Riot Breaches API

openapi: 3.2.0
info:
  description: "## Overview\nThe Riot API is a (mostly) RESTful API. Typically, both POST bodies and responses are JSON-encoded.\n\n## Base URL\nThe base URL for the Riot API is https://public-api.tryriot.com/v1.\n\n## Authentication\n\nEvery API request must include an authentication key in the `x-api-key` header.\n\nTo acquire an API key, customers must contact the technical team.\n\n## Authorization\n\nEach key is scoped to either a single organization or a single workspace, ensuring that access and data are restricted to the appropriate entity.\n\n- **Organization-scoped keys** can access any workspace belonging to the organization. Endpoints that take a `workspace_id` parameter accept any workspace of that organization.\n- **Workspace-scoped keys** are restricted to a single workspace. Requests targeting a different workspace through a `workspace_id` parameter are rejected with a **403** status code.\n\nKeys can also be limited by specific scopes, such as `awareness:read`, `simulation:read`, `breach:read`, or `workspace:read` which define the endpoints that can be accessed.\n\n## Pagination\n\nAll endpoints that return an array of objects support cursor-based pagination.\nEven for endpoints with a limited number of items (e.g., `/courses`), pagination is available to maintain consistency across all endpoints.\n\n**Request**\n\n- **`limit`** (query parameter): Maximum number of items per page. The maximum allowed value is `100`, with a default of `50`.\n- **`cursor`** (query parameter): Pagination cursor for retrieving the next page of results. On the first request, omit this parameter. For subsequent requests, pass the `next_cursor` value from the previous response's `metadata` object unchanged.\n\n**Response**\n\nPaginated responses include a `metadata` object alongside the `data` array:\n\n```json\n{\n  \"data\": [...],\n  \"metadata\": {\n    \"next_cursor\": \"eyJpZCI6...\",\n    \"limit\": 50\n  }\n}\n```\n\n- **`next_cursor`**: The cursor to pass in the next request. `null` when there are no more pages.\n- **`limit`**: The maximum number of items per page.\n\n**Link header**\n\nPaginated responses also include a standard `link` response header with `rel=\"next\"` when there are more results.\nThis header contains a fully constructed URL for the next page, including the cursor and any query parameters from the original request.\n\nExample: `<https://public-api.tryriot.com/v1/groups?workspace_id=abc&cursor=eyJpZCI6...>; rel=\"next\"`\n\nWhen the last page is reached, the `link` header is omitted.\n\n## Rate limits\n\nRate limiting is enforced across all API endpoints and is scoped by the authentication key. This ensures fair usage and prevents abuse of the system.\n\n- **Scope**: Rate limits are applied **per key**, meaning all requests made with the same key share the same limit.\n- **Configuration**: Specific rate limits are defined and managed by the technical team.\n- **Behavior**: The rate limiting mechanism operates within fixed time intervals. If the limit is exceeded within a given interval, further requests will return **429** status code until the next interval begins.\n\n## Webhooks\n\nRiot can push server-to-server events to a customer-configured HTTPS endpoint when something happens in a workspace (e.g. an inbox email being classified).\n\nThe implementation follows the [Standard Webhooks specification](https://github.com/standard-webhooks/standard-webhooks), so any Standard-Webhooks-compatible library can verify and consume payloads without bespoke code.\n\n**Envelope**\n\nEvery event body is wrapped in the Standard Webhooks envelope:\n\n```json\n{\n  \"type\": \"inbox_email_analysis.classified\",\n  \"timestamp\": \"2026-06-03T08:42:11.812Z\",\n  \"data\": { /* event-specific payload */ }\n}\n```\n\n**Headers**\n\n- `webhook-id`: unique event identifier. The same id is sent on every retry; use it as an idempotency key.\n- `webhook-timestamp`: Unix timestamp (seconds) of the delivery attempt.\n- `webhook-signature`: space-delimited list of `v1,<base64-hmac>` signatures, one per active endpoint secret, computed over `<webhook-id>.<webhook-timestamp>.<body>` using HMAC-SHA256 with the raw request body. Multiple signatures support zero-downtime secret rotation.\n\n**Delivery**\n\n- Method: `POST` with `content-type: application/json`.\n- Success: any `2xx` status returned within 15 seconds.\n- Failure: any non-`2xx` status, connection error, or timeout. Retries follow the Standard Webhooks recommended schedule: 10 attempts spread over ~75 hours (immediate, 5s, 5m, 30m, 2h, 5h, 10h, 14h, 20h, 24h).\n\n**Endpoint management**\n\nContact your account manager to add or rotate an endpoint. Self-service management is not available for now.\n\n**Compatibility**\n\nEvent payloads evolve over time. To stay forward-compatible, **ignore unknown fields** in the `data` object — new fields may be added at any time without notice and without a version bump.\n\nThe following changes to an existing event type are **not** considered breaking:\n\n- Adding a new field to the payload.\n- Adding a new event type.\n\nThe following changes **are** breaking and will be shipped under a new event type (e.g. `inbox_email_analysis.classified.v2`), leaving the original event type unchanged:\n\n- Removing or renaming a field.\n- Changing the type of a field.\n- Changing the meaning of an existing value (e.g. repurposing an enum value).\n\n**Event types**\n\nSee the **Webhook Events** section in the sidebar for the list of supported event types and their payload schemas.\n"
  title: Riot Breaches API
  version: v1
servers:
- url: https://public-api.tryriot.com/
security:
- apiKeyAuth: []
tags:
- name: Breaches
paths:
  /v1/breaches:
    get:
      description: 'Lists all breaches for a workspace with their affected employees count and status.


