---
title: "(V2) Get a list of questionnaire risks for one or more watched vendors or a specific questionnaire"
method: GET
path: "/risks/vendors/questionnaires/v2"
tags: ["risks"]
---

# (V2) Get a list of questionnaire risks for one or more watched vendors or a specific questionnaire

`GET /risks/vendors/questionnaires/v2`

## Request

- Base URL: `https://cyber-risk.upguard.com/api/public`
- URL: `https://cyber-risk.upguard.com/api/public/risks/vendors/questionnaires/v2`
- Auth: API key in header `Authorization`
- TypeScript: <https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/docs/risks/vendors/questionnaires/v2/get.ts> (a function with typed inputs; its response is checked against the schema)

Returns a list of currently open questionnaire risks for one or more of an account's watched vendors, including information on whether waivers exist for each risk.

Required API key permissions: `VendorRisk` (select when creating API key in Account Settings)

## Query parameters

- `vendor_id` integer
- `primary_hostname` string
- `questionnaire_id` integer
- `page_token` string
- `page_size` integer
- `ignore_waived_risks` boolean

## Response `200`

Questionnaire risks for specific watched vendors or questionnaire instances, including waiver details if appropriate

- QuestionnaireRisksResponsePayloadBodyV2
  - `next_page_token` string: The token to be used to retrieve the next page of results. Will not be returned if there are no more results.
  - `risks` QuestionnaireRiskV2[]: The list of questionnaire risks
    - `controls` string[]
    - `createdAt` string, date-time: The time the risk was first seen
    - `inRemediation` boolean: Flag indicating whether the risk is in remediation
    - `isSharedQuestionnaire` boolean: Flag indicating whether the risk arise from a shared questionnaire. This field will be present
    - `questionnaireId` integer: The ID of the questionnaire this risk belongs to
    - `riskAdjustedSeverity` 'pass' | 'info' | 'low' | 'medium' | 'high' | 'critical': The severity of the risk, adjusted by any risk modifications
    - `riskCategory` string: The category of the risk
    - `riskExplanation` string
    - `riskId` string: THe ID of the risk
    - `riskName` string: The name of the risk
    - `riskSeverity` 'pass' | 'info' | 'low' | 'medium' | 'high' | 'critical': The severity of the risk
    - `riskText` string: The description of the risk
    - `riskWaivers` QuestionnaireRiskWaiver[]: List of risk waivers associated with the risk
      - `active_at` string, date-time
      - `approved_by` string
      - `created_by` string
      - `expires_at` string, date-time
      - `justification` string
    - `riskWhy` string
    - `vendorId` integer: The ID of the vendor this risk belongs to
  - `total_results` integer: The total number of risks found.

## Other responses

- `403`: Account does not have access to requested entities
- `422`: An invalid parameter was supplied or a mandatory parameter was missing
- `429`: Too many requests have been made to this endpoint.
- `500`: An internal system error occurred

---

[API](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api.md) - [All operations](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/llms.txt) - [OpenAPI document](https://skmtc.dev/upguard/apis/upguard-cyberrisk-api/revisions/d044bf6dc61e?raw)