openapi: 3.2.0 info: title: SecurityScorecard Customer API version: 0.0.1 contact: name: SecurityScorecard Support email: support@securityscorecard.io description: 'For onboarding instructions and details on how SecurityScorecard API works, please see our Readme guide: https://securityscorecard.readme.io/docs For technical support please contact us at support@securityscorecard.io. We typically respond in 48 hours and operate Monday thru Friday 9am - 5pm EST (excluding US federal holidays).' x-logo: url: https://platform.securityscorecard.io/images/ssc-logo-white-stacked.svg backgroundColor: '#222830' servers: - url: https://api.securityscorecard.io security: - Token: [] tags: - name: Customer paths: /max/customer/breaches: get: summary: Get max customer breaches description: Gets breaches for the current customer tags: - Customer parameters: - in: query name: triaged required: false example: 'true' schema: type: string enum: - 'true' - 'false' description: Filter findings that are set to be triaged - in: query name: report required: false example: 'true' schema: type: string enum: - 'true' - 'false' description: Filter findings that are set to be reported - in: query name: vendor_id required: false example: aea7dae2-370f-4279-a458-4c7cb9661778 schema: type: string format: uuid pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ description: Vendor ID filter, accepts single value or comma separated list of vendor ids - in: query name: vendor_domain required: false example: securityscorecard.com schema: type: string description: Vendor domain filter, accepts single value or comma separated list of vendor domains - in: query name: vendor_name required: false example: SecurityScorecard schema: type: string description: Vendor name filter, accepts single value or comma separated list of vendor names - in: query name: published_at required: false example: '{"operator":"gte","value":"2025-01-01"}' schema: type: string description: Published date filter, accept stringified object with date value and operator - in: query name: recent_only required: false example: 'true' schema: type: string enum: - 'true' - 'false' description: Set true to get just recently triaged breaches along with the not triaged ones - in: query name: search required: false example: foo bar schema: type: string description: Word or phrase to search records for - in: query name: sort required: false example: '{"column":"published_at","order":"desc"}' schema: type: string description: Stringified object with value for column to order by and operator - in: query name: page required: false schema: type: integer description: optionally specify which page of results to return - in: query name: limit required: false example: 25 schema: type: integer maximum: 1500 description: optionally specify how many results to return, maximum is 1500 - name: version in: header schema: type: string example: beta description: API version header responses: '200': description: Breaches list for the given filters content: application/json: schema: $ref: '#/components/schemas/BreachesList' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorBadRequest' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorUnauthorized' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorForbidden' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/ErrorNotFound' '429': description: Too Many Requests content: application/json: schema: $ref: '#/components/schemas/ErrorRateLimit' x-summary-source: derived operationId: getMaxCustomerBreaches x-operation-id-source: derived /max/customer/documents: get: summary: Get max customer documents description: Get list of documents related to a customer. tags: - Customer parameters: - in: query name: filter required: false example: '[{"operator":"like","id":"filename","value":["test"],"type":"multiValue"},{"operator":"lt","id":"date","value":["2025-01-01"],"type":"date"},{"operator":"like","id":"uploaded_by","value":["someone@securityscorecard.io"],"type":"multiValue"},{"operator":"like","id":"associated_vendors","value":["securityscorecard.io"],"type":"multiValue"}]' schema: type: string description: Filters to apply to the documents - in: query name: search required: false example: foo bar schema: type: string description: Word or phrase to search records for - in: query name: sort required: false example: '[{"id":"date","desc":"true"}]' schema: type: string description: stringified object with value for column to order by and operator - in: query name: page required: false schema: type: integer description: optionally specify which page of results to return - in: query name: limit required: false example: 25 schema: type: integer maximum: 1500 description: optionally specify how many results to return, maximum is 1500 - name: version in: header schema: type: string example: beta description: API version header responses: '200': description: A list of documents for the specified customer. content: application/json: schema: $ref: '#/components/schemas/DocumentsListSchema' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorBadRequest' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorUnauthorized' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorForbidden' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/ErrorNotFound' '429': description: Too Many Requests content: application/json: schema: $ref: '#/components/schemas/ErrorRateLimit' x-summary-source: derived operationId: getMaxCustomerDocuments x-operation-id-source: derived post: summary: Create max customer documents description: Upload a document. tags: - Customer parameters: - name: version in: header schema: type: string example: beta description: API version header requestBody: content: multipart/form-data: schema: $ref: '#/components/schemas/DocumentToUploadSchema' required: true responses: '201': description: A document id. content: application/json: schema: $ref: '#/components/schemas/DocumentIdSchema' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorBadRequest' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorUnauthorized' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorForbidden' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/ErrorNotFound' '429': description: Too Many Requests content: application/json: schema: $ref: '#/components/schemas/ErrorRateLimit' x-summary-source: derived operationId: postMaxCustomerDocuments x-operation-id-source: derived put: summary: Replace max customer documents description: Edit a document metadata. tags: - Customer parameters: - name: version in: header schema: type: string example: beta description: API version header requestBody: content: application/json: schema: $ref: '#/components/schemas/DocumentToUpdateSchema' required: true responses: '200': description: An updated document ID. content: application/json: schema: $ref: '#/components/schemas/DocumentIdSchema' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorBadRequest' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorUnauthorized' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorForbidden' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/ErrorNotFound' '429': description: Too Many Requests content: application/json: schema: $ref: '#/components/schemas/ErrorRateLimit' x-summary-source: derived operationId: putMaxCustomerDocuments x-operation-id-source: derived /max/customer/documents/{id}: get: summary: Get max customer documents by id description: Get url of a document. tags: - Customer parameters: - in: path name: id required: true example: aea7dae2-370f-4279-a458-4c7cb9661778 schema: type: string format: uuid pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ description: Document identifier - name: version in: header schema: type: string example: beta description: API version header responses: '200': description: A url of a document. content: application/json: schema: $ref: '#/components/schemas/DocumentUrlSchema' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorBadRequest' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorUnauthorized' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorForbidden' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/ErrorNotFound' '429': description: Too Many Requests content: application/json: schema: $ref: '#/components/schemas/ErrorRateLimit' x-summary-source: derived operationId: getMaxCustomerDocumentsById x-operation-id-source: derived /max/customer/findings: get: summary: Get max customer findings description: Gets triaged and reported findings of current customer tags: - Customer parameters: - in: query name: with_hostname required: false example: 'true' schema: type: string enum: - 'true' - 'false' description: Set true for findings with hostname - in: query name: all_dates required: false example: true schema: type: boolean description: Default is false and retrieves 15 days findings, if allDates is true will return 30 days findings - in: query name: hostname required: false example: securityscorecard.com schema: type: string description: Hostname filter, accepts single value or comma separated list of hostnames - in: query name: hostname_matches required: false example: 'true' schema: type: string enum: - 'true' - 'false' description: Set true for findings that have matching vendor domain and hostname - in: query name: max_severity required: false example: Low schema: type: string enum: - Low - Medium - High - Critical description: Max Severity filter, accepts single value or comma separated list of max severities - in: query name: issue_category required: false example: Suspicious Activity schema: type: string description: Category filter, accepts single value or comma separated list of issue categories - in: query name: issue_type_key required: false example: typosquat schema: type: string description: Issue type key filter, accepts single value or comma separated list of issue type keys - in: query name: vendor_id required: false example: aea7dae2-370f-4279-a458-4c7cb9661778 schema: type: string format: uuid pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ description: Vendor ID filter, accepts single value or comma separated list of vendor ids - in: query name: vendor_domain required: false example: securityscorecard.com schema: type: string description: Vendor domain filter, accepts single value or comma separated list of vendor domains - in: query name: vendor_name required: false example: SecurityScorecard schema: type: string description: Vendor name filter, accepts single value or comma separated list of vendor names - in: query name: last_seen required: false example: '{"operator":"gte","value":"2025-01-01"}' schema: type: string description: Last seen filter, accepts stringified object with date value and operator - in: query name: first_seen required: false example: '{"operator":"gte","value":"2025-01-01"}' schema: type: string description: First seen filter, accepts stringified object with date value and operator - in: query name: cve_severity required: false example: low schema: type: string enum: - low - medium - high - critical description: CVE severity filter, accepts single value or comma separated list of severities - in: query name: cve_exploited required: false example: true schema: type: boolean description: True for findings related with a known exploited CVE - in: query name: business_impacts required: false example: medium schema: type: string enum: - low - medium - high - critical description: Filter by business impact - in: query name: search required: false example: foo bar schema: type: string description: Word or phrase to search records for - in: query name: sort required: false example: '[{"id":"first_observed_at","desc":"true"}]' schema: type: string description: stringified object with value for column to order by and operator - in: query name: page required: false schema: type: integer description: optionally specify which page of results to return - in: query name: limit required: false example: 25 schema: type: integer maximum: 1500 description: optionally specify how many results to return, maximum is 1500 - name: version in: header schema: type: string example: beta description: API version header responses: '200': description: Findings list for the given filters content: application/json: schema: $ref: '#/components/schemas/FindingsList' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorBadRequest' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorUnauthorized' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorForbidden' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/ErrorNotFound' '429': description: Too Many Requests content: application/json: schema: $ref: '#/components/schemas/ErrorRateLimit' x-summary-source: derived operationId: getMaxCustomerFindings x-operation-id-source: derived /max/customer/reports/remediation-plans: get: summary: Get max customer reports remediation plans description: Get list of managed action plans for current customer vendors tags: - Customer parameters: - name: filter in: query description: Filter action plans by specific criteria. The filter should be a JSON string that contains an array of objects, each representing a filter condition. schema: type: string example: '[{"operator":"eq","id":"scorecard","value":["securityscorecard.com"],"type":"multiValueWithAsyncOptions"},{"operator":"eq","id":"managed_scorecard","value":["amazon.com"],"type":"multiValueWithAsyncOptions"},{"operator":"gt","id":"created_at","value":["2025-03-01"],"type":"date"},{"operator":"eq","id":"status","value":["active"],"type":"multiValueWithOptions"},{"operator":"gt","id":"progress","value":[5],"type":"number"},{"operator":"gt","id":"due_date","value":["2025-06-30"],"type":"date"}]' - in: query name: search required: false example: '[{"id":"name","value":"test"}]' schema: type: string description: 'Search remediation plans by providing a JSON string that represents an array of objects; each object should include “id” for the field to search and “value” as the term to match. For example, to search plans by name, use { "id": "name", "value": "test" }.' - in: query name: sort required: false example: '[{"id":"name","desc":true}]' schema: type: string description: Sort remediation plans by providing a JSON string representing an array of objects; each object should include "id" for the column to sort by and "desc" as a boolean indicating descending (true) or ascending (false) order. - in: query name: page required: false schema: type: integer description: optionally specify which page of results to return - in: query name: limit required: false example: 25 schema: type: integer maximum: 1500 description: optionally specify how many results to return, maximum is 1500 - name: version in: header schema: type: string example: beta description: API version header responses: '200': description: A list of action plans visible by the user content: application/json: schema: $ref: '#/components/schemas/ActionPlansList' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorBadRequest' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorUnauthorized' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorForbidden' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/ErrorNotFound' '429': description: Too Many Requests content: application/json: schema: $ref: '#/components/schemas/ErrorRateLimit' x-summary-source: derived operationId: getMaxCustomerReportsRemediationPlans x-operation-id-source: derived /max/customer/updates: get: summary: Get max customer updates description: Get updates for the current customer tags: - Customer parameters: - in: query name: search required: false example: '[{"id":"summary","type":"like","value":["test"]}]' schema: type: string description: Search updates by providing a JSON string that represents an array of objects; each object should include “id” for the field to search, “type” for the matching operator (e.g., “like” or “eq”), and “value” as an array of values to compare. - in: query name: sort required: false example: '[{"id":"date","desc":true}]' schema: type: string description: Sort updates by providing a JSON string representing an array of objects; each object should include "id" for the column to sort by and "desc" as a boolean indicating descending (true) or ascending (false) order. - in: query name: page required: false schema: type: integer description: optionally specify which page of results to return - in: query name: limit required: false example: 25 schema: type: integer maximum: 1500 description: optionally specify how many results to return, maximum is 1500 - name: filter in: query description: Filter updates by providing a JSON string that represents an array of objects; each object should include “id” for the field to filter, “type” for the operator (e.g., “like” or “eq”), and “value” as an array of values to compare. schema: type: string example: '[{"id":"summary","type":"like","value":["test"]}]' - name: version in: header schema: type: string example: beta description: API version header responses: '200': description: Successfull response containing customer updates with their associated shared documents for the current customer content: application/json: schema: $ref: '#/components/schemas/CustomerUpdatesList' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorBadRequest' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorUnauthorized' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorForbidden' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/ErrorNotFound' '429': description: Too Many Requests content: application/json: schema: $ref: '#/components/schemas/ErrorRateLimit' x-summary-source: derived operationId: getMaxCustomerUpdates x-operation-id-source: derived /max/customer/users/access: get: summary: Get max customer users access description: Gets user access dashboard tags: - Customer parameters: - name: version in: header schema: type: string example: beta description: API version header responses: '200': description: Dashboard access settings for user content: application/json: schema: $ref: '#/components/schemas/UserAccess' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorBadRequest' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorUnauthorized' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorForbidden' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/ErrorNotFound' '429': description: Too Many Requests content: application/json: schema: $ref: '#/components/schemas/ErrorRateLimit' x-summary-source: derived operationId: getMaxCustomerUsersAccess x-operation-id-source: derived /max/customer/vendors: get: summary: Get max customer vendors description: Get all vendors for current customer tags: - Customer parameters: - in: query name: search required: false example: '' schema: type: string description: Search text to look for vendor name, vendor domain or customer name. - in: query name: sort required: false example: '[{"id":"tier","desc":true}]' schema: type: string description: Sort vendors by providing a JSON string representing an array of objects; each object should include "id" for the column to sort by and "desc" as a boolean indicating descending (true) or ascending (false) order. - in: query name: page required: false schema: type: integer description: optionally specify which page of results to return - in: query name: limit required: false example: 25 schema: type: integer maximum: 1500 description: optionally specify how many results to return, maximum is 1500 - in: query name: vendor_name required: false schema: type: string description: Vendor name filter, accepts single value or comma separated list of vendor names. - in: query name: customer_name required: false schema: type: string description: Customer name filter, accepts single value or comma separated list of customer names. - in: query name: tier required: false example: platinum, gold, silver schema: type: string description: Tier filter, accepts single value or comma separated list of tiers. - in: query name: lifecycle