---
title: "Get portfolio risk profile overview"
method: GET
path: "/risks/vendors/all"
tags: ["risks"]
---

# Get portfolio risk profile overview

`GET /risks/vendors/all`

## Request

- Base URL: `https://cyber-risk.upguard.com/api/public`
- URL: `https://cyber-risk.upguard.com/api/public/risks/vendors/all`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/docs/risks/vendors/all/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns an overview of all risks affecting vendors that match the specified filter criteria or all vendors.
This endpoint provides a consolidated view of cybersecurity risks.

The response includes the total number of vendors matching your filter and a list of all risks found,
with details about how many vendors are affected by each risk.

Results are paginated. Use the `page_size` parameter to control how many results are returned per page
(default: 100, max: 2000). Use the `next_page_token` from the response to retrieve subsequent pages.

Required API key permissions: `VendorRisk` (select when creating API key in Account Settings)

## Query parameters

- `vendor_labels` string[]
- `vendor_label_ids_match_all` boolean
- `include_unlabeled` boolean
- `min_score` integer
- `max_score` integer
- `name_prefix` string
- `vendor_ids` integer[]
- `vendor_label_ids_do_not_match` boolean
- `vendor_tiers` integer[]
- `portfolios` string[]
- `assessed_vendors_only` boolean
- `questionnaire_type_ids` integer[]
- `vendor_date_added_start` string, date-time
- `vendor_date_added_end` string, date-time
- `vendor_date_added_before` boolean
- `vendor_date_added_between` boolean
- `page_size` integer
- `page_token` string

## Response `200`

VendorRiskOverviewV1Response is the response for the vendor risk overview endpoint.

- VendorRiskOverviewV1ResponsePayload
  - `next_page_token` string: Token to retrieve the next page of results. Omitted if there are no more results.
  - `risks` ExternalVendorRisk[]: The list of risks affecting vendors in the portfolio.
    - `adjusted_severity` string: The adjusted severity if the risk severity has been customized. If present, this indicates the original severity before adjustment.
    - `category_title` string: The human-readable title of the risk category.
    - `classification` string: The classification of the risk (for survey risks only).
    - `date_first_detected` string, date-time: The date when this risk was first detected (omitted if not available).
    - `description` string: A detailed description of the risk.
    - `fact_category` string: The category of the risk fact.
    - `id` string: The unique identifier for the risk.
    - `is_verified_vuln` boolean: Indicates if this is a verified vulnerability.
    - `known_exploited_vulnerability` boolean: Indicates whether the vulnerability is known to be actively exploited.
    - `num_failed_vendors` integer: The number of vendors that have failed this risk.
    - `risk_type` string: The type of risk: "cloudscan", "survey", or "additional_evidence".
    - `severity` string: The severity of the risk: "info", "low", "medium", "high", or "critical".
    - `title` string: The title of the risk.

## Other responses

- `403`: Account does not have access to requested entities
- `422`: An invalid parameter was supplied or a mandatory parameter was missing
- `429`: Too many requests have been made to this endpoint.
- `500`: An internal system error occurred

---

[API](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api.md) - [All operations](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/llms.txt) - [OpenAPI document](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/revisions/d044bf6dc61e?raw)