---
title: "Get a list of active risks for your account"
method: GET
path: "/risks"
tags: ["risks"]
---

# Get a list of active risks for your account

`GET /risks`

## Request

- Base URL: `https://cyber-risk.upguard.com/api/public`
- URL: `https://cyber-risk.upguard.com/api/public/risks`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/docs/risks/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns a list of risks that have been detected for your account.

Required API key permissions: `BreachRisk` (select when creating API key in Account Settings)

## Query parameters

- `min_severity` 'info' | 'low' | 'medium' | 'high' | 'critical'
- `include_meta` boolean
- `include_sources` boolean
- `asset_portfolio_names` string[]

## Response `200`

A list of detected risks

- GetRisksV1RespBody
  - `risks` Risk[]: The list of vendor risks that have been detected.
    - `category` string: The risk category identifier
    - `description` string: Description or context surrounding the risk
    - `finding` string: A short description of the finding
    - `firstDetected` string, date-time: When the risk was first detected
    - `hostnameCount` integer: The number of hostnames where the risk was detected
    - `hostnameMeta` object: Map of meta for each hostname, only included if 'include_meta' param is true and there is meta available for the risk
    - `hostnames` string[]: The hostnames where the risk was detected, only included if 'exclude_hostnames' param is false
    - `id` string: The risk identifier
    - `remediation` string: Remediation recommendation
    - `risk` string: Detailed description of the risk
    - `riskSubtype` string: The subtype of the risk, e.g. the subtype of the verified_vuln:CVE-2021-34473 is CVE-2021-34473. This field will be empty if the risk has no subtype, e.g. for wp_version_exposed, or for generic risks like verified_vuln:* where the subtype is only determined when the full risk is specified.
    - `riskType` string: The type of the risk, e.g. the type of the verified_vuln:CVE-2021-34473 is verified_vuln
    - `risk_waivers` RiskWaiver[]: List of risk waivers applicable to this risk
      - `active_at` string, date-time: Time the risk waiver was activated (RFC 3339 format)
      - `all_hostnames` boolean: Flag indicating whether the risk has been waived for all hostnames
      - `approved_by` string: Email address of the user who approved the risk waiver. This field will be omitted if not applicable, e.g. self approved risk waivers.
      - `created_by` string: Email address of the user who created the risk waiver
      - `expires_at` string, date-time: Time the risk waiver will expire (RFC 3339 format). If the risk waiver is set not to expire this field will be omitted.
      - `hostnames` string[]: The list of hostnames the risk has been waived for. The field will be omitted if all_hostnames is true.
      - `justification` string: Justification for the risk waiver. If not available this field will be omitted.
    - `severity` string: The risk severity
    - `sources` string[]: List of sources where the risk was detected, only included if 'include_sources' param is true and there are sources available for the risk

## Other responses

- `422`: An invalid parameter was supplied or a mandatory parameter was missing
- `429`: Too many requests have been made to this endpoint.
- `500`: An internal system error occurred

## Changes

- **2026-11-07** `d044bf6dc61e`: 1 info
  - added the new optional `query` request parameter `asset_portfolio_names`

[Operation history](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/changes/risks/get.md)

---

[API](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api.md) - [All operations](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/llms.txt) - [OpenAPI document](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/revisions/d044bf6dc61e?raw)