required: false example: assess, monitor, respond, maintain schema: type: string description: Lifecycle filter, accepts single value or comma separated list of lifecycle values. - in: query name: status required: false example: ok, at_significant_risk, needs_attention, risk_escalating, active_breach schema: type: string description: Status filter, accepts single value or comma separated list of status values. - in: query name: incident_likelihood required: false example: none, low, medium, high, critical schema: type: string description: Incident likelihood filter, accepts single value or comma separated list of values. - in: query name: business_impact required: false example: none, low, medium, high, critical schema: type: string description: Business impact filter, accepts single value or comma separated list of business impact values. - in: query name: incident_likelihood_trend required: false example: doing_well, improved, did_not_improve, worsened, only_once schema: type: string description: Incident likelihood trend filter, accepts single value or comma separated list of values. - in: query name: initial_assessment required: false example: none, low, medium, high, critical schema: type: string description: Initial assessment filter, accepts single value or comma separated list of values. - in: query name: previous_assessment required: false example: none, low, medium, high, critical schema: type: string description: Previous assessment filter, accepts single value or comma separated list of values. - name: version in: header schema: type: string example: beta description: API version header responses: '200': description: Successful response containing a list of vendors for current customer content: application/json: schema: $ref: '#/components/schemas/VendorsList' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorBadRequest' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorUnauthorized' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorForbidden' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/ErrorNotFound' '429': description: Too Many Requests content: application/json: schema: $ref: '#/components/schemas/ErrorRateLimit' x-summary-source: derived operationId: getMaxCustomerVendors x-operation-id-source: derived /max/customer/vendors-improvements: get: summary: Get max customer vendors improvements description: Returns the customer vendors grouped by their status on vendor improvement tags: - Customer parameters: - name: version in: header schema: type: string example: beta description: API version header responses: '200': description: Customer vendors grouped by their status on vendor improvement content: application/json: schema: $ref: '#/components/schemas/CustomerVendorsTrends' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorBadRequest' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorUnauthorized' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorForbidden' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/ErrorNotFound' '429': description: Too Many Requests content: application/json: schema: $ref: '#/components/schemas/ErrorRateLimit' x-summary-source: derived operationId: getMaxCustomerVendorsImprovements x-operation-id-source: derived /max/customer/vendors/updates: get: summary: Get max customer vendors updates description: Get vendor updates for the current customer tags: - Customer parameters: - in: query name: search required: false example: foo bar schema: type: string description: Word or phrase to search records for - in: query name: sort required: false example: '[{"id":"escalated_date","desc":true}]' schema: type: string description: Sort vendor updates by providing a JSON string representing an array of objects; each object should include "id" for the column to sort by and "desc" as a boolean indicating descending (true) or ascending (false) order. - in: query name: page required: false schema: type: integer description: optionally specify which page of results to return - in: query name: limit required: false example: 25 schema: type: integer maximum: 1500 description: optionally specify how many results to return, maximum is 1500 - in: query name: filter required: false example: '[{"id":"vendor_name","type":"like","value":["amazon"]},{"id":"summary","type":"like","value":["TEST"]},{"id":"priority","type":"eq","value":["CRITICAL"]},{"id":"responsive","type":"eq","value":[true]},{"id":"action_needed","type":"eq","value":[false]},{"id":"escalated_date","type":"lt","value":"2025-05-29"}]' schema: type: string description: 'Used to filter vendor updates data by applying one or more conditions. Accepts a URL-encoded JSON array where each object defines a filter with keys: ''operator'', ''id'', ''value'', and ''type''. For example, to filter vendor updates by a specific vendor name, use an object like {"operator": "eq", "id": "vendor_name", "value": ["example.com"], "type": "multiValue"}.' - name: version in: header schema: type: string example: beta description: API version header responses: '200': description: Successfull response with the list of vendor updates for the current customer content: application/json: schema: $ref: '#/components/schemas/VendorUpdatesList' '400': description: Bad Request content: application/json: schema: $ref: '#/components/schemas/ErrorBadRequest' '401': description: Unauthorized content: application/json: schema: $ref: '#/components/schemas/ErrorUnauthorized' '403': description: Forbidden content: application/json: schema: $ref: '#/components/schemas/ErrorForbidden' '404': description: Not Found content: application/json: schema: $ref: '#/components/schemas/ErrorNotFound' '429': description: Too Many Requests content: application/json: schema: $ref: '#/components/schemas/ErrorRateLimit' x-summary-source: derived operationId: getMaxCustomerVendorsUpdates x-operation-id-source: derived components: schemas: ErrorForbidden: type: object properties: error: type: object properties: message: description: Human readable message, suitable for showing in some UI type: string statusCode: type: integer default: 403 required: - message - statusCode CustomerVendorsTrends: type: object description: Vendor risk profiles for uploaded domains properties: vendors_doing_well: type: object description: Vendors trend metadata properties: count: type: number description: Total number of vendors in the trend percentage: type: number description: Percentage of vendors in the trend required: - count - percentage vendors_improved: type: object description: Vendors trend metadata properties: count: type: number description: Total number of vendors in the trend percentage: type: number description: