# Riot

> Riot is a Paris-based employee security posture management (human risk management) platform. It runs
> phishing and smishing simulations, security awareness training, credential breach monitoring,
> employee-reported email triage (Inbox), inbound email protection (Slash), and third-party SaaS/drive
> exposure monitoring (Sonar). Riot publishes a public REST API (OpenAPI 3.1.1) with API-key auth, cursor
> pagination, a SCIM 2.0 provisioning surface, and Standard Webhooks events carrying OCSF Detection
> Finding payloads.

Generated by API Evangelist on 2026-08-05. Riot publishes no llms.txt of its own —
https://tryriot.com/llms.txt and https://docs.tryriot.com/llms.txt both return 404. This file is
generated from the provider's published OpenAPI and public pages; it is a third-party profile, not a Riot
document.

## Key facts

- Base URL: https://public-api.tryriot.com/v1
- Spec: OpenAPI 3.1.1, served at https://public-api.tryriot.com/openapi
- Auth: `x-api-key` header. Not self-service — customers request a key from Riot's technical team.
- Key scoping: organization-scoped or workspace-scoped; optional read scopes (`awareness:read`,
  `simulation:read`, `breach:read`, `workspace:read`). Cross-workspace access returns 403.
- Surface size: 32 paths, 40 operations, 109 schemas. 36 GET, 1 POST, plus 17 SCIM operations.
- Pagination: cursor. `limit` (default 50, max 100) + `cursor`; response `metadata.next_cursor`; `link`
  header with `rel="next"`.
- Errors: JSON:API-style `errors[]` array with code/title/detail/source.pointer. NOT RFC 9457.
- Rate limits: per key, fixed interval, 429 on exceed. No numeric limit and no RateLimit-*/Retry-After
  headers are published.
- Events: 2 webhook types, declared in the OpenAPI `webhooks` block. Standard Webhooks signing
  (HMAC-SHA256), OCSF Detection Finding payloads. No AsyncAPI document.
- No OAuth 2.0, no OpenID Connect, no GraphQL, no MCP server, no A2A agent card, no first-party SDKs.

## APIs

- [Riot Public API](https://docs.tryriot.com/): Read access to organization, workspaces, employees,
  groups, awareness courses and progress, phishing simulation campaigns/attacks/events, credential
  breaches and compromised employees, and Inbox/Slash statistics; plus SCIM 2.0 provisioning and
  server-to-server webhooks.

## Operations by product

- General: `organizations_get_XEBQFJQ`, `employees_get_paginated_LRY7OLI`, `employees_get_LRY7OLI`,
  `employees_get_statistics_LRY7OLI`, `groups_get_paginated_BOILCUA`,
  `groups_get_group_employees_BOILCUA`, `domains_get_paginated_domains_OOWLIAA`
- Awareness: `courses_get_paginated_DJESCNQ`, `courses_get_statistics_DJESCNQ`,
  `courses_get_employees_progress_DJESCNQ`, `courses_get_course_statuses_of_employees_DJESCNQ`
- Simulation: `campaigns_get_paginated_CWCTX3I`, `campaigns_get_statistics_CWCTX3I`,
  `attacks_get_paginated_KCLEOEQ`, `attack_login_domains_get_attack_login_domain_paginated_XU5W4YI`
- Breaches: `breaches_get_paginated_FAUE35Y`, `breaches_get_statistics_FAUE35Y`,
  `breaches_get_breach_compromised_employees_FAUE35Y`
- Inbox: `reports_report_attack_from_message_id_DO4XYPA`,
  `inbox_tickets_list_employees_with_email_reports_QHKH7RI`, `inbox_tickets_get_inbox_statistics_QHKH7RI`
- Slash: `inbound_protections_list_employees_with_alerts_stats_YGL572Y`,
  `inbound_protections_list_employees_with_impersonation_stats_YGL572Y`
- SCIM 2.0: Users, Groups, Schemas, ResourceTypes, ServiceProviderConfiguration under
  `/scim/{workspace_id}/v2/`

## Webhook events

- `inbox_email_analysis.classified` (Inbox) — an email reported to the Inbox was classified, including
  reclassification. Payload is an OCSF Detection Finding, class 2004, v1.4.0.
- `revoke_drive_item_permission_request.created` (Sonar) — Riot asks the customer to revoke a Google or
  Microsoft drive permission. Riot does not perform the revocation itself.

## Docs

- [API reference](https://docs.tryriot.com/)
- [OpenAPI document](https://public-api.tryriot.com/openapi)
- [Changelog](https://tryriot.com/changelog/)
- [Status](https://status.tryriot.com/)
- [Pricing](https://tryriot.com/pricing/)
- [Security](https://tryriot.com/security/)
- [Trust center](https://trust.tryriot.com/)
- [security.txt](https://tryriot.com/.well-known/security.txt)
- [Blog](https://tryriot.com/blog/)
- [GitHub organization](https://github.com/tryriot)

## API Evangelist artifacts

- openapi/riot-public-api-openapi.yml — harvested spec
- openapi/_original/riot-openapi.json — verbatim source
- authentication/riot-authentication.yml
- scopes/riot-scopes.yml
- conventions/riot-conventions.yml
- errors/riot-error-codes.yml
- rate-limits/riot-rate-limits.yml
- lifecycle/riot-lifecycle.yml
- changelog/riot-changelog.yml
- conformance/riot-conformance.yml
- data-model/riot-data-model.yml
- asyncapi/riot-webhooks.yml
- mcp/riot-mcp.yml (candidate only — Riot operates no MCP server)
- skills/_index.yml
- agentic-access/riot-agentic-access.yml
- security/riot-domain-security.yml
- security/riot-trust-center.yml
- security/riot-vulnerability-disclosure.yml
- well-known/riot-well-known.yml
- overlays/riot-public-api-overlay.yaml

## Compliance

- AICPA SOC 2 Type II, GDPR (published at https://tryriot.com/security/ and https://trust.tryriot.com/)
- Data hosted in AWS (Ireland) and Azure (France); AES-256 at rest, TLS 1.2+ in transit
- Coordinated vulnerability disclosure via Yogosha; security@tryriot.com