---
title: "List risks"
method: GET
path: "/v1/supplychains/{supply_chain_id}/risks"
tags: ["Supply Chain Intelligence"]
---

# List risks

`GET /v1/supplychains/{supply_chain_id}/risks`

Returns the risks (vulnerabilities, misconfigurations, and exposures) identified across a supply chain. By default the entire supply chain is searched; provide `supplier_ids` to narrow the search to specific suppliers.

## Path parameters

- `supply_chain_id` string, uuid, required — The ID of a Censys supply chain. Obtain the supply chain ID using the [list supply chains endpoint](https://docs.censys.com/reference/v1-supply-chain-list-supply-chains#/) to find the IDs of your organization's supply chains.

## Query parameters

- `organization_id` string, uuid, required — The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information.
- `supplier_ids` string[], nullable — Narrow the search to one or more Censys suppliers in the supply chain. For multiple values, include comma-separated values. When omitted, the entire supply chain is searched.
- `query` string — A CenQL query. When set, only risks present on assets matching this query are returned.
- `risk_type` 'misconfigs' | 'vulns' | 'exposures' — Filter to a single risk category. When omitted, misconfigurations, vulnerabilities, and exposures are all included.
- `resource_type` 'hosts' | 'web' — Filter to risks observed on a single asset resource type. When omitted, hosts and web are both included.
- `page_size` integer — Maximum number of risks to return per page.
- `page_token` string — Pagination token from a previous response to retrieve the next page of results.

## Headers

- `X-Organization-ID` string, uuid — The ID of a Censys organization to associate the request with. See the [Getting Started docs](https://docs.censys.com/reference/get-started#step-3-find-and-use-your-organization-id-optional) for more information. Note: The header parameter is supported for atypical use cases; we recommend always providing this field via the query parameter.

## Response `200`

Risk information returned successfully

- ResponseEnvelopeListRisksPayload
  - `result` ListRisksPayload
    - `next_page_token` string — Pagination token for the next page of results, if any.
    - `risks` SupplyChainRisk[], nullable, required — Risks matching the given search criteria.
      - `asset_count` integer, required — Total number of assets affected by this risk.
      - `confidence` number, double, required — Confidence score, from 0 to 1, that this risk is present.
      - `description` string, required — Description of the risk.
      - `evidence` string — Evidence supporting the identification of this risk.
      - `id` string, required — Unique identifier for the risk, e.g. a CVE ID.
      - `name` string, required — Human-readable name of the risk.
      - `remediation` SupplyChainRiskRemediation, required
        - `primary` string — Primary recommended remediation step.
        - `secondary` string[], nullable — Additional recommended remediation steps.
      - `severity` 'UNSPECIFIED' | 'LOW' | 'MEDIUM' | 'HIGH' | 'CRITICAL', required — Severity of the risk.
      - `type` string, required — Risk category: vulns, misconfigs, or exposures.

## Other responses

- `400` — Invalid arguments
- `401` — Request does not contain a valid Authorization token
- `403` — User does not have permission to access this data
- `409` — Conflict
- `422` — Invalid inputs
- `500` — Internal server error

---

[API](https://skmtc.net/censys/apis/censys-platform-api.md) · [All operations](https://skmtc.net/censys/apis/censys-platform-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/censys/censys-platform-api/revisions/261c916bf05b/schema)