---
title: "GetCountryVulnerabilities"
method: GET
path: "/api/supply-chain/v1/get-country-vulnerabilities"
tags: ["SupplyChainService"]
---

# GetCountryVulnerabilities

`GET /api/supply-chain/v1/get-country-vulnerabilities`

## Request

- Base URL: `https://api.worldmonitor.app`
- URL: `https://api.worldmonitor.app/api/supply-chain/v1/get-country-vulnerabilities`
- Auth: one of:
  - API key in header `X-WorldMonitor-Key`
  - API key in header `X-Api-Key`
  - HTTP bearer

GetCountryVulnerabilities returns the full per-commodity score evidence for one country. PRO-gated. Requires entitlement tier >= 1.

## Query parameters

- `iso2` string, required
- `jmespath` string

## Response `200`

OK

- WorldmonitorSupplyChainV1GetCountryVulnerabilitiesResponse
  - `iso2` string: Uppercase ISO 3166-1 alpha-2 code for the requested country.
  - `country` string: Human-readable name of the requested country.
  - `vulnerabilities` WorldmonitorSupplyChainV1CommodityVulnerability[]
    - `countryIso2` string: ISO 3166-1 alpha-2 code for the scored country.
    - `countryName` string: English display name for the scored country.
    - `commodityId` string: Stable reviewed commodity mapping identifier.
    - `commodity` string: Human-readable commodity name.
    - `score` number, double: Vulnerability score from 0 to 100; absent when evidence is insufficient.
    - `band` string: Score band: low, moderate, high, or critical; empty when the score is absent.
    - `components` WorldmonitorSupplyChainV1VulnerabilityComponents
      - `sourceConcentration` WorldmonitorSupplyChainV1VulnerabilitySourceConcentration
        - `value` number, double: Combined supplier or producer concentration from 0 to 1.
        - `importHhi` number, double: Import supplier Herfindahl-Hirschman concentration from 0 to 1.
        - `mineHhi` number, double: Mine-stage production concentration from 0 to 1.
        - `refineryHhi` number, double: Refinery-stage production concentration from 0 to 1.
        - `productionHhi` number, double: Combined mine and refinery production concentration from 0 to 1.
        - `productionCoverage` string: Producer-stage coverage used for the combined concentration.
        - `coverage` string: Overall concentration coverage state.
        - `inputs` WorldmonitorSupplyChainV1VulnerabilityInput[]
          - `sourceKey` string: Redis or source-contract key that supplied this observation.
          - `sourceName` string: Human-readable source name.
          - `sourceUrl` string: Public source or methodology URL.
          - `value` number, double: Numeric observation used by the scorer; absent when the source is unknown.
          - `year` integer: Observation year when the source publishes annual data.
          - `fetchedAt` string: ISO 8601 timestamp when the source snapshot was fetched.
          - `stale` boolean: True when this observation is older than its source-specific freshness budget.
          - `detail` string: Bounded explanation of the mapped input.
      - `transitExposure` WorldmonitorSupplyChainV1VulnerabilityTransitExposure
        - `value` number, double: Combined chokepoint exposure from 0 to 1.
        - `chokepoints` WorldmonitorSupplyChainV1VulnerabilityTransitRoute[]
          - `id` string: Stable chokepoint identifier.
          - `name` string: Human-readable chokepoint name.
          - `transitShare` number, double: Country and commodity exposure share using this route, from 0 to 1.
          - `weightedTransitShare` number, double: Transit share after the current disruption multiplier, from 0 to 1.
          - `status` string: Current route state: baseline, disrupted, or unknown when the flow row is absent.
          - `inputs` WorldmonitorSupplyChainV1VulnerabilityInput[]
            - `sourceKey` string: Redis or source-contract key that supplied this observation.
            - `sourceName` string: Human-readable source name.
            - `sourceUrl` string: Public source or methodology URL.
            - `value` number, double: Numeric observation used by the scorer; absent when the source is unknown.
            - `year` integer: Observation year when the source publishes annual data.
            - `fetchedAt` string: ISO 8601 timestamp when the source snapshot was fetched.
            - `stale` boolean: True when this observation is older than its source-specific freshness budget.
            - `detail` string: Bounded explanation of the mapped input.
      - `buffer` WorldmonitorSupplyChainV1VulnerabilityBuffer
        - `state` string: Buffer evidence state: known or unknown.
        - `vulnerability` number, double: Residual vulnerability after the available buffer, from 0 to 1.
        - `kind` string: Buffer source class, such as stocks_to_use or gas_storage_fill.
        - `inputs` WorldmonitorSupplyChainV1VulnerabilityInput[]
          - `sourceKey` string: Redis or source-contract key that supplied this observation.
          - `sourceName` string: Human-readable source name.
          - `sourceUrl` string: Public source or methodology URL.
          - `value` number, double: Numeric observation used by the scorer; absent when the source is unknown.
          - `year` integer: Observation year when the source publishes annual data.
          - `fetchedAt` string: ISO 8601 timestamp when the source snapshot was fetched.
          - `stale` boolean: True when this observation is older than its source-specific freshness budget.
          - `detail` string: Bounded explanation of the mapped input.
    - `coverage` string[]
    - `state` string: Evidence state: ok, insufficient_data, or stale_input.
    - `reasons` string[]
    - `methodologyVersion` string: Version of the scoring methodology that produced this row.
  - `generatedAt` string: ISO 8601 timestamp when the country index was generated.
  - `methodologyVersion` string: Version of the scoring methodology used for every row.
  - `upstreamUnavailable` boolean: True when the published country index could not be read.

## Other responses

- `400`: Validation error
- `401`: Missing or invalid API key.
- `403`: PRO entitlement access denied.
- `429`: Rate limit exceeded.
- `503`: Service unavailable. Billing-verification responses include code and X-Billing-Verification; other gateway infrastructure failures use the generic GatewayError shape.
- `default`: Gateway or handler error response.

---

[API](https://skmtc.dev/worldmonitor/apis/worldmonitor-api.md) · [All operations](https://skmtc.dev/worldmonitor/apis/worldmonitor-api/llms.txt) · [OpenAPI document](https://skmtc.dev/worldmonitor/apis/worldmonitor-api/revisions/e3dc8463a5c9?raw)