---
title: "List Entity Risk Scores"
method: GET
path: "/api/v2/security-entities/risk-scores"
tags: ["Entity Risk Scores"]
---

# List Entity Risk Scores

`GET /api/v2/security-entities/risk-scores`

Get a list of entity risk scores for your organization. Entity risk scores provide security risk assessment for entities like cloud resources, identities, or services based on detected signals, misconfigurations, and identity risks.

## Query parameters

- `from` integer
- `to` integer
- `page[size]` integer
- `page[number]` integer
- `page[queryId]` string
- `filter[sort]` string
- `filter[query]` string
- `entityType` string[]

## Response `200`

OK

- SecurityEntityRiskScoresResponse — Response containing a list of entity risk scores
  - `data` SecurityEntityRiskScore[], required — Array of entity risk score objects.
    - `attributes` SecurityEntityRiskScoreAttributes, required — Attributes of an entity risk score.
      - `accountIds` string[], required — Cloud account IDs associated with the entity.
      - `configRisks` SecurityEntityConfigRisks, required — Configuration risks associated with the entity
        - `hasIdentityRisk` boolean, required — Whether the entity has identity risks
        - `hasMisconfiguration` boolean, required — Whether the entity has misconfigurations
        - `hasPrivilegedRole` boolean, required — Whether the entity has privileged roles
        - `isPrivileged` boolean, required — Whether the entity has privileged access
        - `isProduction` boolean, required — Whether the entity is in a production environment
        - `isPubliclyAccessible` boolean, required — Whether the entity is publicly accessible
      - `entityMetadata` SecurityEntityMetadata, required — Metadata about the entity from cloud providers
        - `accountID` string — Cloud account ID (AWS)
        - `environments` string[], required — Environment tags associated with the entity
        - `mitreTactics` string[], required — MITRE ATT&CK tactics detected
        - `mitreTechniques` string[], required — MITRE ATT&CK techniques detected
        - `projectID` string — Cloud project ID (GCP)
        - `services` string[], required — Services associated with the entity
        - `sources` string[], required — Data sources that detected this entity
        - `subscriptionID` string — Cloud subscription ID (Azure)
      - `entityName` string — Human-readable name of the entity.
      - `entityProviders` string[], required — Cloud providers associated with the entity.
      - `entityRoles` string[] — Roles associated with the entity.
      - `entitySubTypes` string[], required — Sub-types associated with the entity.
      - `entityType` string — Type of the entity (for example, aws_iam_user, aws_ec2_instance).
      - `entityTypes` string[] — All types associated with the entity.
      - `firstDetected` integer, required — Timestamp when the entity was first detected (Unix milliseconds).
      - `lastActivityTitle` string, required — Title of the most recent signal detected for this entity.
      - `lastDetected` integer, required — Timestamp when the entity was last detected (Unix milliseconds).
      - `riskScore` integer, required — Current risk score for the entity.
      - `riskScoreEvolution` integer, required — Change in risk score compared to previous period.
      - `severity` 'critical' | 'high' | 'medium' | 'low' | 'info', required — Severity level based on risk score
      - `signalsDetected` integer, required — Number of security signals detected for this entity.
    - `id` string, required — Unique identifier for the entity
    - `type` 'SecurityEntityRiskScore', required — Resource type.
  - `meta` SecurityEntityRiskScoresMeta, required — Metadata for pagination
    - `pageNumber` integer, required — Current page number (1-indexed)
    - `pageSize` integer, required — Number of items per page
    - `queryId` string, required — Query ID for pagination consistency
    - `totalRowCount` integer, required — Total number of entities matching the query

## Other responses

- `400` — Bad Request
- `401` — Unauthorized
- `403` — Forbidden
- `429` — Too many requests

---

[API](https://skmtc.net/datadog/apis/api-v2.md) · [All operations](https://skmtc.net/datadog/apis/api-v2/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/datadog/api-v2/revisions/da68bf029e4c/schema)