Percentage of vendors in the trend required: - count - percentage vendors_didnt_improve: type: object description: Vendors trend metadata properties: count: type: number description: Total number of vendors in the trend percentage: type: number description: Percentage of vendors in the trend required: - count - percentage vendors_worsened: type: object description: Vendors trend metadata properties: count: type: number description: Total number of vendors in the trend percentage: type: number description: Percentage of vendors in the trend required: - count - percentage vendors_first_assessment: type: object description: Vendors trend metadata properties: count: type: number description: Total number of vendors in the trend percentage: type: number description: Percentage of vendors in the trend required: - count - percentage required: - vendors_doing_well - vendors_improved - vendors_didnt_improve - vendors_worsened - vendors_first_assessment DocumentToUploadSchema: type: object description: Document to upload. properties: description: type: string description: description of the document example: This is a description associatedVendorIds: type: string description: Array of associated vendor IDs (sent as a JSON-stringified array in form-data) example: '{}' customerId: type: string description: customer id example: 123e4567-e89b-12d3-a456-426614174000 file: type: string format: binary description: document file required: - customerId - file DocumentIdSchema: type: object properties: id: type: string format: uuid example: 123e4567-e89b-12d3-a456-426614174000 description: Unique ID of the document required: - id DocumentUrlSchema: type: object properties: url: type: string example: https://example.com/document.csv DocumentToUpdateSchema: type: object description: Document properties: documentId: type: string format: uuid example: 690cba40-cddd-4c61-b18e-63b0230512b5 filename: type: string example: updated-name.csv description: type: string example: This is a description associatedVendorIds: type: array items: type: string format: uuid example: - 5a935701-9960-5895-882a-08e6284f0f58 required: - documentId VendorsList: type: object additionalProperties: false properties: entries: type: array description: List of vendors items: type: object properties: vendor_id: example: aea7dae2-370f-4279-a458-4c7cb9661778 pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ description: Unique identifier of vendor type: string vendor_name: example: SecurityScorecard type: string description: Vendor name vendor_domain: example: securityscorecard.com type: string description: Vendor domain customer_id: example: aea7dae2-370f-4279-a458-4c7cb9661778 pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ description: Identifier type: string customer_name: example: SecurityScorecard type: string customer_domain: example: securityscorecard.com type: string business_impact: type: string incident_likelihood: type: string engagement: type: string lifecycle: type: string tier: type: string custom_tags: type: array items: type: object properties: id: example: aea7dae2-370f-4279-a458-4c7cb9661778 pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ description: Identifier type: string name: type: string required: - name incident_likelihood_report_id: example: aea7dae2-370f-4279-a458-4c7cb9661778 pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ description: Identifier type: string deleted_at: example: '2020-01-01T00:00:00.000Z' format: date-time type: string pattern: ^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}\.{0,1}[0-9]*Z$ created_at: example: '2020-01-01T00:00:00.000Z' format: date-time type: string pattern: ^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}\.{0,1}[0-9]*Z$ required: - vendor_id - vendor_name - vendor_domain - customer_id - customer_name - customer_domain - business_impact - incident_likelihood - engagement - lifecycle - tier - custom_tags total: description: The total number of records matching the given query example: 999 type: integer required: - entries - total ErrorRateLimit: type: object properties: error: type: object properties: message: description: Human readable message, suitable for showing in some UI type: string statusCode: type: integer default: 429 required: - message - statusCode BreachesList: type: object additionalProperties: false properties: entries: type: array items: allOf: - type: object properties: vendor_id: example: aea7dae2-370f-4279-a458-4c7cb9661778 pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ description: vendor identifier type: string vendor_domain: example: securityscorecard.com type: string description: domain of the vendor vendor_name: type: string description: name of the vendor example: SecurityScorecard customers: type: array items: type: object properties: id: example: aea7dae2-370f-4279-a458-4c7cb9661778 pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ description: id of the customer type: string domain: example: securityscorecard.com type: string description: domain of the customer name: example: SecurityScorecard type: string description: name of the customer required: - id - domain - name report: type: boolean description: is reported triaged: type: boolean description: is triaged is_active_breach: type: boolean description: vendor has breach edited_at: example: '2020-01-01T00:00:00.000Z' type: string pattern: ^(?:\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}\.{0,1}\d*Z)?$ description: last edition of report or trigger fields required: - vendor_id - vendor_domain - vendor_name - customers - report - triaged - is_active_breach - edited_at - type: object properties: breach_id: example: aea7dae2-370f-4279-a458-4c7cb9661778 pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ description: breach identifier type: string description: type: string description: description of the breach link: example: https://www.example.com/resource/123 type: string description: source URL of the breach published_date: type: string format: date example: '2020-01-01' pattern: ^\d{4}-\d{2}-\d{2}$ description: published date of the breach required: - breach_id - description - link - published_date size: description: The number of records to be returned per page example: 100 type: integer page: description: The page number to be returned example: 1 type: integer total: description: The total number of records matching the given query example: 999 type: integer required: - entries - size - page - total FindingsList: type: object additionalProperties: false properties: entries: type: array items: allOf: - type: object properties: vendor_id: example: aea7dae2-370f-4279-a458-4c7cb9661778 pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ description: vendor identifier type: string vendor_domain: example: securityscorecard.com type: string description: domain of the vendor vendor_name: type: string description: name of the vendor example: SecurityScorecard customers: type: array items: type: object properties: id: example: aea7dae2-370f-4279-a458-4c7cb9661778 pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ description: id of the customer type: string domain: example: securityscorecard.com type: string description: domain of the customer name: example: SecurityScorecard type: string description: name of the customer required: - id - domain - name report: type: boolean description: is reported triaged: type: boolean description: is triaged is_active_breach: type: boolean description: vendor has breach edited_at: example: '2020-01-01T00:00:00.000Z' type: string pattern: ^(?:\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}\.