        **Scopes required:**

        - breaches:read'
      operationId: breaches_get_paginated_FAUE35Y
      parameters:
      - in: header
        name: x-item-limit
        required: false
        schema:
          default: 50
          deprecated: true
          maximum: 100
          minimum: 1
          type: integer
      - in: header
        name: x-next-cursor
        required: false
        schema:
          deprecated: true
          type: string
      - in: query
        name: cursor
        required: false
        schema:
          type: string
      - in: query
        name: limit
        required: false
        schema:
          default: 50
          maximum: 100
          minimum: 1
          type: integer
      - in: query
        name: workspace_id
        required: true
        schema:
          format: uuid
          type: string
      - explode: false
        in: query
        name: status
        required: false
        schema:
          items:
            $ref: '#/components/schemas/BreachStatusSchema'
          minItems: 1
          type: array
          uniqueItems: true
        style: form
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  data:
                    items:
                      $ref: '#/components/schemas/PaginatedBreachPayload'
                    type: array
                  metadata:
                    properties:
                      limit:
                        type: integer
                      next_cursor:
                        type:
                        - string
                        - 'null'
                    required:
                    - next_cursor
                    - limit
                    type: object
                required:
                - data
                type: object
          description: Breaches list
          headers:
            link:
              description: 'Link header with rel="next" pointing to the next page URL. Format: `<url>; rel="next"`'
              required: false
              schema:
                type: string
            x-next-cursor:
              description: Pagination cursor for the next page
              required: false
              schema:
                deprecated: true
                type: string
        '401':
          $ref: '#/components/responses/UnauthorizedErrorResponse'
        '403':
          $ref: '#/components/responses/ForbiddenErrorResponse'
        '422':
          $ref: '#/components/responses/UnprocessableContentErrorResponse'
        '429':
          $ref: '#/components/responses/RateLimitExceededErrorResponse'
      security:
      - apiKeyAuth:
        - breaches:read
      summary: List breaches
      tags:
      - Breaches
      x-riot-team-ownership: simulation
  /v1/breaches/statistics:
    get:
      description: 'Retrieves statistics about breaches for a given workspace, including impacted employees count, acknowledged employees count, and warned employees count.


        **Scopes required:**

        - breaches:read'
      operationId: breaches_get_statistics_FAUE35Y
      parameters:
      - in: query
        name: workspace_id
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: breached_after
        required: false
        schema:
          format: date-time
          type: string
      - in: query
        name: breached_before
        required: false
        schema:
          format: date-time
          type: string
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  data:
                    $ref: '#/components/schemas/BreachesStatisticsPayload'
                required:
                - data
                type: object
          description: Breaches statistics
        '401':
          $ref: '#/components/responses/UnauthorizedErrorResponse'
        '403':
          $ref: '#/components/responses/ForbiddenErrorResponse'
        '422':
          $ref: '#/components/responses/UnprocessableContentErrorResponse'
        '429':
          $ref: '#/components/responses/RateLimitExceededErrorResponse'
      security:
      - apiKeyAuth:
        - breaches:read
      summary: Get breaches statistics
      tags:
      - Breaches
      x-riot-team-ownership: simulation
  /v1/breaches/{breach_id}/compromised-employees:
    get:
      description: 'Lists all employees affected by a specific breach, ordered by their compromise date in descending order (most recent first).

