UpGuard userrisk API

openapi: 3.2.0
info:
  description: 'Access information from the CyberRisk platform programmatically using this API.


    You can find or generate an API key to access this API in your CyberRisk Account Settings.

    Please authorize all requests by setting the "Authorization" header to your api key.


    The base url for all public endpoints is https://cyber-risk.upguard.com/api/public'
  title: UpGuard CyberRisk breaches Userrisk API
  version: 1.13.2
servers:
- url: https://cyber-risk.upguard.com/api/public
security:
- API key in header: []
tags:
- name: userrisk
paths:
  /user_risk/app_categories/list:
    get:
      description: 'Retrieve a list of app categories for your organization.


        Required API key permissions: `User Risk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List app categories
      operationId: getUserRiskAppCategoriesList
      parameters:
      - description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
        schema:
          type: integer
          format: int64
      - description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
        schema:
          type: string
      - description: The field to sort results by. Default is `name`.
        name: sort_by
        in: query
        schema:
          type: string
          enum:
          - name
      - description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
        schema:
          type: string
          enum:
          - asc
          - desc
      responses:
        '200':
          description: A list of app categories for your organization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetUserRiskAppCategoriesListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '500':
          description: An internal system error occurred
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
  /user_risk/apps/list:
    get:
      description: 'Retrieve a list of apps for your organization.


        Required API key permissions: `User Risk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List apps
      operationId: getUserRiskAppsList
      parameters:
      - description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
        schema:
          type: integer
          format: int64
      - description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
        schema:
          type: string
      - description: The field to sort results by. Default is `name`.
        name: sort_by
        in: query
        schema:
          type: string
          enum:
          - name
          - first_detected
          - num_users
          - exposure_level
      - description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
        schema:
          type: string
          enum:
          - asc
          - desc
      - description: Filter applications by usage policy outcome. Matches the policy base rule or any custom rule.
        name: usage_policy_outcomes
        in: query
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            format: string
          enum:
          - approve
          - tolerate
          - nudge
          - block
      - description: Filter applications by where their usage policy is derived from.
        name: usage_policy_sources
        in: query
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            format: string
          enum:
          - org_default
          - app
      - description: Filter applications by category.
        name: categories
        in: query
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - description: Filter applications by source.
        name: sources
        in: query
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            format: string
          enum:
          - browser
          - google
          - microsoft
      - description: Filter applications by Shadow AI status.
        name: shadow_ai
        in: query
        schema:
          type: boolean
      - description: Filter applications by AI usage.
        name: vendor_using_ai
        in: query
        schema:
          type: boolean
      - description: Filter applications by vendor monitoring status.
        name: vendor_monitored
        in: query
        schema:
          type: boolean
      - description: Filter applications first detected after or at this date-time.
        name: first_detected_min
        in: query
        schema:
          type: string
          format: date-time
      - description: Filter applications first detected before or at this date-time.
        name: first_detected_max
        in: query
        schema:
          type: string
          format: date-time
      responses:
        '200':
          description: The list of apps for your organization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserRiskAppsListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '500':
          description: An internal system error occurred
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
  /user_risk/apps/permissions/list:
    get:
      description: 'Retrieve a list of permissions granted to a specific application.


        Required API key permissions: `User Risk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List app permissions
      operationId: getUserRiskAppsPermissionsList
      parameters:
      - description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
        schema:
          type: integer
          format: int64
      - description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
        schema:
          type: string
      - description: The field to sort results by. Default is `name`.
        name: sort_by
        in: query
        schema:
          type: string
          enum:
          - name
          - exposure_level
          - num_users
      - description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
        schema:
          type: string
          enum:
          - asc
          - desc
      - description: The name of the application.
        name: app_name
        in: query
        required: true
        schema:
          type: string
      responses:
        '200':
          description: A list of permissions granted to the application
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetUserRiskAppsPermissionsListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '500':
          description: An internal system error occurred
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
  /user_risk/apps/users/list:
    get:
      description: 'Retrieve a list of users using a specific application.