{0,1}\d*Z)?$ description: last edition of report or trigger fields required: - vendor_id - vendor_domain - vendor_name - customers - report - triaged - is_active_breach - edited_at - type: object properties: description: type: string description: description of the finding finding_id: example: aea7dae2-370f-4279-a458-4c7cb9661778 pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ description: an uuid of an existing finding type: string information: type: array description: Finding information of the finding items: type: object properties: title: type: string description: Title of the field value: type: string description: value of the field required: - title - value extra_information: type: array description: extra information fields with not empty value items: type: object properties: title: type: string description: Title of the field value: type: string description: value of the field required: - title - value first_observed_at: example: '2020-01-01T00:00:00.000Z' format: date-time type: string pattern: ^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}\.{0,1}[0-9]*Z$ description: first observed date time last_observed_at: example: '2020-01-01T00:00:00.000Z' format: date-time type: string pattern: ^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}\.{0,1}[0-9]*Z$ description: last observed date time issue_name: type: string description: Issue Name issue_type: type: string description: Issue Type category: type: string description: Max Finding category max_severity: type: string description: Max severity breach_risk: type: string description: Breach risk threat_level: type: string description: Threat level hostname: type: string description: Asset hostname ip_address: type: string description: the asset IP address product_name: type: string description: Product Name product_version: type: string description: Product Version port: type: number description: Port number cve: type: object description: CVE information properties: id: type: string description: CVE ID known_exploit: type: boolean description: true if it is known the CVE was exploited last_modified_date: example: '2020-01-01T00:00:00.000Z' format: date-time type: string pattern: ^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}\.{0,1}[0-9]*Z$ description: Last modified date severity: type: string description: Nvd severity score: type: number description: Nvd score description: type: string description: CVE description required: - id - known_exploit - last_modified_date - severity - score - description malware: type: object description: Malware information properties: family: type: string description: Malware family detection_method: type: string description: Malware Detection Methods required: - family - detection_method last_breach: type: object description: Last breach information properties: description: type: string description: Breach description source_type: type: string description: Source type news_source: type: string description: Source url (news) source: type: string description: Source url (official) published_at: type: string format: date example: '2020-01-01' pattern: ^\d{4}-\d{2}-\d{2}$ description: Breach published date required: - description - published_at required: - max_severity - category - issue_type - issue_name - last_observed_at - first_observed_at - information - finding_id - description size: description: The number of records to be returned per page example: 100 type: integer page: description: The page number to be returned example: 1 type: integer total: description: The total number of records matching the given query example: 999 type: integer required: - entries - size - page - total ErrorBadRequest: type: object properties: error: type: object properties: message: description: Human readable message, suitable for showing in some UI type: string statusCode: type: integer default: 400 required: - message - statusCode UserAccess: type: object properties: email: type: string description: Email of the user pattern: ^.+@.+$ example: john.smith@example.com access_type: type: string description: Dashboard access required: - email - access_type CustomerUpdatesList: type: object additionalProperties: false properties: entries: type: array description: A list of customer updates with their associated shared documents for the current customer items: type: object properties: id: example: aea7dae2-370f-4279-a458-4c7cb9661778 pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ description: Identifier type: string date: example: '2020-01-01T00:00:00.000Z' format: date-time type: string pattern: ^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}\.{0,1}[0-9]*Z$ summary: type: string description: summary of the customer update featured: type: boolean description: is it featured update link: example: https://www.example.com/resource/123 type: string description: source URL created_by: type: string description: user who created the update required: - id - date - summary - featured - link - created_by total: description: The total number of records matching the given query example: 999 type: integer required: - entries - total ActionPlansList: type: object additionalProperties: false properties: entries: type: array items: type: object properties: id: example: aea7dae2-370f-4279-a458-4c7cb9661778 pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ description: action plan identifier type: string remediation_version: type: string roles: type: array items: type: string name: type: string description: action plan name example: Example action plan description: type: string description: description example: Example description due_date: anyOf: - example: '2020-01-01T00:00:00.000Z' format: date-time type: string pattern: ^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}\.