---
title: "Get risk score history for an entity"
method: GET
path: "/api/risk_score/history"
tags: ["Security Entity Analytics API"]
---

# Get risk score history for an entity

`GET /api/risk_score/history`

**Spaces method and path for this operation:**

<div><span class="operation-verb get">get</span>&nbsp;<span class="operation-path">/s/{space_id}/api/risk_score/history</span></div>

Refer to [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces) for more information.

Returns time-ordered historical risk score entries from the risk score time-series index for a given entity.

## Query parameters

- `entity_type` 'host' | 'user' | 'service' | 'generic', required
- `entity_id` string, required
- `from` string
- `to` string
- `score_type` 'base' | 'propagated' | 'resolution'
- `include_contributions` boolean

## Response `200`

Successful response

- SecurityEntityAnalyticsAPIRiskScoreHistoryResponse
  - `entity_id` string, required
  - `entity_type` 'host' | 'user' | 'service' | 'generic', required
  - `entries` SecurityEntityAnalyticsAPIRiskScoreHistoryEntry[], required
    - `@timestamp` string, date-time, required
    - `calculated_level` 'Unknown' | 'Low' | 'Moderate' | 'High' | 'Critical', required
    - `calculated_score` number, double
    - `calculated_score_norm` number, double, required
    - `category_1_count` integer
    - `category_1_score` number, double
    - `category_2_count` integer
    - `category_2_score` number, double
    - `criticality_level` 'low_impact' | 'medium_impact' | 'high_impact' | 'extreme_impact' — The criticality level of the asset.
    - `inputs` SecurityEntityAnalyticsAPIRiskScoreInput[] — Present only when requested with `include_contributions=true`.
      - `category` string, required — The risk category of the risk input document.
      - `contribution_score` number, double
      - `description` string, required — A human-readable description of the risk input document.
      - `entity_id` string — The EUID of the entity within the graph that generated this alert.
      - `id` string, required — The unique identifier (`_id`) of the original source document
      - `index` string, required — The unique index (`_index`) of the original source document
      - `risk_score` number, double — The weighted risk score of the risk input document.
      - `timestamp` string — The @timestamp of the risk input document.
    - `modifiers` SecurityEntityAnalyticsAPIRiskScoreModifier[] — Present only when requested with `include_contributions=true`.
      - `contribution` number, double, required
      - `metadata` object
      - `modifier_value` number, double
      - `subtype` string
      - `type` string, required
    - `score_type` 'base' | 'propagated' | 'resolution'
  - `interval` string, required — The effective Elasticsearch `date_histogram` interval expression the entries were aggregated into (for example `3h`, `1d`, `1w`), derived from the requested time range.

## Other responses

- `400` — Invalid request

---

[API](https://skmtc.net/elastic/apis/kibana-apis.md) · [All operations](https://skmtc.net/elastic/apis/kibana-apis/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/elastic/kibana-apis/versions/531c9e2a7d23/schema)