        The breach notification and acknowledgement dates, and breached email accounts are provided.



        **Scopes required:**

        - breaches:read'
      operationId: breaches_get_breach_compromised_employees_FAUE35Y
      parameters:
      - in: header
        name: x-item-limit
        required: false
        schema:
          default: 50
          deprecated: true
          maximum: 100
          minimum: 1
          type: integer
      - in: header
        name: x-next-cursor
        required: false
        schema:
          deprecated: true
          type: string
      - in: query
        name: cursor
        required: false
        schema:
          type: string
      - in: query
        name: limit
        required: false
        schema:
          default: 50
          maximum: 100
          minimum: 1
          type: integer
      - in: path
        name: breach_id
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: workspace_id
        required: true
        schema:
          format: uuid
          type: string
      - in: query
        name: warned
        required: false
        schema:
          type: boolean
      - in: query
        name: acknowledged
        required: false
        schema:
          type: boolean
      responses:
        '200':
          content:
            application/json:
              schema:
                properties:
                  data:
                    items:
                      $ref: '#/components/schemas/PaginatedBreachCompromisedEmployeePayload'
                    type: array
                  metadata:
                    properties:
                      limit:
                        type: integer
                      next_cursor:
                        type:
                        - string
                        - 'null'
                    required:
                    - next_cursor
                    - limit
                    type: object
                required:
                - data
                type: object
          description: Compromised employees list for a breach
          headers:
            link:
              description: 'Link header with rel="next" pointing to the next page URL. Format: `<url>; rel="next"`'
              required: false
              schema:
                type: string
            x-next-cursor:
              description: Pagination cursor for the next page
              required: false
              schema:
                deprecated: true
                type: string
        '401':
          $ref: '#/components/responses/UnauthorizedErrorResponse'
        '403':
          $ref: '#/components/responses/ForbiddenErrorResponse'
        '404':
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/BreachNotFoundErrorResponse'
          description: no description
        '422':
          $ref: '#/components/responses/UnprocessableContentErrorResponse'
        '429':
          $ref: '#/components/responses/RateLimitExceededErrorResponse'
      security:
      - apiKeyAuth:
        - breaches:read
      summary: List compromised employees for a breach
      tags:
      - Breaches
      x-riot-team-ownership: simulation
components:
  responses:
    UnauthorizedErrorResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/UnauthorizedErrorResponse'
      description: Missing API key or the key is invalid
    UnprocessableContentErrorResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/UnprocessableContentErrorResponse'
      description: Unprocessable content
    ForbiddenErrorResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/ForbiddenErrorResponse'
      description: Requested resource cannot be accessed
    RateLimitExceededErrorResponse:
      content:
        application/json:
          schema:
            $ref: '#/components/schemas/RateLimitExceededErrorResponse'
      description: Rate limit is exceeded
  schemas:
    BreachedAccountPayload:
      additionalProperties: false
      properties:
        compromised_at:
          description: When the email was compromised
          format: date-time
          type: string
        email:
          description: The compromised email address
          examples:
          - john.doe@example.com
          type: string
      required:
      - compromised_at
      - email
      title: BreachedAccountPayload
      type: object
    UnauthorizedErrorResponse:
      additionalProperties: false
      properties:
        errors:
          items:
            additionalProperties: false
            properties:
              code:
                const: unauthorized
              detail:
                type: string
              source:
                properties:
                  pointer:
                    type: string
                required:
                - pointer
                type: object
              title:
                const: Unauthorized
            required:
            - title
            - source
            - detail
            type: object
          type: array
      required:
      - errors
      title: UnauthorizedErrorResponse
      type: object
    BreachNotFoundErrorResponse:
      additionalProperties: false
      properties:
        error:
          const: Breach not found
      required:
      - error
      title: BreachNotFoundErrorResponse
      type: object
    UnprocessableContentErrorResponse:
      additionalProperties: false
      properties:
        errors:
          items:
            additionalProperties: false
            properties:
              code:
                type: string
              detail:
                type: string
              source:
                properties:
                  pointer:
                    type: string
                required:
                - pointer
                type: object
              title:
                type: string
            required:
            - title
            - source
            - detail
            type: object
          type: array
      required:
      - errors
      title: UnprocessableContentErrorResponse