{0,1}[0-9]*Z$ - type: string maxLength: 0 example: '' description: due date scorecard: description: scorecard identifier example: example.com type: string anyOf: - example: example.com type: string description: primary domain of the company - example: aea7dae2-370f-4279-a458-4c7cb9661778 pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ description: Identifier type: string guests: type: array items: type: string description: list of emails of guest users editors: type: array items: type: string description: list of emails of editors created_by: type: string example: user@example.com description: user who created the object created_at: example: '2020-01-01T00:00:00.000Z' format: date-time type: string pattern: ^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}\.{0,1}[0-9]*Z$ description: created date updated_by: type: string example: user@example.com description: user who updated the object updated_at: example: '2020-01-01T00:00:00.000Z' format: date-time type: string pattern: ^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}\.{0,1}[0-9]*Z$ description: created date type: type: string description: action plan type example: overall_score_improvement enum: - overall_score_improvement - remediation - issue_resolution - factor_score_improvement status: type: string description: action plan status example: active enum: - active - completed organization_domain: example: example.com type: string description: primary domain of the company archived_at: anyOf: - example: '2020-01-01T00:00:00.000Z' format: date-time type: string pattern: ^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}\.{0,1}[0-9]*Z$ - type: string maxLength: 0 example: '' description: archived date synchronized_at: anyOf: - example: '2020-01-01T00:00:00.000Z' format: date-time type: string pattern: ^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}\.{0,1}[0-9]*Z$ - type: string maxLength: 0 example: '' description: synchronized date is_custom_scorecard: type: boolean description: true if this action plan is based on a custom scorecard, false otherwise company_name: example: Example Ltd. type: string company_score: type: integer description: security score from 0 to 100 example: 95 factor_scores: type: array items: type: object properties: factor: type: string description: factor name/id example: network_security score: type: integer description: security score from 0 to 100 example: 95 additionalProperties: false target: type: object properties: factor_score_targets: type: array items: type: object properties: factor: type: string description: factor name/id example: network_security score: type: integer description: security score from 0 to 100 example: 95 additionalProperties: false overall_score: type: number description: overall score of the action plan if applies example: 90 criteria: type: object properties: factors: type: array items: type: string description: factor name/id example: network_security description: factors associated to the action plan if applies issues: type: array items: description: issue type (permanent key) type: string example: cookie_secure_flag description: issues associated to the action plan if applies is_managed: type: boolean is_published: type: boolean managed_scorecard: type: string total_issues: type: number example: 36 description: number of issues associated to the action plan closed_issues: type: number example: 0 description: number of closed issues associated to the action plan progress: type: number example: 0 description: percentage of progress size: description: The number of records to be returned per page example: 100 type: integer page: description: The page number to be returned example: 1 type: integer total: description: The total number of records matching the given query example: 999 type: integer required: - entries - size - page - total ErrorUnauthorized: type: object properties: error: type: object properties: message: description: Human readable message, suitable for showing in some UI type: string statusCode: type: integer default: 401 required: - message - statusCode VendorUpdatesList: type: object additionalProperties: false properties: entries: type: array description: A list of vendor updates for the current customer items: type: object properties: id: example: aea7dae2-370f-4279-a458-4c7cb9661778 pattern: ^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$ description: Identifier type: string summary: type: string description: summary of the vendor update escalated_date: example: '2020-01-01T00:00:00.000Z' format: date-time type: string pattern: ^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}\.{0,1}[0-9]*Z$ priority: type: string description: priority of the vendor update responsive: type: boolean description: is responsive action_needed: type: boolean description: is any action needed date: example: '2020-01-01T00:00:00.000Z' format: date-time type: string pattern: ^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}\.{0,1}[0-9]*Z$ updated_at: example: '2020-01-01T00:00:00.000Z' format: date-time type: string pattern: ^\d{4}-\d{2}-\d{2}[T ]\d{2}:\d{2}:\d{2}\.{0,1}[0-9]*Z$ vendor_domain: example: securityscorecard.com type: string description: domain of the vendor vendor_name: example: SecurityScorecard type: string description: name of the vendor required: - id - summary - escalated_date - priority - responsive - action_needed - date - vendor_domain - vendor_name total: description: The total number of records matching the given query example: 999 type: integer required: - entries - total ErrorNotFound: type: object properties: error: type: object properties: message: description: Human readable message, suitable for showing in some UI type: string statusCode: type: integer default: 404 required: - message - statusCode DocumentsListSchema: type: object additionalProperties: false properties: entries: type: array description: A list of documents for the specified customer. items: type: object description: Document properties: id: type: string format: uuid customerId: type: string format: uuid filename: type: string description: type: string createdAt: type: string format: date-time createdBy: type: string associatedVendorIds: type: array items: type: string required: - id - filename total: description: The total number of records matching the given query example: 999 type: integer required: - entries - total securitySchemes: Token: type: apiKey in: header name: Authorization description: "SecurityScorecard API endpoints require an authentication token to be passed\nin an authorization header in order to return data. If you do not already\nhave a token, you can create one by going to the API Access area in your\n[Settings page](https://platform.securityscorecard.io/#/settings/api) and then\nclicking Generate New Token. Please note this tokens have no expiration\nso they can be used until manually revoked. If you have a token and generate\na new one, the previous token will be revoked and can no longer be used.