scan (RFC 3339 format) - `expected` string: The expected status - `hostname` string: The domain name or IP address experiencing the risk diff - `metaValueA` string: Metadata for the result of the first check - `metaValueB` string: Metadata for the result of the second check - `prevProvisionalID` string: Previous provisional ID if the last scan contained it - `property` string: The property checked - `statusA` string - `statusB` string - `valueMetadataA` ValueMetadata - `description` string - `resolvesAfter` string, date-time - `resolvesAfterEvent` string - `urls` ValueMetadataURL[] - `displayText` string - `url` string - `valueMetadataB` ValueMetadata - `description` string - `resolvesAfter` string, date-time - `resolvesAfterEvent` string - `urls` ValueMetadataURL[] - `displayText` string - `url` string - `description` string: Description or context surrounding the risk - `group` string: The ID of the risk class - `id` string: The ID of risk - `name` string: The name of the risk - `remediation` string: Remediation recommendation - `riskDetails` string: Detailed description of the risk - `riskSubtype` string: The subtype of the risk, e.g. the subtype of the verified_vuln:CVE-2021-34473 is CVE-2021-34473. This field will be empty if the risk has no subtype, e.g. for wp_version_exposed, or for generic risks like verified_vuln:* where the subtype is only determined when the full risk is specified. - `riskType` string: The type of the risk, e.g. the type of the verified_vuln:CVE-2021-34473 is verified_vuln - `severity` integer - `severityName` 'pass' | 'info' | 'low' | 'medium' | 'high' | 'critical': The severity of the risks in human-readable form - `sources` string[]: List of sources where the risk was detected, only included if 'include_sources' param is true and there are sources available for the risk - `vendorDiff` VendorDiff - `expected` string: The expected status - `metaValueA` string: Metadata for the result of the first check - `metaValueB` string: Metadata for the result of the second check - `prevProvisionalID` string: Previous provisional ID if the last scan contained it - `statusA` string - `statusB` string - `groupID` string: The ID of the risk group - `highestSeverity` integer - `highestSeverityName` 'pass' | 'info' | 'low' | 'medium' | 'high' | 'critical': The highest severity of the risks in this group in human-readable form - `name` string: The name of the risk group - `risksResolved` SummaryDiffGroup[]: The risks resolved between start date and end date grouped by class - `diffs` SummaryDiff[]: The list of risk diffs in this group - `category` 'website_sec' | 'email_sec' | 'network_sec' | 'ip_domain_reputation' | 'brand_protect' | 'attack_surface' | 'dns' | 'vulnerability_management' | 'data_leakage' | 'encryption' | 'questionnaire_risks' | 'vulns' | 'typosquatting' | 'emailexposures' | 'dataleaks' | 'additional_evidence': The category of the risk group - `cloudscanDiffs` Diff[] - `dateA` string, date-time: The date of the first scan (RFC 3339 format) - `dateB` string, date-time: The date of the second scan (RFC 3339 format) - `expected` string: The expected status - `hostname` string: The domain name or IP address experiencing the risk diff - `metaValueA` string: Metadata for the result of the first check - `metaValueB` string: Metadata for the result of the second check - `prevProvisionalID` string: Previous provisional ID if the last scan contained it - `property` string: The property checked - `statusA` string - `statusB` string - `valueMetadataA` ValueMetadata - `description` string - `resolvesAfter` string, date-time - `resolvesAfterEvent` string - `urls` ValueMetadataURL[] - `displayText` string - `url` string - `valueMetadataB` ValueMetadata - `description` string - `resolvesAfter` string, date-time - `resolvesAfterEvent` string - `urls` ValueMetadataURL[] - `displayText` string - `url` string - `description` string: Description or context surrounding the risk - `group` string: The ID of the risk class - `id` string: The ID of risk - `name` string: The name of the risk - `remediation` string: Remediation recommendation - `riskDetails` string: Detailed description of the risk - `riskSubtype` string: The subtype of the risk, e.g. the subtype of the verified_vuln:CVE-2021-34473 is CVE-2021-34473. This field will be empty if the risk has no subtype, e.g. for wp_version_exposed, or for generic risks like verified_vuln:* where the subtype is only determined when the full risk is specified. - `riskType` string: The type of the risk, e.g. the type of the verified_vuln:CVE-2021-34473 is verified_vuln - `severity` integer - `severityName` 'pass' | 'info' | 'low' | 'medium' | 'high' | 'critical': The severity of the risks in human-readable form - `sources` string[]: List of sources where the risk was detected, only included if 'include_sources' param is true and there are sources available for the risk - `vendorDiff` VendorDiff - `expected` string: The expected status - `metaValueA` string: Metadata for the result of the first check - `metaValueB` string: Metadata for the result of the second check - `prevProvisionalID` string: Previous provisional ID if the last scan contained it - `statusA` string - `statusB` string - `groupID` string: The ID of the risk group - `highestSeverity` integer - `highestSeverityName` 'pass' | 'info' | 'low' | 'medium' | 'high' | 'critical': The highest severity of the risks in this group in human-readable form - `name` string: The name of the risk group ## Other responses - `422`: An invalid parameter was supplied or a mandatory parameter was missing - `429`: Too many requests have been made to this endpoint. - `500`: An internal system error occurred --- [API](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api.md) - [All operations](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/llms.txt) - [OpenAPI document](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/revisions/d044bf6dc61e?raw)