SecurityScorecard Scorecard Notes API

openapi: 3.2.0
info:
  title: All Companies & VSOR Customer API - OpenAPI 2.0 Scorecard…
  description: API Definition for All Companies & VSOR Customer Facing API
  version: 1.0.0
servers:
- url: https://api.securityscorecard.io
security:
- Token: []
tags:
- name: scorecard-notes
  description: Operations about scorecard notes
paths:
  /scorecard-notes/{domain}:
    get:
      tags:
      - scorecard-notes
      summary: Find scorecard notes
      description: Searches scorecard notes by any of the allowed fields. Results are paginated.
      operationId: findScorecardNotes
      parameters:
      - name: domain
        in: path
        description: Filter by followed company domain
        required: true
        schema:
          type: string
      - name: sort
        in: query
        description: Sort by any of the allowed fields. Use "-" for DESC order. Default sort by created_at DESC.
        schema:
          type: string
          enum:
          - created_at
          - -created_at
          - updated_at
          - -updated_at
          - created_by
          - -created_by
          - updated_by
          - -updated_by
      - name: page
        in: query
        description: Current page (zero-based)
        schema:
          type: integer
          default: 0
      - name: page_size
        in: query
        description: Results per page
        schema:
          type: integer
          minimum: 10
          maximum: 100
          default: 20
      responses:
        '200':
          description: Successful operation
          content:
            application/json; charset=utf-8:
              schema:
                type: object
                properties:
                  entries:
                    type: array
                    items:
                      $ref: '#/components/schemas/Note'
                  page:
                    type: integer
                    description: Current page (zero-based)
                  size:
                    type: integer
                    description: Total number of records
        '400':
          description: Bad request
components:
  schemas:
    Note:
      type: object
      properties:
        id:
          type: string
          format: uuid
        note:
          type: string
          example: Example note description
        created_at:
          type: string
          format: date-time
        updated_at:
          type: string
          format: date-time
        created_by:
          type: object
          properties:
            id:
              type: string
              format: uuid
            first_name:
              type: string
              example: John
            last_name:
              type: string
              example: Doe
            username:
              type: string
              example: john_doe
        updated_by:
          type: object
          properties:
            id:
              type: string
              format: uuid
            first_name:
              type: string
              example: John
            last_name:
              type: string
              example: Doe
            username:
              type: string
              example: john_doe
  securitySchemes:
    Token:
      type: apiKey
      in: header
      name: Authorization
      description: 'SecurityScorecard API endpoints require an authentication token to be passed\nin an authorization header in order to return data. If you do not already\nhave a token, you can create one by going to the API Access area in your\n[Settings page](https://platform.securityscorecard.io/#/settings/api) and then\nclicking Generate New Token. Please note this tokens have no expiration\nso they can be used until manually revoked. If you have a token and generate\na new one, the previous token will be revoked and can no longer be used.\n\nAdministrators can also revoke API tokens for any user in their account.\n\nOnce you have your token you can pass it in using the `Authorization` http header like this:\n\n```\ncurl -X GET \\\n  https://api.securityscorecard.io/portfolios \\\n  -H ''authorization: Token \u003Cyour token\u003E''\n```'
x-provenance:
  method: searched
  source: https://securityscorecard.readme.io/reference
  harvested: '2026-10-14'
  tool: harvest-readme-openapi.py
  note: Assembled verbatim from the OpenAPI definition ReadMe embeds in each operation page of the provider's developer portal; paths and components merged by API title, nothing authored.
  assembled_from:
  - https://securityscorecard.readme.io/reference/deletefollowedcompanybydomain.md
  - https://securityscorecard.readme.io/reference/executecustomtagsfollowedcompaniesbulkcreateoperation.md
  - https://securityscorecard.readme.io/reference/executecustomtagsfollowedcompaniesbulkdeleteoperation.md
  - https://securityscorecard.readme.io/reference/executefollowedcompaniesbulkdeleteoperation.md
  - https://securityscorecard.readme.io/reference/executefollowedcompaniesbulkupdateoperation.md
  - https://securityscorecard.readme.io/reference/findfollowedcompanies.md
  - https://securityscorecard.readme.io/reference/findscorecardnotes.md
  - https://securityscorecard.readme.io/reference/getfollowedcompanybydomain.md
  - https://securityscorecard.readme.io/reference/updatefollowedcompanybydomain.md
  merge:
    pages: 9
    deduped: 13
    conflicts_kept_first: 0