---
title: "Get a list of questionnaire risks for one or more watched vendors or a specific questionnaire"
method: GET
path: "/risks/vendors/questionnaires"
tags: ["risks"]
deprecated: true
---

# Get a list of questionnaire risks for one or more watched vendors or a specific questionnaire

`GET /risks/vendors/questionnaires`

## Request

- Base URL: `https://cyber-risk.upguard.com/api/public`
- URL: `https://cyber-risk.upguard.com/api/public/risks/vendors/questionnaires`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/docs/risks/vendors/questionnaires/get.ts> (a function with typed inputs; its response is checked against the schema)

> **Deprecated.**

Returns a list of currently open questionnaire risks for one or more of an account's watched vendors. Please note this version of the endpoint has been deprecated, and v2 should be used instead.

Required API key permissions: `VendorRisk` (select when creating API key in Account Settings)

## Query parameters

- `vendor_id` integer
- `primary_hostname` string
- `questionnaire_id` integer
- `page_token` string
- `page_size` integer

## Response `200`

Questionnaire risks for specific watched vendors or questionnaire instances

- QuestionnaireRisksResponsePayloadBody
  - `next_page_token` string: The token to be used to retrieve the next page of results. Will not be returned if there are no more results.
  - `risks` QuestionnaireRisk[]: The list of questionnaire risks
    - `controls` string[]
    - `createdAt` string, date-time: The time the risk was first seen
    - `inRemediation` boolean: Flag indicating whether the risk is in remediation
    - `questionnaireId` integer: The ID of the questionnaire this risk belongs to
    - `riskAdjustedSeverity` 'pass' | 'info' | 'low' | 'medium' | 'high' | 'critical': The severity of the risk, adjusted by any risk modifications
    - `riskCategory` string: The category of the risk
    - `riskExplanation` string
    - `riskId` string: THe ID of the risk
    - `riskName` string: The name of the risk
    - `riskSeverity` 'pass' | 'info' | 'low' | 'medium' | 'high' | 'critical': The severity of the risk
    - `riskText` string: The description of the risk
    - `riskWaivers` QuestionnaireRiskWaiver[]: List of risk waivers associated with the risk
      - `active_at` string, date-time
      - `approved_by` string
      - `created_by` string
      - `expires_at` string, date-time
      - `justification` string
    - `riskWhy` string
    - `vendorId` integer: The ID of the vendor this risk belongs to
  - `total_results` integer: The total number of risks found.

## Other responses

- `403`: Account does not have access to requested entities
- `422`: An invalid parameter was supplied or a mandatory parameter was missing
- `429`: Too many requests have been made to this endpoint.
- `500`: An internal system error occurred

---

[API](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api.md) - [All operations](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/llms.txt) - [OpenAPI document](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/revisions/d044bf6dc61e?raw)