        Required API key permissions: `UserRisk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List app users
      operationId: getUserRiskAppUsersList
      parameters:
      - description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
        schema:
          type: integer
          format: int64
      - description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
        schema:
          type: string
      - description: The field to sort results by. Default is `id`.
        name: sort_by
        in: query
        schema:
          type: string
          enum:
          - id
          - email
          - name
          - risk_rating
      - description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
        schema:
          type: string
          enum:
          - asc
          - desc
      - description: The name of the application.
        name: app_name
        in: query
        required: true
        schema:
          type: string
      responses:
        '200':
          description: The list of users using the application
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserRiskAppUsersListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '500':
          description: An internal system error occurred
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
  /user_risk/identity_breaches/list:
    get:
      description: 'Retrieve a list of identity breaches for your organization.


        Required API key permissions: `User Risk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List identity breaches
      operationId: getUserRiskIdentityBreachesList
      parameters:
      - description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
        schema:
          type: integer
          format: int64
      - description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
        schema:
          type: string
      - description: The field to sort results by. Default is `title`.
        name: sort_by
        in: query
        schema:
          type: string
          enum:
          - title
          - breach_date
          - published_date
      - description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
        schema:
          type: string
          enum:
          - asc
          - desc
      - description: Filter identity breaches by status.
        name: statuses
        in: query
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
            format: string
          enum:
          - active
          - ignored
          - remediated
      - description: Filter identity breaches that occurred after or at this date-time.
        name: breach_date_min
        in: query
        schema:
          type: string
      - description: Filter identity breaches that occurred before or at this date-time.
        name: breach_date_max
        in: query
        schema:
          type: string
      - description: Filter identity breaches published after or at this date-time.
        name: published_date_min
        in: query
        schema:
          type: string
      - description: Filter identity breaches published before or at this date-time.
        name: published_date_max
        in: query
        schema:
          type: string
      - description: Filter identity breaches by exposed data classes.
        name: data_classes
        in: query
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      responses:
        '200':
          description: A list of identity breaches
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdentityBreachesListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '500':
          description: An internal system error occurred
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
  /user_risk/identity_breaches/users/list:
    get:
      description: 'Retrieve a list of users involved in a specific identity breach.


        Required API key permissions: `User Risk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List identity breach users
      operationId: listIdentityBreachUsers
      parameters:
      - description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
        schema:
          type: integer
          format: int64
      - description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
        schema:
          type: string
      - description: The field to sort results by. Default is `id`.
        name: sort_by
        in: query
        schema:
          type: string
          enum:
          - id
          - email
          - name
          - risk_rating
      - description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
        schema:
          type: string
          enum:
          - asc
          - desc
      - description: The unique identifier of the identity breach.
        name: id
        in: query
        required: true
        schema:
          type: string
      responses:
        '200':
          description: A list of users involved in the identity breach
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/IdentityBreachUsersListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '500':
          description: An internal system error occurred
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
  /user_risk/permissions/apps/list:
    get:
      description: 'Retrieve a list of applications that were granted a specific permission.


        Required API key permissions: `User Risk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List permission apps
      operationId: getUserRiskPermissionsAppsList
      parameters:
      - description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
        schema:
          type: integer
          format: int64
      - description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
        schema:
          type: string
      - description: The field to sort results by. Default is `name`.
        name: sort_by
        in: query
        schema:
          type: string
          enum:
          - name
          - first_detected
          - num_users
          - exposure_level
      - description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
        schema:
          type: string
          enum:
          - asc
          - desc
      - description: The unique identifier of the permission.
        name: id
        in: query
        required: true
        schema:
          type: string
      responses:
        '200':
          description: A list of apps that were granted the permission
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetUserRiskPermissionsAppsListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '500':
          description: An internal system error occurred
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
  /user_risk/permissions/list:
    get:
      description: 'Retrieve a list of permissions for your organization.