\n\nAdministrators can also revoke API tokens for any user in their account.\n\nOnce you have your token you can pass it in using the `Authorization` http header like this:\n\n```\ncurl -X GET \\\n https://api.securityscorecard.io/portfolios \\\n -H 'authorization: Token '\n```" x-provenance: method: searched source: https://securityscorecard.readme.io/reference harvested: '2026-10-14' tool: harvest-readme-openapi.py note: Assembled verbatim from the OpenAPI definition ReadMe embeds in each operation page of the provider's developer portal; paths and components merged by API title, nothing authored. assembled_from: - https://securityscorecard.readme.io/reference/delete_max-partner-documents.md - https://securityscorecard.readme.io/reference/delete_max-partner-managed-customers-customer-id-updates.md - https://securityscorecard.readme.io/reference/delete_max-partner-managed-customers-customer-id-vendors-updates.md - https://securityscorecard.readme.io/reference/delete_max-partner-managed-customers-customer-id.md - https://securityscorecard.readme.io/reference/delete_max-partner-reports-bulk-delete.md - https://securityscorecard.readme.io/reference/delete_max-partner-vendors.md - https://securityscorecard.readme.io/reference/get_footprint-parentdomain-attribution-log.md - https://securityscorecard.readme.io/reference/get_max-customer-breaches.md - https://securityscorecard.readme.io/reference/get_max-customer-documents-id.md - https://securityscorecard.readme.io/reference/get_max-customer-documents.md - https://securityscorecard.readme.io/reference/get_max-customer-findings.md - https://securityscorecard.readme.io/reference/get_max-customer-reports-remediation-plans.md - https://securityscorecard.readme.io/reference/get_max-customer-updates.md - https://securityscorecard.readme.io/reference/get_max-customer-users-access.md - https://securityscorecard.readme.io/reference/get_max-customer-vendors-improvements.md - https://securityscorecard.readme.io/reference/get_max-customer-vendors-updates.md - https://securityscorecard.readme.io/reference/get_max-customer-vendors.md - https://securityscorecard.readme.io/reference/get_max-partner-breaches.md - https://securityscorecard.readme.io/reference/get_max-partner-customer-id-vendors-improvements.md - https://securityscorecard.readme.io/reference/get_max-partner-documents-id.md - https://securityscorecard.readme.io/reference/get_max-partner-findings-report-id.md - https://securityscorecard.readme.io/reference/get_max-partner-findings.md - https://securityscorecard.readme.io/reference/get_max-partner-indicators-exclusion.md - https://securityscorecard.readme.io/reference/get_max-partner-indicators.md - https://securityscorecard.readme.io/reference/get_max-partner-managed-customers-customer-domain-vendor-vendor-domain-reports-likelihood-assessments-date.md - https://securityscorecard.readme.io/reference/get_max-partner-managed-customers-customer-id-documents.md - https://securityscorecard.readme.io/reference/get_max-partner-managed-customers-customer-id-managed-portfolios.md - https://securityscorecard.readme.io/reference/get_max-partner-managed-customers-customer-id-updates.md - https://securityscorecard.readme.io/reference/get_max-partner-managed-customers-customer-id-vendors-domain.md - https://securityscorecard.readme.io/reference/get_max-partner-managed-customers-customer-id-vendors-updates.md - https://securityscorecard.readme.io/reference/get_max-partner-managed-customers-customer-id.md - https://securityscorecard.readme.io/reference/get_max-partner-managed-customers-id-access.md - https://securityscorecard.readme.io/reference/get_max-partner-managed-customers-id-users.md - https://securityscorecard.readme.io/reference/get_max-partner-managed-customers.md - https://securityscorecard.readme.io/reference/get_max-partner-reports-likelihood-assessments-logs.md - https://securityscorecard.readme.io/reference/get_max-partner-reports-managed-customers.md - https://securityscorecard.readme.io/reference/get_max-partner-reports-remediation-plans.md - https://securityscorecard.readme.io/reference/get_max-partner-reports-vendors.md - https://securityscorecard.readme.io/reference/get_max-partner-reports.md - https://securityscorecard.readme.io/reference/get_max-partner-unmanaged-customers.md - https://securityscorecard.readme.io/reference/get_max-partner-vendors-domain-managed-customers.md - https://securityscorecard.readme.io/reference/get_max-partner-vendors.md - https://securityscorecard.readme.io/reference/get_v2-portfolios-portfolio-id-companies.md - https://securityscorecard.readme.io/reference/post_max-customer-documents.md - https://securityscorecard.readme.io/reference/post_max-partner-documents.md - https://securityscorecard.readme.io/reference/post_max-partner-managed-customers-customer-id-updates.md - https://securityscorecard.readme.io/reference/post_max-partner-managed-customers-customer-id-vendors-domain-updates.md - https://securityscorecard.readme.io/reference/post_max-partner-managed-customers-id-access.md - https://securityscorecard.readme.io/reference/post_max-partner-management-requests.md - https://securityscorecard.readme.io/reference/post_max-partner-reports-likelihood-assessments.md - https://securityscorecard.readme.io/reference/post_max-partner-vendor-onboarding-add-vendor-domains-domain-or-portfolio-id.md - https://securityscorecard.readme.io/reference/post_max-partner-vendor-onboarding-negotiate-vendor-list.md - https://securityscorecard.readme.io/reference/put_max-customer-documents.md - https://securityscorecard.readme.io/reference/put_max-partner-breaches.md - https://securityscorecard.readme.io/reference/put_max-partner-documents.md - https://securityscorecard.readme.io/reference/put_max-partner-findings.md - https://securityscorecard.readme.io/reference/put_max-partner-managed-customers-updates-id.md - https://securityscorecard.readme.io/reference/put_max-partner-vendor-onboarding-add-vendor-domains-domain-or-portfolio-id.md - https://securityscorecard.readme.io/reference/put_max-partner-vendor-onboarding-negotiate-vendor-list.md - https://securityscorecard.readme.io/reference/put_max-partner-vendors-statuses.md - https://securityscorecard.readme.io/reference/put_max-partner-vendors-updates-id.md merge: pages: 61 deduped: 371 conflicts_kept_first: 0