      type: object
    RateLimitExceededErrorResponse:
      additionalProperties: false
      properties:
        errors:
          items:
            additionalProperties: false
            properties:
              code:
                const: too_many_requests
              detail:
                type: string
              source:
                properties:
                  pointer:
                    type: string
                required:
                - pointer
                type: object
              title:
                const: Too Many Requests
            required:
            - title
            - source
            - detail
            type: object
          type: array
      required:
      - errors
      title: RateLimitExceededErrorResponse
      type: object
    PaginatedBreachCompromisedEmployeePayload:
      additionalProperties: false
      properties:
        acknowledged_at:
          description: When the employee acknowledged the breach
          format: date-time
          type:
          - string
          - 'null'
        breached_accounts:
          description: List of compromised email accounts
          items:
            $ref: '#/components/schemas/BreachedAccountPayload'
          type: array
        compromised_at:
          description: When the employee was last compromised for the breach domain
          format: date-time
          type: string
        employee:
          $ref: '#/components/schemas/EmployeeOverviewSchema'
        warned_at:
          description: When the employee was warned about the breach
          format: date-time
          type:
          - string
          - 'null'
      required:
      - breached_accounts
      - acknowledged_at
      - warned_at
      - compromised_at
      - employee
      title: PaginatedBreachCompromisedEmployeePayload
      type: object
    BreachesStatisticsPayload:
      additionalProperties: false
      properties:
        acknowledged_employees_count:
          description: Number of employees that have acknowledged breaches
          type: integer
        breaches_count:
          description: Total number of breaches
          type: integer
        impacted_employees_count:
          description: Number of employees impacted by breaches
          type: integer
        warned_employees_count:
          description: Number of employees warned about a breach
          type: integer
      required:
      - breaches_count
      - acknowledged_employees_count
      - warned_employees_count
      - impacted_employees_count
      title: BreachesStatisticsPayload
      type: object
    PaginatedBreachPayload:
      additionalProperties: false
      properties:
        acknowledged:
          description: Number of employees that have acknowledged this breach
          type: integer
        created_at:
          format: date-time
          type: string
        criticality:
          $ref: '#/components/schemas/BreachCriticalitySchema'
        domain:
          description: The affected domain
          examples:
          - shadow.tech
          type: string
        id:
          format: uuid
          type: string
        impacted:
          description: Number of employees impacted by this breach
          type: integer
        last_breached_at:
          description: When the latest breach occurred
          format: date-time
          type: string
        name:
          description: The name of the breach
          examples:
          - Shadow
          type: string
        status:
          $ref: '#/components/schemas/BreachStatusSchema'
        updated_at:
          format: date-time
          type: string
        warned:
          description: Number of employees that have been warned about this breach
          type: integer
      required:
      - acknowledged
      - warned
      - impacted
      - criticality
      - status
      - name
      - domain
      - last_breached_at
      - updated_at
      - created_at
      - id
      title: PaginatedBreachPayload
      type: object
    BreachStatusSchema:
      description: The breach is considered resolved when all impacted employees have acknowledged the breach
      enum:
      - active
      - resolved
      title: BreachStatusSchema
      type: string
    ForbiddenErrorResponse:
      additionalProperties: false
      properties:
        errors:
          items:
            additionalProperties: false
            properties:
              code:
                const: forbidden
              detail:
                type: string
              source:
                properties:
                  pointer:
                    type: string
                required:
                - pointer
                type: object
              title:
                const: Forbidden
            required:
            - title
            - source
            - detail
            type: object
          type: array
      required:
      - errors
      title: ForbiddenErrorResponse
      type: object
    BreachCriticalitySchema:
      enum:
      - high
      - low
      - medium
      title: BreachCriticalitySchema
      type: string
    EmployeeOverviewSchema:
      additionalProperties: false
      properties:
        id:
          description: UUID of the employee
          format: uuid
          type: string
        name:
          description: Name of the employee
          examples:
          - John Doe
          type:
          - string
          - 'null'
        primary_email_address:
          description: Email address
          examples:
          - john.doe@tryriot.com
          format: email
          type:
          - string
          - 'null'
        username:
          description: Username of the employee
          type:
          - string
          - 'null'
      required:
      - primary_email_address
      - username
      - name
      - id
      title: EmployeeOverviewSchema
      type: object
  securitySchemes:
    apiKeyAuth:
      in: header
      name: x-api-key
      type: apiKey