        Required API key permissions: `User Risk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List permissions
      operationId: getUserRiskPermissionsList
      parameters:
      - description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
        schema:
          type: integer
          format: int64
      - description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
        schema:
          type: string
      - description: The field to sort results by. Default is `name`.
        name: sort_by
        in: query
        schema:
          type: string
          enum:
          - id
          - name
          - exposure_level
          - times_granted
      - description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
        schema:
          type: string
          enum:
          - asc
          - desc
      - description: Filter permissions by category.
        name: categories
        in: query
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
      - description: Filter permissions by access level.
        name: access_level
        in: query
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
          enum:
          - read_only
          - read_write
      - description: Filter permissions by exposure level.
        name: exposure_level
        in: query
        style: form
        explode: true
        schema:
          type: array
          items:
            type: string
          enum:
          - basic
          - elevated
      responses:
        '200':
          description: A list of permissions for your organization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetUserRiskPermissionsListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '500':
          description: An internal system error occurred
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
  /user_risk/permissions/users/list:
    get:
      description: 'Retrieve a list of users who granted a specific permission.


        Required API key permissions: `User Risk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List permission users
      operationId: getUserRiskPermissionsUsersList
      parameters:
      - description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
        schema:
          type: integer
          format: int64
      - description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
        schema:
          type: string
      - description: The field to sort results by. Default is `id`.
        name: sort_by
        in: query
        schema:
          type: string
          enum:
          - id
          - email
          - name
          - risk_rating
      - description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
        schema:
          type: string
          enum:
          - asc
          - desc
      - description: The unique identifier of the permission.
        name: id
        in: query
        required: true
        schema:
          type: string
      responses:
        '200':
          description: A list of users who granted the permission
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetUserRiskPermissionsUsersListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '500':
          description: An internal system error occurred
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
  /user_risk/roles/list:
    get:
      description: 'Retrieve a list of roles for your organization.


        Required API key permissions: `User Risk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List roles
      operationId: getUserRiskRolesList
      parameters:
      - description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
        schema:
          type: integer
          format: int64
      - description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
        schema:
          type: string
      - description: The field to sort results by. Default is `name`.
        name: sort_by
        in: query
        schema:
          type: string
          enum:
          - name
          - user_count
      - description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
        schema:
          type: string
          enum:
          - asc
          - desc
      responses:
        '200':
          description: A list of roles for your organization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetUserRiskRolesListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '500':
          description: An internal system error occurred
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
  /user_risk/teams/list:
    get:
      description: 'Retrieve a list of teams for your organization.


        Required API key permissions: `User Risk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List teams
      operationId: getUserRiskTeamsList
      parameters:
      - description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
        schema:
          type: integer
          format: int64
      - description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
        schema:
          type: string
      - description: The field to sort results by. Default is `name`.
        name: sort_by
        in: query
        schema:
          type: string
          enum:
          - name
          - user_count
      - description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
        schema:
          type: string
          enum:
          - asc
          - desc
      responses:
        '200':
          description: A list of teams for your organization
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/GetUserRiskTeamsListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '429':
          description: Too many requests have been made to this endpoint.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '500':
          description: An internal system error occurred
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
  /user_risk/users/apps/list:
    get:
      description: 'Retrieve a list of apps used by a specific user.


        Required API key permissions: `UserRisk` (select when creating API key in Account Settings)'
      tags:
      - userrisk
      summary: List a user apps
      operationId: getUserRiskUserAppsList
      parameters:
      - description: The page size of results to return. If not supplied, default is 100.
        name: page_size
        in: query
        schema:
          type: integer
          format: int64
      - description: The `page_token` from a previous request, use this to get the next page of results.
        name: page_token
        in: query
        schema:
          type: string
      - description: The field to sort results by. Default is `name`.
        name: sort_by
        in: query
        schema:
          type: string
          enum:
          - name
          - first_detected
          - exposure_level
      - description: The direction to sort results. Default is `asc`.
        name: sort_dir
        in: query
        schema:
          type: string
          enum:
          - asc
          - desc
      - description: The ID of the user to retrieve the apps for
        name: id
        in: query
        required: true
        schema:
          type: string
      responses:
        '200':
          description: The list of app for a user
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/UserRiskUseAppsListResponse'
        '403':
          description: Your API key does not have permission to perform this action.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/endpointError'
        '422':
          description: An invalid parameter was supplied or a mandatory parameter was missing
          content:
            application/json:
            

# --- truncated at 32 KB (69 KB total) ---
# Full source: https://raw.githubusercontent.com/api-evangelist/upguard/refs/heads/main/openapi/upguard-userrisk-api-openapi.yml