---
title: "Search for risk history"
method: POST
path: "/history"
tags: ["Risk History"]
---

# Search for risk history

`POST /history`

Returns change events (not daily snapshots) for the risk score, criticality, and individual risk rules of one or more entities, so you can see when each value became active and when it was replaced.

## Request body

- SearchRiskHistoriesRequest
  - `entities` string[], required
  - `from` string, date-time — Default value is minus 30 days from `to` date or current date if `to` date is missing
  - `to` string, date-time — Default value is plus 30 days from `from` date or current date if `from` date is missing

## Response `200`

A list of risk histories.

- SearchRiskHistoriesResponse
  - `data` object[], required
    - `attributes` EntityRiskHistories
      - `entity` Entity
        - `id` string, required — Entity id
        - `provided_id` string, required — Entity id provided in request
        - `type` string, required — Entity type
        - `name` string, required — Entity name
      - `scores` RiskScoreHistory[]
        - `score` integer, required — Entity risk score
        - `added` string, date-time
        - `removed` string, date-time
      - `levels` RiskLevelHistory[]
        - `criticality` integer, required — Entity risk criticality
        - `added` string, date-time — Date when risk was added to the entity
        - `removed` string, date-time — Date when risk was removed from the entity
      - `risk_rules` RiskRuleHistory[]
        - `risk_id` string, required — Risk rule id
        - `risk_name` string, required — Risk rule name
        - `criticality` integer, required — Risk criticality
        - `evidence` string, required — Risk evidence
        - `sightings_count` integer — Number of sightings for this risk rule
        - `added` string, date-time — Date when risk was added to the entity
        - `removed` string, date-time — Date when risk was removed from the entity
  - `counts` object, required
    - `returned` integer, required
    - `total` integer, required

---

[API](https://skmtc.net/recordedfuture/apis/alert-api.md) · [All operations](https://skmtc.net/recordedfuture/apis/alert-api/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/recordedfuture/alert-api/versions/c8c2f68d8b60/schema)